"Full disclosure" from the University of Minnesota

Posted Apr 28, 2021 17:44 UTC (Wed) by wtarreau (subscriber, #51152)
Parent article: "Full disclosure" from the University of Minnesota

It's nice they've finally published everything, but quite frankly, all that for that...

I mean, they draw conclusions such as "it's easy to inject bugs" when all their attempts failed, and they base their reasoning on "one patch that was accepted could have brought a bug if it had been different" (but did not) and "one patch was rejected but the reviewer didn't comment on a second issue that was hidden in it". Do they want that people comment on all their mistakes to justify a patch rejection ?

Finally "have you thought about wasting even more time using a myriad of tools and complex processes to improve your faulty security?" is laughable at best since it basically demonstrates they've never been involved in reviewing code for distributed projects, that they have no idea what they're speaking about, yet they have good advices to share!

Thank you very much for knocking on the door but we don't need your laundry detergent, we get the same result by washing by hand, and in less time, so we eliminate more crap at the end of the day.

"Full disclosure" from the University of Minnesota

Posted Apr 28, 2021 22:47 UTC (Wed) by amacater (subscriber, #790) [Link] (3 responses)

It's as if, for any given situation, there exists an xkcd that is apposite just as if Randall Monroe were monitoring - https://xkcd.com/2456/

XKCD 2456

Posted Apr 29, 2021 9:32 UTC (Thu) by pr1268 (subscriber, #24648) [Link] (2 responses)

And if I understand how Monroe set up his web page, that's the latest (as of 29 April 2021) XKCD. How convenient (or even prescient)...

And, just curious,

WE SCANNED SOME UNDERGRADUATES

I don't get that, but perhaps that's the point. 😕

XKCD 2456

Posted Apr 29, 2021 11:38 UTC (Thu) by rschroev (subscriber, #4164) [Link]

> I don't get that, but perhaps that's the point

An explanation can be found, as always, on the explain xkcd wiki: https://www.explainxkcd.com/wiki/index.php/2456:_Types_of...

> We scanned some undergraduates:

>> Some initial research, especially that on a low budget, may recruit students at the same institution as easily available test-subjects. Quite often these are psychological or sociological studies, but can involve more medical (but non-invasive) 'scans', from simple eyeball-tracking to full-body MRI. When misread as "scammed", this paper can also refer to numerous famous psychological studies done before the establishment of certain ethical rules, such as the Milgram experiment.

XKCD 2456

Posted May 5, 2021 10:09 UTC (Wed) by ceplm (subscriber, #41334) [Link]

>> WE SCANNED SOME UNDERGRADUATES
>
> I don't get that, but perhaps that's the point.

The most affordable testing human material for the university researchers are sophomores, so they are by far the most common test subjects of most human research studies. There are many researchers in social and experimental psychology (where I have some knowledge of the field) acutely aware of how many papers are distorted by most of the research done on not-completely-mature and in-many-other-ways special test subjects.

"Full disclosure" from the University of Minnesota

Posted Apr 29, 2021 17:28 UTC (Thu) by HenrikH (subscriber, #31152) [Link]

Quite clear that they come to, and wrote, their conclusion before they tested their hypothesis. And now they are trying to verify their original conclusions by changing the goal posts (they did not reject the patch due to the real problem and so on).

"Full disclosure" from the University of Minnesota

Posted Apr 30, 2021 10:28 UTC (Fri) by Uqbar (guest, #121169) [Link]

I hope the kernel team will keep the permanent ban. For two reasons.

1. Software development has rules, just like democracy.
They tried to break the rules. And they did that with one of the most "important" and valuable projects with clear intention to do harm.

2. The kernel team doesn't work for you, the submitter. And not even the other way around (I think). You work for the community with code and documentation contributions. If there's no code and documentation contribution there's little room for you.