One final lesson that one might be tempted to take is that the kernel is running a terrible risk of malicious patches inserted by actors with rather more skill and resources than the UMN researchers have shown. That could be, but the simple truth of the matter is that regular kernel developers continue to insert bugs at such a rate that there should be little need for malicious actors to add more.
Not saying what they were doing was in any way ok, but I do doubt there's any way to measure what they were trying to measure without deliberately introducing bugs into some sort of review stream. Merely using observational data would produce results that are approximately as useful as those of every other observational design. (to wit: not very)
Dmitry Vyuko[0] estimated in 2019 that each kernel release contains >20,000 bugs. As an outsider looking in, it seems that the kernel needs a lot more boots on the ground focusing on maintenance.
[0] https://www.youtube.com/watch?v=iAfrrNdl2f4 ~0:00-3:30 for statement.
But you can also flip it and ask if this feature focus is really helping or hurting. The parts of the work that look like 'feature factory' work should be treated as suspect. On some projects that can be half of the new work. We get so consumed trying to figure out if we can do something that we don't stop to think if we should.
In a volunteer organization, however, you have to create a certain amount of busy work in order to make sure that new volunteers have stepping stones to becoming bigger contributors. Did this need to be done? No, but we needed a way to get Tom from point A to point C, where we really need his help, and so we had him do B even though it's not really much of a priority.
Following kernel development a decade ago, that was exactly my opinion as well. Maintenance of older, creakier stuff gets little attention. Adding shiny new buggy features was all the rage. Code and architecture review was spotty at best, and a lot of shiny new things caused damage to old things, but no one cared because the new things were shiny.
I mean, it's not like dependency package injection have been proven to be a good way to hack back doors or anything. /S
P.s.- as a non contributor, I know I'm being a bit dickish. The truth is these researchers proved thier point in spades and no one wants to admit it. I
This seems like a rather lackadaisical take on the situation.
If UMN is an APT group, then it is reasonable to ban them.