Re: [MAINTAINER SUMMIT] Rethinking the acceptance policy for "trivial" patches

From: Geert Uytterhoeven <geert@linux-m68k.org>
To: James Morris <jmorris@namei.org>
Cc: Julia Lawall <julia.lawall@inria.fr>,
	Stephen Hemminger <stephen@networkplumber.org>,
	 Roland Dreier <roland@kernel.org>,
	Steven Rostedt <rostedt@goodmis.org>,
	 James Bottomley <James.Bottomley@hansenpartnership.com>,
	ksummit@lists.linux.dev
Subject: Re: [MAINTAINER SUMMIT] Rethinking the acceptance policy for "trivial" patches
Date: Thu, 22 Apr 2021 09:34:38 +0200	[thread overview]
Message-ID: <CAMuHMdU=c2bY1_sq+rSh1fON5QhNx8xWqMQLT+cD0BpqG0RtCg@mail.gmail.com> (raw)
In-Reply-To: <d95ee281-4dc0-c5c1-ec87-81d83f44979@namei.org>

On Wed, Apr 21, 2021 at 11:50 PM James Morris <jmorris@namei.org> wrote:
> On Wed, 21 Apr 2021, Julia Lawall wrote:
> > The apology states that they didn't detect any vulnerabilities.  They
> > found three non exploitable bugs and submitted incorrect patches for them.
> > When the patches received some positive feedback, they explained that the
> > patches were incorrect and provided a proper fix.
> >
> > So they damaged trust, but not actually the Linux kernel...
>
> The issue is that there was no consent and no coordination, so we don't
> know the scope of the experiment and whether it was still continuing.
>
> We are this not able to trust anything the group said about what they'd
> done or not done, until now [1].
>
> In all probability there is nothing further amiss but we would not have
> expected them to use fake gmail accounts to submit bugs to the kernel
> either.
>
> It's now on us to audit all of their known contributions, because we don't
> know the scope of the experiment, which was based on the use of deception,
> and we can't make any assumptions based on what they have said.
>
> We also need the identity of the 'random' gmail accounts they used,
> although this should be handled by a small trusted group in private, as it
> will lead to privacy issues for kernel maintainers who responded to them
> in public.

What do we gain by blindly reverting all[1] umn.edu patches, and
ignoring future patches from umn.edu?
I think all of this is moot: other people may be doing the same thing,
or even "in worse faith".  The only thing that helps is making sure
patches get reviewed[2] before being applied.

[1] Judging from the new review comments, many of the 190 patches
    to be reverted were real fixes.
[2] Whether we can trust the reviewers is another question, and might
    become the topic of another research project :-(

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds