Conversation

Replying to

and

s/submit/land doesn't make it a revelation either. Of course open source is effectively build upon trust. And it's worth noting that the patches that most recently re-awakened this subject were actually "caught" pretty quickly.

Replying to

and

Again, they didn't submit these patches from university email addresses and you're continuing to engage in slandering students not involved in it. That's unethical behavior too. Spreading misinformation as misdirection, especially attacking innocent people, is not okay.

Replying to

Definitely not widely accepted that by using open source software, you inherently trust any random person able to submit code to a mailing list from Gmail. Pretty big difference between trusting the developers of a project and trusting anyone able to submit patches to it.

Replying to

and

I mean. What? Yeah it is. No one sits and audits every line of code in ANY FOSS software they use, nor even the contributors list. The top 5 contributors list here shows two major cohorts NOT from known institutions: news.itsfoss.com/huawei-kernel-

Replying to

You REALLY were somehow surprised by the revelation that tons of anonymous or near-anonymous contributors work on the Linux kernel? REALLY?

GIF

read image description

ALT

Replying to

and

You're simply continuing to make disingenuous arguments. I never said anything of the kind. I'm well aware of the serious systemic security issues of the Linux kernel, which go way beyond an unsafe language and very lax code review. I really don't need you to explain it to me.

Replying to

and

Why are you clutching pearls over the results of the UMN study, then?

Replying to

and

Clutching pearls? What? I'm simply explaining that to many people, the findings of the study are far from obvious. It was obvious to me, and clearly to you, but it isn't to many people. Scientific studies demonstrating something some people think is obvious aren't useless.

Replying to

and

A thing that's obvious to the bulk of people within a community and not obvious to people outside that community is obvious enough not to warrant and unethically administered study to publicizing it. Especially when the study inherently impedes the meaningful work being done.

Replying to

and

The 4 or so patches they submitted as part of the study hardly wasted much time. The vast majority of the time being wasted and the harm being done is because of kernel maintainers exaggerating what happened, spreading misinformation and attempting collective punishments for it.

Replying to

twitter.com/kees_cook/stat The claims you're making about their overall work on the kernel are simply not accurate, including what you're claiming about that recent patch. They've done a lot of useful work, and the study on testing the code review process was only ~4 patches.

Quote Tweet