skysight-inc/HackerNews huggingface dataset:
The University of Minnesota IRB never should have approved this research. So this is an institutional level problem. This is not just a problem with some researchers.

It's unfortunate that many people will get caught up in this ban that had nothing to do with it, but the university deserves to take a credibility hit here. The ball is now in their court. They need to either make things right or suffer the ban for all of their staff and students.
Well, there's nothing easier to corrupt than a small company (not just in the PRC), because you could found one specifically to introduce vulnerabilities without breaking any laws in any country I know of.
Remote code execution in Homebrew by compromising the official Cask repository
No, that's a both sides false equivalence kind of argument.

In context - and especially in light of yesterday's verdict - it's really rather unconvincing.
Get Good Feedback
And it has gotten the University banned from contributing to the kernel. Hope it was worth it.
Are they even killing a mosquito?

Someone wants to introduce bugs, they can.

Meanwhile lots of people banned for some other person's actions.
> Research without ethics is research without value.

didn't we learn a lot from nazi/japanese experiments from ww2?
Thanks for pointing that out. 4 hours old, 1000+ points, it seems to have been hit with an invisible penalty.
> Why no radical approach has been taken to fix it?

And then you go on to suggest what amounts to barely obfuscated ethnic cleansing. Radical indeed.
This is so cool! Also love how easy it is to verify my identity and pull up the graph. it's interesting to see how many people in my CH are people I went to school with, even though most of them signed up later.
I've never run into the phantom employee but I did work with one guy who ended up being the last person at a remote site who then picked up a second remote fulltime job.

I light a candle to his memory now and again.
I don't understand the promise of lattice confinement fusion. While it is certain believable that they measured fusion events, the explanation they give involves several unlikely steps of one particle hitting another. Since each step is unlikely, the overall gain of the process is extremely low, like 10^(-6). It's not obvious how the gain might be improved to something technologically useful (over 1).
Carrying out an attack for personal gain is malicious. It doesn't matter if the payload is for crypto mining, creating a backdoor for the NSA, or a vulnerability you can cite in a paper.

Pentesting unwitting participants is malicious, and in many cases illegal.
‘Now-and-then’ views of Poland
Commenters have been reasonably accusing the researchers of bad practice, but I think there's another possible take here based on Hanlon's razor: "never attribute to malice that which is adequately explained by stupidity".

If you look at the website of the PhD student involved [1], they seem to be writing mostly legitimate papers about, for example, using static analysis to find bugs. In this kind of research, having a good reputation in the kernel community is probably pretty valuable because it allows you to develop and apply research to the kernel and get some publications/publicity out of that.

But now, by participating in this separate unethical research about OSS process, they've damaged their professional reputation and probably setback their career somewhat. In this interpretation, their other changes were made in good faith, but now have been tainted by the controversial paper.

[1] https://qiushiwu.github.io/
The question isn't whether the variant is in the population (of course we can assume it is), the question is whether it differs enough from the prior variant to break through past immunization at the population level.
He is doing a great job. But I think a few insults earlier on might have prevented a whole lot of trouble.
Sounds like YouTube and Facebook.
if you define yourself as a developer do yourself a favour and learn SQL. It's probably much easier than whatever programming language you use and will avoid you many headaches.
Here's the commit specifically identified by Leon Romanovsky as having a "built-in bug"

https://github.com/torvalds/linux/commit/8e949363f017
In the follow up chain it was stated that some of their patches made it to stable: https://lore.kernel.org/linux-nfs/YH%2F8jcoC1ffuksrf@kroah.c...

Can someone who's more invested into kernel devel find them and analyze their impact? That sounds pretty interesting to me.

Edit: This is the patch reverting all commits from that mail domain: https://lore.kernel.org/lkml/20210421130105.1226686-1-gregkh...

Edit 2: Now that the first responses to the reversion are trickling in, some merged patched were indeed discovered to be malicious, like the following. Most of them seem to be fine though or at least non malicious. https://lore.kernel.org/lkml/78ac6ee8-8e7c-bd4c-a3a7-5a90c7c...
The remote RCE issues Apple has had are critical vulnerabilities. Saudi Arabi doesn't like you, they exploit remotely (maybe not even knowing who you are at all yet) to get your data / your contact lists and social graph etc - and you could be impacted or others could be impacted as a result in a major way.

This exploit requires that they already know who you are and where you live and where you go get coffee. They have to send a physical attacker to stalk your coffee shop. They have to have this equipment to run the impersonation exercise - and then wait until you are picking up coffee and airdropping something.

And after all this they get your email and phone number? So they know all these details about you but can't be bothered to use true people search or ANY of the data brokers or any of the giant data leaks to look this up?

Apple is selling a CONSUMER device. If your threat model is this elaborate, stick your phone in a faraday cage and leave it at home, someone could just grab it out of your hand at the coffee shop and be likely to get a lot more data.

So yes, it's a risk - but on the scale of risks including just being straight mugged and your phone stolen, it seems somewhat lower?
> However this sentence made me inadvertently laugh, because it captures every bit of confusion I had

Haha, for further context, .NET 5 is the SDK + runtime. ASP.NET Core is the default Web framework that includes a ton of out of the box functionality.

I'd highly recommend taking a read of https://docs.microsoft.com/en-us/aspnet/core/introduction-to..., which links to the relevant tutorials for your scenario.
Related: The Forgotten Employee (2002)

https://news.ycombinator.com/item?id=17332440
I'm just going by publicized, real world attacks, which I think fall under the 3 categories I listed.

> These vulnerabilities are discovered through testing and more importantly real world usage.

FWIW I disagree that real world usage is necessarily more important. It is quite important, but at the same time the real world usage isn't going to hit all sorts of weird quirky paths. By contrast, Rustls has 97% line coverage, OpenSSL has ~65%. Of course, coverage isn't everything, but that's notable.

> It's not a formal proof. It could still be wrong.

So long as the type system is sound, I'm not sure this is true. If you embed a state machine into your type system your type system guarantees that the state machine executes as defined. Granted this is not checking against an external model.

I will say that rustls still will benefit from wider adoption and more evaluation but imo it addresses the largest concerns today.
Right, my comment was the other way around; I don't know whether infinite Tetris is Turing complete.
This is a topic I think a lot about. I don't have a lot of time this morning so I will just say a few things ...

First, the OP describes an eSIM for his mobile phone - in this case with a provider named "silent.link". In my experience, eSIMs provide "voip" numbers and not actual "mobile" numbers. This is an important distinction since most 2FA verifications[1] come not from a phone number, but from a "short code"[2] and voip numbers cannot receive SMS from a short code. So you are quite limited in what services you can sign up for and maintain with just an eSIM.

Second, the term "threat model" does not appear in the article. This is important because if your threat model is "everyone except state level actors" or "everyone but state level actors AND my bank" the possibilities open up dramatically. I think there is a tremendous amount of benefit in remaining anonymous in relation to your carrier and the FAANGs and (various vendors) that is realistic to achieve - but anonymity in relation to state level actors is practically impossible.

Third, there is a big, giant blind spot in the entire chain of identity and that is the following: VISA/MC do not validate name and address[3]. It seems like they do - and merchants believe that they do - but they do not. This means you can use your bank card with any name you like and the minimal address match (which, in the US, is zip code). I'm not going to diagram this out for you but if your threat model is (everyone except bank and state level actors) you now have the basis for a working pseudonym.

Fourth, a second blind spot in the chain of identity is a business tax ID (which you can get for free at[4]). Many providers (like mobile carriers) ask for things like SSN, etc., but if you say "business" and give them a tax ID, it's like their brains turn off. They typically don't even ask for ID. You can initiate service over the phone. You may be forced to pay a higher rate for "business service".

[1] gmail, your bank, even twilio (ironically).

[2] https://en.wikipedia.org/wiki/Short_code

[3] AMEX does.

[4] https://sa.www4.irs.gov/modiein/individual/index.jsp
See https://en.wikipedia.org/wiki/Parkinson%27s_law#Formula for an example of this.
AMD Ryzen 7 5800U - 15/25 watts TDP

Apple M1 - 10 watts TDP

If the numbers are accurate, then it is close. However, each company measures TDP in different ways. Plus AMD can boost to 30W for short periods of time. Obviously the boost is good when you need it. The big question, how does this affect battery consumption?

That said, AMD's biggest issue is supply. I don't know if it is supply issues from TSMC, or component issues with the OEMs. But it is nearly impossible to buy a 5800u.
I think the ban hits the right institution, but I'd reason the other way around: is it really the primary fault of the individual (arguably somewhat immature, considering the tone of the email) PhD Student? The problem in academia is not "bad apples", but problematic organizational culture and misaligned incentives.
Every time I have seen Theo from the OpenBSD project come down hard on someone, it was deserved.
So has "Fusion is always 30 years away"[1] turned into "Fusion is always 10 years away?"

1 https://www.discovermagazine.com/technology/why-nuclear-fusi...
Once you are large enough to control the government then you are the government, you can eliminate competition and thus have no incentive to be efficient.
I worked at Ford as a contractor back in the 80's. They regularly hired contractors, usually from India on a green card, through body shops. The body shop could be making $30/hr while the contractor was getting a pittance in exchange for the green card. And because the body shop was sponsoring their green card, the "employee" couldn't switch to another company. Pretty horrible.

Instead of going through a body shop, which I refused to do, Ford just required that I was incorporated. This completely lets them off the hook on the contractor vs employee question. Did the same thing with IBM.

Forming an LLC is something that at least here in Indiana can be done in a few days by filling out a form online with the state and getting a tax id with the IRS. This allows you (actually, your LLC) to be directly hired at any company without them taking any risk of you being classified as an employee.
Chink spies
this is not surprising to me given the quality of minnesotta universities. U of M should be banned from existence. I remember vividly how they'd break their budgets redesigning cafeterias, hiring low quality 'professors' that refused to make paper assignments digitized. (They didnt know how). Artificially inflated dorm costs without access to affordable cooking. (Meal plans only). They have bankrupted plenty of students that were forced to drop out due to their policies on mental health. It's essentially against policy to be depressed or suicidal. They predate on kids in high school who don't at all know what they're signing up for.

Defund federal student loans. Make these universities stand on their own two feet or be replaced by something better.
The parent commenter is talking about the "currently online" indicator, which can't be disabled. From a (strangely worded) WhatsApp doc:

> Please note you can't hide your online.

https://faq.whatsapp.com/general/chats/about-last-seen-and-o...
That's true, because a 100% open minded person would believe anything uncritically, without questioning it. That's why I said fairly open minded. But if you refuse to discuss it then what else can I say.
UiPath Was Inevitable
It's not a ban on people, it's a ban on the institution that has demonstrated they can't be trusted to act in good faith.

If people affilated with the UMN want to contribute to the Linux kernel, they can still do that on a personal title. They just can't do it as part of UMN research, but given that UMN has demonstrated they don't have safeguards to prevent bad faith research, that seems reasonable.
I don't like it either but it's not as bad as it sounds: the ban almost certainly isn't enforced mindlessly and with no recourse for the affected.

I'm pretty sure that if someone from the University of Minnesota would like to contribute something of value to the Linux kernel, dropping a mail to GregKH will result in that being possible.
> It's obvious: you have a cultural problem, and you can't change people... so have to replace people.

This makes no sense at all. The government exists to serve those people who are getting replaced, so if you fix their problems by replacing them then nothing has actually been solved. You’re putting the importance of the government and the region over the people which is backwards.
Great work Kosta, I've met him, he's brilliant.

The fact that it's essentially trivial for a non-technical/non-expert to uncover obvious elements of fraud I think gives pause to the oft-repeated mantle "Our Control is Essential To Your Security". There are some voices here who oddly believe that their limited choice is a price worth paying for quality, but the reality is there's no legitimate reason for Apple to not allow 3rd party downloads if users so chose, and, no legitimate reason for them to not provide considerably more transparency in the approval process.

The paradox is, that unlike Amazon.com who may or may not actually benefit from a deluge of fake goods, Apple definitely doesn't need these scammy apps around for it's own benefit.
I know someone from state school that went to Microsoft. His personal projects seemed to be the factor that made him stand out.
Going public with the demands is a risky strategy, as now Apple’s response will be publicly known.

If they pay the ransom, it sends a message to everyone with access to confidential Apple manufacturing materials that they are sitting on millions of dollars of ransom material.

I would guess that Apple will refuse to engage in order to avoid incentivizing everyone in their manufacturing chain from trying the same stunt. Instead, they’ll go to great lengths to investigate the leak and punish the manufacturer responsible for leaking the material.

Schematics don’t hold much an exceptionally high value given that they could be reverse engineered from the product by sufficiently funded individuals. However, it would represent a leak of the details of upcoming products which is something Apple goes to great lengths to avoid.
I suppose it depends on what you make of Greg's opinion (I am only vaguely familiar with this topic, so I have none).

> They obviously were _NOT_ created by a static analysis tool that is of any intelligence, as they all are the result of totally different patterns, and all of which are obviously not even fixing anything at all. So what am I supposed to think here, other than that you and your group are continuing to experiment on the kernel community developers by sending such nonsense patches?

Greg didn't think that the static analysis excuse could be legitimate as the quality was garbage.
It feels like a corollary of memetic assholery in online communities. Essentially the R0 [0] of being a dick.

If I have a community, bombarded by a random number of transient bad actors at random times, then if R0 > some threshold, my community inevitably trends to a cesspool, as each bad actor creates more negative members.

If I take steps to decrease R0, one of which may indeed be "blunt- and harshness to new contributors", then my community may survive in the face of equivalent pressures.

It's a valid point, and seems to have historical support via evidence of many egalitarian / welcoming communities collapsing due to the accumulation of bad faith participants.

The key distinction is probably "Are you being blunt / harsh in the service of the primary goal, or ancillary to the mission?"

[0] https://en.m.wikipedia.org/wiki/Basic_reproduction_number
Or just grab the phone out of your hand - most people take their phones out of their pocket all the time even on the street. I used to ride a bus and they would grab phones and jump off just as bus would leave a stop. You can actually often get a ton more data this way if you have physical custody of device - no airdrop impersonation needed.
Being pro-free-market is against the interests of incumbents, and if in fact an incumbent was pro-free-market regardless then that is laudable. Incumbents are protected by regulations.

There is a lot to dislike about the Daily Mail I'm sure (I don't read it). But you aren't catching them in a moment of hypocrisy here. Everyone hates losing, doesn't mean they are wrong about what the rules of the game should be.
"Some"

How many people didn't and did? The numbers seem absurd.
Channel sell through may be impacted if new products are known ahead of their sales schedule, resulting in unsold inventory or discounts
The UMN had worked on a research paper dubbed "On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits".

I guess it's not as feasible as they thought.
Sorry, LAPP. Just postgresql instead of mysql. Not sure what I was thinking... I still love Linux. ;)
You mean B.C.?
>I mean I understand that people in academia are becoming increasingly disconnected from the real world, but wow this is low.

I don't have data to back this up, but I've been around a while and I can tell you papers are rejected from conferences for ethics violations. My personal observation is that infosec/cybersecurity academia has been steadily moving to higher ethical standards in research. That doesn't mean that all academics follow this trend, but that unethical research is more likely to get your paper rejected from conferences.

Submitting bugs to an open source project is the sort of stunt hackers would have done in 1990 and then presented at a defcon talk.
Well, if there's no process, then it's not ethical (and sometimes, not legal) to purposefully introduce bad commits or do things like that. You need consent.

Firstly, it accomplishes nothing. We already all know that PRs and code submission is a potential vector for buggy code or security vulnerabilities. This is like saying water is wet.

Secondly, it wastes the time of the people working on the linux kernel and ruins the trust of code coming from the university of minnesota.

All of this happened due to caring about one's own research more than the ethics of doing this sort of thing. And continuing to engage in this behavior after receiving a warning.
High-performance JavaScript SDK that reduced execution time from 200 to 20-60ms
Prompted to download PDF, assumed is 5d chess malware, didn't read \s
That might be what OS'es currently _are_, but I disagree that it is what an OS _is_. I think fundamentally an OS is as the OP uses it, a set of code that interfaces with all your hardware to make the computer function.

Heres a good talk I came across in a HN comment a little while back [1] about how games used to be developed vs how they are today.

[1] - https://www.youtube.com/watch?v=kZRE7HIO3vk
The problem with this analysis is that he seems to think things like paid exclusives are good for consumers, rather than just externalities of platform competition that harm consumers.

By this logic anything Apple that limits monetization strategies of 3rd parties, even if it benefits the consumer* would be regarded as a problem.

I would like to see whether a fully open ecosystem ends up producing a better result than Apple’s “managed” approach.

We will never find out if Apple is forced to stop managing their ecosystem.
> In reality, several of their bad commits made it into the stable branch.

Is it known whether these commits were indeed bad? It is certainly worth removing them just in case, but is there any confirmation?
I suspect the university will take some sort of action now that this has turned into incredibly bad press (although they really should have done something earlier).
This isn't some employer-employee trust relationship. The whole point of the test is that you can't trust a patch just because it's from some university or some major company.
If the state where you live wants to know if you've been at a protest, they have more efficient ways of figuring that out than sending someone out to walk around, trying to collect AirDrop IDs. That should be the least of your worries.

I mean sure, I'm not saying there's no issue here. But it certainly isn't 'huge' either.
Can you move your desk to the basement ? And while you're there....
That's why it's more fun to try to optimize for size
If you want an orm that encourages you to use sql instead of abstracting it, you can look at my library: https://github.com/Seb-C/kiss-orm
I think he wants to be untracable from start to end, no credit card.
It’s worth noting that standard news practice of selective choice of images is going to give you a skewed a perspective.
> since it is the de-facto SMS standard in my country.

Same in my country, I don't think Americans (or the American tech culture) realise how ubiquitous WhatsApp is in Europe and around the world.
Dupe. https://news.ycombinator.com/item?id=26889677
Whether the law to enforce consequences exists or not, smart contracts will still provide value. Some of those contracts will be exploited, and the law will not help in 99% of cases.
That's fine, I have no plans to become one. I'm not legally trained, nor do I pretend to be.

The Daily Mail, however, has spent the last few years describing the UK judiciary as "Enemies of the People", so they can continue to cry me a river.
Some clarifications since they are unclear in the original report.

- Aditya Pakki (the author who sent the new round of seemingly bogus patches) is not involved in the S&P 2021 research. This means Aditya is likely to have nothing to do with the prior round of patching attempts that led to the S&P 2021 paper.

- According to the authors' clarification [1], the S&P 2021 paper did not introduce any bugs into Linux kernel. The three attempts did not even become Git commits.

Greg has all reasons to be unhappy since they were unknowingly experimented on and used as lab rats. However, the round of patches that triggered his anger *are very likely* to have nothing to do with the three intentionally incorrect patch attempts leading to the paper. Many people on HN do not seem to know this.

[1] https://www-users.cs.umn.edu/~kjlu/papers/clarifications-hc....
That's one seizure, of a small number according to the source. The claim was 'keeps seizing'...
You need to remove the vulnerable PHP script too
I haven’t stated anything to be a problem; only given the lay of the land.