Date: Thu, 22 Apr 2021 12:41:54 -0400 From: Santiago Torres <torresariass@...il.com> To: oss-security@...ts.openwall.com Subject: Re: Malicious commits to Linux kernel as part of university study > *ALL* OSS projects should review proposed changes for potential security > issues, and harden their software & supply chain against attacks. > I also welcome research to make that better! > But we don’t need researchers who perform attacks > on production systems without authorization, or perform > attacks on developers without their consent. Agreed, when I first heard about the paper in November I was very excited to read about it, as I sometimes face skepticism about SC attacks (less so, now that they appear more in the news). Research in the space is important, but this is akin to cutting the brakes on a bus to see when the drivers or the passengers find out... To add to things, I don't think the researchers themselves are aware on how the lkml actually works. They wouldn't be able to assess the result of their experiment, or prepare a meaningful explanation for the IRB with such a flawed model. I'm not trying to point fingers at anybody here, but us academics need to do some soul-seeking in terms of how we engage with the rest of the software-world. Thanks, -Santiago Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.