University of Minnesota Banned from Contributing to the Linux Kernel for Submitting Nonsense Fixes for a Research Project

[Tensimeter]

Summary

Greg Kroah-Hartman, the maintainer of the Linux Kernel's stable branch, has banned anyone using a University of Minnesota email address from contributing to the open-source Linux kernel. Researchers from the university had been submitting patches that were "known-buggy" to judge the communitiy's reaction to them. Without informing anyone of what happened, the researchers then published a paper on the topic.

 

Quotes

From one of the researchers:

Quote

Greg,
 

I respectfully ask you to cease and desist from making wild accusations that are bordering on slander.

[...]

Obviously, it is a wrong step but your preconceived biases are so strong that you make allegations without merit nor give us any benefit of doubt. I will not be sending any more patches due to the attitude that is not only unwelcome but also intimidating to newbies and non experts.

 

In response to the above message, Greg Kroah-Hartman said:

Quote

You, and your group, have publicly admitted to sending known-buggy patches to see how the kernel community would react to them, and published a paper based on that work.

[...]

Because of this, I will now have to ban all future contributions from your University and rip out your previous contributions, as they were obviously submitted in bad-faith with the intent to cause problems.

 

Update: The university's "CS&E" department released this statement:

https://cse.umn.edu/cs/statement-cse-linux-kernel-research-april-21-2021

Quote

Leadership in the University of Minnesota Department of Computer Science & Engineering learned today about the details of research being conducted by one of its faculty members and graduate students into the security of the Linux Kernel. The research method used raised serious concerns in the Linux Kernel community and, as of today, this has resulted in the University being banned from contributing to the Linux Kernel.

 

We take this situation extremely seriously. We have immediately suspended this line of research. We will investigate the research method and the process by which this research method was approved, determine appropriate remedial action, and safeguard against future issues, if needed. We will report our findings back to the community as soon as practical.

 

Sincerely,

 

Mats Heimdahl, Department Head
Loren Terveen, Associate Department Head

 

My thoughts

This is quite an unfortunate waste of Kernel maintainer's time. Even though the way the research was conducted is extremely questionable ethically (the researchers did not consider this human research even though humans were directly involved), there is still something to learn from this. The fact that the researchers' activities were not noticed until after the paper was published does show that it can be difficult to try and catch bad actors in an open-source project. Of course, this is not a new issue for open projects, the general solution as it has always been is more people and tools looking out for bad actors.

 

Sources

The mailing list thread where the above quotes were found:

https://lore.kernel.org/linux-nfs/YH%2FfM%2FTsbmcZzwnX@kroah.com/

Articles about the thread:

https://www.neowin.net/news/linux-bans-university-of-minnesota-for-sending-buggy-patches-in-the-name-of-research/

https://fosspost.org/researchers-secretly-tried-to-add-vulnerabilities-to-linux-kernel/

https://www.phoronix.com/scan.php?page=news_item&px=University-Ban-From-Linux-Dev

The research paper in question:

https://github.com/QiushiWu/QiushiWu.github.io/blob/main/papers/OpenSourceInsecurity.pdf

[emosun]

It's almost as if people don't like being unknowingly used as test subjects

cough cough , microsoft

[Beerzerker]

Wasting time over BS is just that and can't blame the guys maintaining the kernel for the ban.
Waste my time over some self important, self-contrived BS?

Get lost already and I'll even help you to and through the door.

[givingtnt]

Guys guys guys, gather round I have an Idea..
Let's all write code for the forum that will let bots in to see how soon mortis gets a heart attack, and then tell the whole world it was our idea and how we did it !

Seriously, who in their right mind thought this was a good idea !?

[suicidalfranco]

when you are not paid, and have to deal with this level of bs.

good on the Linux team for this decision.

[sazrocks]

Quote

 has banned anyone from the University of Minnesota from contributing to the open-source Linux kernel.

To be clear, individuals from UMN are still free to contribute, just not from a UMN email address. This ban is more aimed at university organizations.

[Tensimeter]

2 minutes ago, sazrocks said:

To be clear, individuals from UMN are still free to contribute, just not from a UMN email address. This ban is more aimed at university organizations.

Thanks, you're right, I edited the post to be more clear about this.

[Guest willies leg]

Interesting background on the "researchers"

[jaslion]

22 minutes ago, emosun said:

It's almost as if people don't like being unknowingly used as test subjects

cough cough , microsoft

You'd think microsoft and their near infinite money would at least want to make the slightest attempt at not making windows so undesireable that people would jump ship in a heatbeat the moment a fully viable alternative rolls around. But I know they won't having heard, read and been told the stories (and visuals) of how horrific their coding is and how basically nobody knows how stuff works anymore.

[BondiBlue]

Good. What made them think they had the right to use the Linux kernel as a subject for their own research, especially when said research involves submitting bogus patches? What a waste of time. 

[emosun]

7 minutes ago, jaslion said:

You'd think microsoft and their near infinite money would at least want to make the slightest attempt at not making windows so undesireable that people would jump ship in a heatbeat the moment a fully viable alternative rolls around. But I know they won't having heard, read and been told the stories (and visuals) of how horrific their coding is and how basically nobody knows how stuff works anymore.

I think the fact that windows 10 was and literally is still free and nobody wanted it is kinda the big red flag

[jaslion]

38 minutes ago, emosun said:

I think the fact that windows 10 was and literally is still free and nobody wanted it is kinda the big red flag

I mean it basically went wrong at 8 in terms of just massive programming bloat and they will keep it going till it can't anymore in 10. For some reason one of the biggest companies in the world making the most popular os feels like on of the most understaffed badly managed startups ever.

[kvuj]

Considering 95+% of the Internet, 90+% of phones run Linux and the insane amount of money being pumped into it by various companies, I'm not sure it was wise to purposely insert vulnerabilities . Many big players could be a bit angry.

[piemadd]

Yeah I'm extremely happy that I denied my acceptance into that BS of an institution. If their ethics board said yes to stuff like that who knows what I would go there as a student.

[HarryNyquist]

Oh my god, they got their IRB to think this wasn't "human research"

 

Someone is getting fired for this. Lmao

[trag1c]

It's one thing to unknowingly commit a bug to a repo...but to purposefully do it is disgusting. That kernel is basically the infrastructure for our digital world and using it as a plaything should not be taken lightly.

[Brooksie359]

1 hour ago, pierom_qwerty said:

Yeah I'm extremely happy that I denied my acceptance into that BS of an institution. If their ethics board said yes to stuff like that who knows what I would go there as a student.

What ethics board oversees every project don't? It likely never knew about it. I would say the professor that allowed this to happen is more to blame. 

[staticpage]

I'm amazed that non of the students took pause, my fist class in CIT was ethics. That being said we won't be hiring anyone that comes from that mess of a program.

[BuckGup]

20 hours ago, emosun said:

It's almost as if people don't like being unknowingly used as test subjects

cough cough , microsoft

Microsoft

Facebook

Google

Apple

...

 

Literally every large tech company is experimenting daily on their users. That's how they advance their own tech

[duncannah]

4 hours ago, Tensimeter said:

The fact that the researchers' activities were not noticed until after the paper was published does show that it can be difficult to try and catch bad actors in an open-source project.

So much for public scrutiny

[Taf the Ghost]

I do love how the asshole researcher goes to "[o]bviously, it is a wrong step but your preconceived biases are so strong that you make allegations without merit nor give us any benefit of doubt. I will not be sending any more patches due to the attitude that is not only unwelcome but also intimidating to newbies and non experts." They published a public paper on it. How stupid is this person? If they have a PhD, the university should ask for it back.

 

There's a sub-point about a lot of the dust ups in OSS lately being in utterly bad faith. This is just the one that looks the most stupid. Impressive, in some ways.

[AnonymousGuy]

Uh...this is a serious ethical violation from this professor.  You can't conduct research that has a material impact on other people and be like "just a prank bro" when they get pissed.

[AnonymousGuy]

4 hours ago, duncannah said:

So much for public scrutiny

Are you really surprised?  Tons of code is so obscure that there's probably only a handful of people capable of understanding it even if they were getting paid to do it, and most of those people aren't getting paid.  Open source is like a pig on cocaine...you don't know which way its going.  Could be great, could be dog shit.  At least when you have a paid service you get some predictability more of the time.

[andrewnyr]

Many of you have the wrong idea. While Microsoft and other tech companies do have beta programs, no one is committing malicious code on purpose. Comparing this incident to big tech companies is stupid to say the least.

[Bombastinator]

Completely ignoring the ban there is serious academic problems with this.  This amounts to using the community as experimental subjects without their permission.  That’s a really fundamental academic

6 hours ago, Taf the Ghost said:

I do love how the asshole researcher goes to "[o]bviously, it is a wrong step but your preconceived biases are so strong that you make allegations without merit nor give us any benefit of doubt. I will not be sending any more patches due to the attitude that is not only unwelcome but also intimidating to newbies and non experts." They published a public paper on it. How stupid is this person? If they have a PhD, the university should ask for it back.

 

There's a sub-point about a lot of the dust ups in OSS lately being in utterly bad faith. This is just the one that looks the most stupid. Impressive, in some ways.

That phd thing may actually happen. This is a real face-palmer