[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 23 Apr 2021 09:40:45 -0400
From: James Feister <openjaf@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Malicious commits to Linux kernel as part of
university study
> "Someone else might be even more unethical later" is a horrible reason
> to refrain from calling out unethical research methods. This community
> needs to make it absolutely clear that nonconsensual adversarial
> "research" is completely unacceptable, or next year you'll see five
> hundred grant applications intending to throw government-sponsored
> wrenches into every piece of collaboratively-written software on Earth.
It is naive to think this adversarial behavior is not already taking place.
The overall response I have seen to this should be encouraging to all of
us that live in these open-source and free software communities. It
shows how our system works. In this case, the actors were identified,
attributed to a publicly known group, and weeded out. The key part is
the information was freely shared, everyone knows about it and can take
what they feel are appropriate actions. Just like the submissions to this
very mailing list help facilitate and the discussions that follow.
As much as we can blame the University or group for the efficacy of their
intent, we should assume this behavior has and is already happening.
There is no other reason not to. It is a wake-up call to those who think
otherwise, in public, private, and government sectors. In this case, the
project's maturity ensured the proper people were able to identify
the actor and take appropriate actions.
My suggestion to part of the solution would not be any single technical
process. It would be to ask that more commercial and government
agencies ensure some of their budgeted resources (aka people) are
used to help maintain the free software and open-source software they
leverage. Yes, it will bring a whole new set of challenges, but it may tip
the scale to favor those who are there to help.
- Jim
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
