Doğaç Eldenk

Doğaç Eldenk

@dogac.dev

Software Engineer @ CarbonHealth · Read my blog at https://blog.dogac.dev · https://github.com/Dogacel

57 followers117 following31 posts

View full thread
Doğaç Eldenk
@dogac.dev

According to the apology letter, the research on stealthily introducing vulnerabilities was concluded last year and those commits were a product of a new research which aims to fix kernel security bugs. Also reverting all commits would result in losing valuable fixes.

View full thread
Doğaç Eldenk
@dogac.dev

Looking at what the professor at UMN published in 2020, "On the Feasibility of Stealthily Introducing Vulnerabilities in Open-Source Software via Hypocrite Commits" This paper was the reason why Linux maintainers were so sceptical about the patch.

View full thread
Doğaç Eldenk
@dogac.dev

However the OP claims those commits are auto-generated by some experimental tool and did not carry a bad intention. There is also some evidence that the same professor worked on static analysis tools.

Doğaç Eldenk
@dogac.dev

However another maintainer mentions he took a look at OP's patches and 3 of 4 are seemed to be adding bugs. This creates a lot of suspicion on OP's intentions and they immediately decide to revert all PR's coming from UMN (the university of the researchers) and ban them from any contribution.

View full thread
Doğaç Eldenk
@dogac.dev

Couple contributors quickly join, some argue there isn't a double-free bug and some say it should be fixed in a different way. However a major kernel developer Greg KH answered,

Doğaç Eldenk
@dogac.dev

> Please stop submitting known-invalid patches. Your professor is playing around with the review process in order to achieve a paper in some strange and bizarre way. > > This is not ok, it is wasting our time, and we will have to report this, AGAIN, to your university...

Doğaç Eldenk
@dogac.dev

It starts with a patch on the GSS-based authentication (auth_gss.c) used within the linux kernel's SunRPC implementation. SunRPC is developed by Sun Microsystems as a part of their NFS implementation. That patch supposedly prevents a "double-free" bug.

Doğaç Eldenk
@dogac.dev

First time hitting the homepage on Hacker News. To be honest I was scared to be handling all that traffic from my home server. And here it goes, it was fun until it lasted.

Doğaç Eldenk
@dogac.dev

Son olarak şunu eklemeliyim, bu soru "Illegal Content" hakkındaydı. Fakat ülke bazında gelen istekler bu kadar net olmayabilir. Misal yakın zamanda konuşulan Kıbrıs meselesinde yapılan bir yorum ya bir ülkede ya da diğer ülkede illegal sayılabilir. O halde bu konunun PDS'de hiç bulunmaması lazım.

Doğaç Eldenk@dogac.dev

@fka.dev Bluesky ve AT Protocol'un orijinal makalesini okuduğumda da bu soru aklıma geldi ve Martin Kleppman'a direkt özelden yazmıştım, sağolsun hızlıca cevap vermişti. Özetle PDS operatörlerinin ilgilenmesi lazım, ama app view'ın da bazı sorumlulukları var. Cevapı aşağıya yazıyorum.

You are up to date.