[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <YIKH4FHGjJ0d4p4n@wopr>
Date: Fri, 23 Apr 2021 01:40:00 -0700
From: Kurt H Maier <khm@...ops.net>
To: oss-security@...ts.openwall.com
Subject: Re: Malicious commits to Linux kernel as part of
university study
On Fri, Apr 23, 2021 at 01:02:36AM +0200, Jan Engelhardt wrote:
>
> If you alert the crowd that something is about to happen, you can no
> longer observe how the crowd acts in an unalerted state, dooming the
> research effort.
This could have been coordinated with kernel maintainers who were
willing to participate, for instance by placing sabotaged code in a
time-locked escrow to be revealed after a set window. This is not
an all-or-nothing proposition. Red team protocols vary, but none of
them start with "first, pick an unsuspecting cadre of strangers trying to
build something, then attack it."
> Not to encourage UMN's conduct, but I'd find that the prank shows on TV
> (let alone Youtube) are a much more severe intrusion, but somehow those
> shows still run.
Those prank shows are generally not produced with money from the
National Science Foundation.
> What's more, with the pitchfork way this incident is being responded to,
> future researchers may choose to operate more stealthily; no more
> mailings from an edu mail address, more elaborate internet avatars (did
> we ever prove who George Spelvin was?), up to the point that the
> identities become indistinguishable from a foreign malignent elite
> hacker group.
"Someone else might be even more unethical later" is a horrible reason
to refrain from calling out unethical research methods. This community
needs to make it absolutely clear that nonconsensual adversarial
"research" is completely unacceptable, or next year you'll see five
hundred grant applications intending to throw government-sponsored
wrenches into every piece of collaboratively-written software on Earth.
I'm more disappointed with the IEEE S&P for accepting this paper than I
am with the researchers who wrote it, but giving them a pass sets the
worst possible standards for future work.
khm
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
