His reaction was that after the previous incident, from a year ago, he couldn't blindly trust something coming from the same source. That group has done no wrong, but they are barely a part of this overall discussion.
This is not the same source! It's the same UNIVERSITY, which has thousands of students every year. And the source of the bugs wasn't even from university addresses, it was from random gmail addresses.
Aditya submitted LEGITIMATE patches based on his static analysis tool.
He is being slandered because people won't take 5 seconds to learn the facts.
>And the source of the bugs wasn't even from university addresses, it was from random gmail addresses.
I don't know why this really matters. They could be running a similar experiment this time pretending UMN was compromised.
I'm not sure who Pakki is, if he's not part of the first research group at all it is truly unfortunate he is receiving the blame for it. If he was, the internet's reaction is still unwarranted but frankly typical. I don't see how Kroah-Hartman is at fault though.
Because Greg's response doesn't actually address any problem, it's purely grandstanding. The researchers explicitly performed their work not using university addresses, so banning the university does nothing. As Kees Cook has already noted, the vast majority of patches from the university are legitimate.
> I'm not sure who Pakki is
The researcher who submitted output from his legitimate research to try to fix bugs. Greg responded by insulting him, saying he is incompetent, stating that he is malicious, and then that he would ban the university over this.
How could Greg not be at fault? His post made false allegations against Aditya, claiming that he was acting maliciously, and because no one fucking reads anymore, people think Aditya was trying to insert vulnerabilities into the kernel.
I believe Greg was not saying Aditya was both incompetent and malicious. Greg was saying incompetent or malicious. The incompetence stemmed from how Aditya handled his static analysis patches: seemingly no manual review and no explicit statement that the patches were from a tool (which is apparently standard procedure).
Most of Aditya's patches were legitimate. Multiple upstream developers have confirmed this:
> https://lore.kernel.org/lkml/CACRpkdbw_sF2FO0jjq47KStUjvhKvW...
Other kernel maintainers have already picked up on this.
> You, and your group, have publicly admitted to sending known-buggy patches to see how the kernel community would react to them, and published a paper based on that work.
Here is a direct quote from Greg where he falsely alleges that Aditya is responsible for the previous work.
> Now you submit a new series of obviously-incorrect patches again,
Many of the patches are correct - see the above link where one maintainer points this out.
> So what am I supposed to think here, other than that you and your group are continuing to experiment on the kernel community developers by sending such nonsense patches?
Another false allegation that Aditya is experimenting on the kernel, attributing malice.
> You were not asking for help, you were claiming that these were legitimate fixes, which you KNEW to be incorrect.
Many were legitimate. Again, a false accusation from Greg.
Then Greg goes on to attack him some more, instead of just explaining things to him, like "Hey, in the future can you add 'found by tool xyz'". In other mailing lists kernel maintainers point out that that would have been the sane response, not going to bother to link that.
> Our community welcomes developers who wish to help and enhance Linux. That is NOT what you are attempting to do here, so please do not try to frame it that way.
In fact, that is exactly what Aditya was trying to do.
> Our community does not appreciate being experimented on, and being "tested" by submitting known patches that are either do nothing on purpose, or introduce bugs on purpose.
Aditya did no such thing.
Greg's response is indefensible. It's just littered with insults and attacks, and factually incorrect allegations against a legitimate security researcher.
99% of his reaction was related to the previous paper's actions, it's unfortunate that Pakki is getting the blame but from the first post Kroah-Hartman tried to deflect blame away from him.
Where are people getting this from? Greg literally, explicitly, accuses Aditya of malice. I have repeatedly quoted him doing so.
Again, quoting for the millionth time,
"> You, and your group, have publicly admitted to sending known-buggy patches to see how the kernel community would react to them, and published a paper based on that work."
YOU. The first word. In a response to Aditya. It's a false allegation, it's literally incorrect.
Aditya was NOT one of the researchers involved in that previous work.
Followed by "and your group," which is exactly what my last post said. And even if he was not part of the group that carried out the previous work, he would still be part of the UMN CS research program that "publicly admitted to sending known-buggy patches..."
I've said multiple times it seems that Pakki is receiving far more blame than he deserves. He merely submitted bad patches and got defensive about the manner in which they were rejected.