undefined | Better HN

0 pointsinetknght4y ago0 comments

> 1. The experiment is not on live, deployed, versions of the kernel.

The patches were merged and the email thread discusses that the patches made it to the stable tree. Some (many?) distributions of Linux have and run from stable.

> 2. There are mechanisms in place for preventing actual merging of the faulty patches.

Those mechanisms failed.

> 3. Even if a patch is merged by mistake, it can be easily backed out or replaced with another patch, and the updates pushed anywhere relevant.

Arguably. But I think this is a weak argument.

0 comments

einpoklum4y ago

> The patches were merged

The approved methodology - described in the linked paper - was that when a patch with the introduced vulnerabilities is accepted by its reviewer, the patch submitter indicates that the patch introduces a vulnerability exists, and sends a no-vulnerability version. That's what the paper describes.

If the researchers did something other than what the methodology called for (and what the IRB approved), then perhaps the analogy may be valid.

Zevis4y ago

There are literally mails in that list pointing out that commits made it to stable. At least read the damn thing before repeating the professor's/student's nonsense lies.

einpoklum4y ago

The mails in the pointed-to threads indicate that commits by those UMin people made it to stable; it does not say that commits which introduce bugs made it to stable - it is following a decision/suggestion to back out all patches by these people to the kernel.

There is further indication that the patches to revert are not mostly/not at all vulnerability-introducing patches in a message by "Steve" which says:

> The one patch from Greg's reverts that affects my code was actually a legitimate fix

So, again, while it is still theoretically possible that vulnerabilities were introduced into stable, that is not known to be the case.

1 more reply

j / k navigate · click thread line to collapse

0 pointsinetknght4y ago0 comments

> 1. The experiment is not on live, deployed, versions of the kernel.

The patches were merged and the email thread discusses that the patches made it to the stable tree. Some (many?) distributions of Linux have and run from stable.

> 2. There are mechanisms in place for preventing actual merging of the faulty patches.

Those mechanisms failed.

> 3. Even if a patch is merged by mistake, it can be easily backed out or replaced with another patch, and the updates pushed anywhere relevant.

Arguably. But I think this is a weak argument.

0 comments

einpoklum4y ago

> The patches were merged

If the researchers did something other than what the methodology called for (and what the IRB approved), then perhaps the analogy may be valid.

Zevis4y ago

There are literally mails in that list pointing out that commits made it to stable. At least read the damn thing before repeating the professor's/student's nonsense lies.

einpoklum4y ago

There is further indication that the patches to revert are not mostly/not at all vulnerability-introducing patches in a message by "Steve" which says:

> The one patch from Greg's reverts that affects my code was actually a legitimate fix

So, again, while it is still theoretically possible that vulnerabilities were introduced into stable, that is not known to be the case.

1 more reply

j / k navigate · click thread line to collapse