Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <YIGnUqbkYtqOAQCx@meme-cluster>
Date: Thu, 22 Apr 2021 12:41:54 -0400
From: Santiago Torres <torresariass@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Malicious commits to Linux kernel as part of
 university study

> *ALL* OSS projects should review proposed changes for potential security
> issues, and harden their software & supply chain against attacks.
> I also welcome research to make that better!
> But we don’t need researchers who perform attacks
> on production systems without authorization, or perform
> attacks on developers without their consent.

Agreed, when I first heard about the paper in November I was very
excited to read about it, as I sometimes face skepticism about SC
attacks (less so, now that they appear more in the news). 

Research in the space is important, but this is akin to cutting the
brakes on a bus to see when the drivers or the passengers find out...

To add to things, I don't think the researchers themselves are aware on
how the lkml actually works. They wouldn't be able to assess the result
of their experiment, or prepare a meaningful explanation for the IRB
with such a flawed model. I'm not trying to point fingers at anybody
here, but us academics need to do some soul-seeking in terms of how we
engage with the rest of the software-world.

Thanks,
-Santiago

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.