[BearsAreCool]

I'm really not sure what the motive to lie is. You got caught with your hand in the cookie jar, time to explain what happened before they continue to treat you like a common criminal. Doing a pentest and refusing to state it was a pentest is mind boggling.

Has anyone from the "research" team commented and confirmed this was even them or a part of their research? It seems like the only defense is from people who did google-fu for a potentially outdated paper. At this point we can't even be sure if this isn't a genuinely malicious actor using comprimised credentials to introduce vulnerabilities.

[mort96]

It's also not a pen test. Pen testing is explicitly authorized, where you play the role as an attacker, with consent from your victim, in order to report security issues to your victim. This is just straight-up malicious behavior, where the "researchers" play the role as an attacker, without consent from their victim, for personal gain (in this case, publishing a paper).

[NotEvil]

Because of the nature of the research an argument can be made that it was like a bug bounty (not defending them just putting my argument) but they should have come clean when the patched was merged and told the community about the research or at least submitted the right patch.

Intentionally having bugs in kernel only you know about is very bad.

[opnitro]

The primary difference being the organization being tested explicitly sets up a bug bounty with terms, as opposed to this.

[unanswered]

I'll take People Who Don't Understand Consent for $400, Alex.

[shkkmo]

This is the rare HN joke that not only is hilarious, but susinctly makes the core point that is being disagreed about clear

[salawat]

This is a disturbingly frequent thing occurrence here.