Looking back at the UMN episode

Greg Kroah-Hartman started off by posting a link to a presentation he put together with David Wheeler on the UMN episode. He described the events as "the university sent some crap patches, we caught them". The community, he said, is pretty much over it now. The university apologized, and meanwhile the wider security community, which has been worried about the prospect of Trojan-horse patches for years, was thankful that all of this had come out and gotten people thinking about this kind of problem.

Recently, UMN has reached out to kernel developers, asking how it can restart its involvement with the kernel community; Kroah-Hartman has put them in touch with a kernel developer who will guide them. He is working on writing a document on how research groups should collaborate with the development community; he promised to post a draft over the weekend.

Kees Cook noted that the UMN community is large and has had a number of people moving through it. There were two issues that arose in April: low code quality from UMN in general, and one bad actor. Even that actor was not truly malicious, he said, "just dumb", but nobody in UMN caught his activities in time. Kroah-Hartman said that this episode woke up a lot of people; we were lucky that we caught it. He also offered his apology for yelling at the UMN researchers; he gets to be mad once per year, he said, and this was the time for this year.

Ted Ts'o said that the assembled group should consider more general issues of code quality and how much attention should be paid to security both before and after code is submitted. He mentioned the discovery of a wide set of security problems in the just-merged ksmbd file server, which have evidently been discussed in private for a while before the topic spilled over onto the linux-kernel list. We are continuing to put security bugs into the kernel, and that seems unlikely to change, he said.

Kroah-Hartman then claimed to have written more security bugs than anybody else; in general, core developers are responsible for the most security problems in the kernel. We are all "known good actors who are accidentally malicious", he said. Cook agreed that bug creation was almost entirely "volume based"; the more code a developer writes, the more bugs they create.

Ts'o tried to return the conversation to malicious actors, noting that the UMN developers "weren't smart" about how they tried to add bugs to the kernel. But what if there are malicious actors who are smarter? The only solution, he said, was better tools to try to detect security issues. Kroah-Hartman closed the session by saying that the community has to get better at catching all of the bugs it creates, regardless of whether they are intentional or not.