A university got itself banned from the Linux kernel

theverge.com

8 points·Tomte··4 comments

"One could argue that their process was similar, in principle, to that of white-hat hacking: play around with software, find bugs, let the developers know."

No. Just no. You cannot argue that introducing vulnerabilities in one of the most critical piece of open-source software as a test to see if it will get through is "white hat". Had they talked with Greg beforehand, maybe, but as the situation stands right now this is grey hat at best.

Whether you think this research was okay of not, even a very liberal definition of white hat simply isn't compatible with what they did.

Big original discusssion: https://news.ycombinator.com/item?id=26887670

Big followup discussion from yesterday: https://news.ycombinator.com/item?id=26982309

TL; DR: The Linux developers did not approve of pro bono process vulnerability assessment.

They want to know that there is an experiment going on. But knowing this would affect the outcome - developers would pay extra attention to potentially-"hypocrite" patches.

This is a bad summary which ignores the important aspects of the discussion:

- When you do a research, you have to get consent from your subjects.

- When you do a research, you have to compensate your subjects for their time.

Neither of those points were respected.

And yes, you can obtain consent without divulgating the exact process that will be used. All psychology researchers know how to do that effectively and ethically.

Reply on news.ycombinator.com