<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">Nick writes:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">< <span style="color:black">Let’s say I was an evil genius and wanted to introduce evil code into a project on github. What would happen? ><o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal"><b><span style="font-size:12.0pt"><o:p> </o:p></span></b></p>
<p class="MsoNormal">Typically the person maintaining the project will require modestly-sized patches that are described one at a time. They will “pull” these changes from the contributors branch into their branch.<o:p></o:p></p>
<p class="MsoNormal">They will want the code in a style they are comfortable with, and they’ll want to be able to understand it well enough that they could change it. It’s like giving an article to an editor.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">If the contribution is large and complex, then it may basically need to be taken on faith, and rationalized over time by the maintainer. That would be the most direct way to get a malicious code into distribution. Make it too valuable
to ignore, but too complex to understand in a short amount of time. Code that directly performed malicious things would be noticed, but more subtle would be, say, for a government to get someone hired at a large firm, and plan with/for them to leave exploitable
holes in the form of non-obvious bugs. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">To screw up models like this? Dunno. Advisory committees might discourage use of available and relevant data on grounds of expedience or turf. The remarkable effectiveness of just denying reality seems to work just fine for this
administration, so I don’t see why to posit there are any evil geniuses at work. Also academics can be amazingly petty, caring more about their reputation/citations in their small circle of expert frenemies, than in doing anything that really makes an impact.
It’s probably pretty easy for a biased administration to fan the flames of those conflicts via funding intermediaries to serve whatever political goals.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Marcus<o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>