I am a Developer Advocate for Security in Mobile Apps and APIs at approov.io.
Another passion is the Elixir programming language that was designed to be concurrent, distributed and fault tolerant.
Location
Scotland
Education
Self teached Developer
Work
Developer Advocate for Mobile and API Security at approov.io
But there's a right way and a wrong way to do it. You don't go testing how to defuse a live nuke by just clipping random wires and hoping for a good outcome.
This are not exactly comparable things.
If the code gets merged to the mainstream branch its not released to the public immediately or it shouldn't be, therefore the researchers would then reveal that they have failed and the commit would be reverted.
The research team should have had complete approval from senior leadership who knew exactly what they were doing beforehand.
I have worked in the past in a factory where a leak could kill everyone in a radius of up to x kilomenters, depending on the wind and leak.
Emergency exercises where carried out to test the responsiveness of local authorities and of all employees in the factory, and when done everyone involved was aware that they would occur, therefore the outcome was always excellent. So they always contained the leak in around 20 minutes with the help of the fireman department of the nearest city.
They would appoint an hour to the exercise and then have police in all intersections from the fireman station to the factory and all employees involved in the emergency were already in their battle positions, therefore the exercise was always a tremendous success.
In real life if a leak occurs the police will not be in all intersections, or in any, the fireman will take the double of the time to leave the station and to arrive to the factory, the employees in the factory will have to stop their current task, run to the nearest protection equipment, get dressed up and then go to fight the leak, this if they don't get killed by the leak before they have time to put the mask.
So, yes I agree with tests being carried out without their knowledge, because that's the only true way to test their resistance against the supply chain attack, anything else it's just theoretical and may not reveal the issues that their process may have.
If their process releases the Linux kernel to the public when a merge request is approved, then their process is flawed and vulnerable to be exploited more easily. They must put it in a staging phase before it can reach the public.
For further actions, you may consider blocking this person and/or reporting abuse
We're a place where coders share, stay up-to-date and grow their careers.
This are not exactly comparable things.
If the code gets merged to the mainstream branch its not released to the public immediately or it shouldn't be, therefore the researchers would then reveal that they have failed and the commit would be reverted.
I have worked in the past in a factory where a leak could kill everyone in a radius of up to x kilomenters, depending on the wind and leak.
Emergency exercises where carried out to test the responsiveness of local authorities and of all employees in the factory, and when done everyone involved was aware that they would occur, therefore the outcome was always excellent. So they always contained the leak in around 20 minutes with the help of the fireman department of the nearest city.
They would appoint an hour to the exercise and then have police in all intersections from the fireman station to the factory and all employees involved in the emergency were already in their battle positions, therefore the exercise was always a tremendous success.
In real life if a leak occurs the police will not be in all intersections, or in any, the fireman will take the double of the time to leave the station and to arrive to the factory, the employees in the factory will have to stop their current task, run to the nearest protection equipment, get dressed up and then go to fight the leak, this if they don't get killed by the leak before they have time to put the mask.
So, yes I agree with tests being carried out without their knowledge, because that's the only
trueway to test their resistance against the supply chain attack, anything else it's just theoretical and may not reveal the issues that their process may have.If their process releases the Linux kernel to the public when a merge request is approved, then their process is flawed and vulnerable to be exploited more easily. They must put it in a staging phase before it can reach the public.