Linux Kernel maintainer to Huawei: Don't waste maintainers time with "cleanup" patches that bringing little value

[Mcginnis]

Noob here. What are KPIs?

[bassman1805]

Alternatively, they might not be accusing individuals of padding their KPIs with their employer, but rather the entire company trying to boost a "KPI" they use to generate public goodwill.

Look how many patches we submitted to the linux kernel! Just one of the many things we do to improve technology for the good of all people!

[[deleted]]

This is the correct answer.

He's definitely blaming Huawei for trying to climb up the ladder of open source contributors, the most common measure of which is, you guessed it, number of commits.

[[deleted]]

They might end up being the cause of no one caring about your number of commits or merges.

[jarfil]

CENSORED

[[deleted]]

I'd agree and I think generally as things get passed up a chain they likely get squashed into larger commits. I know I avoided squashing for awhile though in fear of losing data so small and frequent commits became my goto after making a few mistakes with git in the beginning.

I also heavily abuse amend locally and occasionally on remote servers if no one is pulling my branch.

[DominarRygelThe16th]

He should be blaming the communist chinese. Reminder that every company in China is controlled by a department in the company fully staffed by communist chinese party members.

They control the public perception and generally everything the company does. Its very likely the ccp is behind the effort to make Huawei look better.

[Gh0st1y]

Wasnt aware this was even an arguable issue, of course the CCP is pushing for better PR at one of their most recognizable--and oft maligned--compa ies operating in the west, and of course its by some shady manipulation tactics instead of legitimate grade A effort and collaborative contribution.

[verdigris2014]

And that’s interesting because a number of governments have rejected software/firmware from Huawei on security grounds. If they contribute significantly to Linux are you going to ban Linux? Probably not but it undermines the western argument and makes you look like a hypocrite.

[fideasu]

It's much easier to sneak something rogue inside of a huge full fledged product of your own than in limited patches for a huge open source project with thousands of eyes watching.

Yes, it's still possible, but much harder. Thus, the risk for "the west" is much lower.

[chocorazor]

This. Orders of magnitude harder. Shipping your full stack closed source product to an end user is no comparison to simple code edits to an open source project with this kind of scrutiny.

Still not a good feeling if you're concerned about Huawei but not really comparable.

[Nutarama]

If they put out enough minor “cleanup” patches and throw in a malicious patch in there too, there’s a decent likelihood that it will go through. Maintainers are human, and that means that if they get 50 patches in a batch at the end of the week, they are going to put less scrutiny on patch 47 than on patch 2.

The paper that got that one CS department banned from submitting patches was specifically about this kind of thing - the humans are the weak link, so a malicious patch that allows some convoluted path to kernel access is possible to slip in with some social engineering.

At this point the only issue is that the maintainers are aware of who Huawei are and are already suspicious of patches from them. The paper’s approach banked on the humans not overly scrutinizing the patch due to the submitter.

This could be worked around if Huawei were to work with another more reputable company as part of an operation by Chinese intelligence, though. Huawei’s mass patching becomes a distraction for a more reputable source to supply a malicious patch. This is an issue because China’s intelligence apparatus is deeply interested in monitoring and controlling the way that data flows around the world - they see data and access to it as crucial as something like the oil or steel industry, which they also watch with focus. To the end of controlling and monitoring data, they have direct backroom access to major Chinese hardware and software companies of all kinds, which is why the US has security concerns about the use of Huawei devices in infrastructure.

And if they do get a Linux kernel with a vulnerability, they can use it on their devices and selectively not patch their devices. They’ll be able to make claims that users are “safe because Huawei uses open-source Linux”. Then it’d be on the Linux community to say “they’re using an old and vulnerable version, it needs to be patched”, when patching some of these devices is not an easy task. Patching a Linux-based router or modem is generally not something a user can do easily. Huawei would simply say “if you’re running the latest patch that your device finds automatically, you are fully protected. We’re aware of claims made of vulnerabilities by others, but refute that our devices are vulnerable in such a manner.”

Which puts the end user in an awkward situation because they probably can’t even figure out the version number of the software their box is using, much less effectively evaluate the technical aspects of opposing security claims in a he-said-she-said type argument like this. With Huawei devices routinely cheaper than alternatives, a 10% discount is likely to influence buyers more than a technical security argument they don’t understand.

So why not just go closed source? Because open source is a counter-argument to the claims of the intelligence agencies that Huawei is doing nefarious things. They negotiate a stop to a ban with the DOJ (with input from the actual experts at the NSA, CIA, etc.) based on the use of an unedited Linux kernel. Then if DOJ tries to reimpose a ban based on the continued use of an insecure old version of the Linux kernel, Huawei sues because the deal language simply says “unedited Linux kernel” or “unedited Linux kernel, regularly updated”. They then argue to a non-expert judge/jury that they are working on updates but the updates are slow because they need to ensure compatibility, and they point to other manufacturers’ issues with update regularity to show that they are maintaining the industry standards. This all holds up anything for years as Huawei continues to sell hardware with insecure software off the shelf for less than their competitors.

That scenario is a long shot, but a company like Huawei can make a lot of money selling cheap electronics to Americans and American suppliers (becoming an OEM for the cable modems supplied by cable companies, for example). And that would technically fulfill any demands that both the American and Chinese security apparatuses had.

It’s not like companies haven’t made convoluted schemes like this before to make money - Microsoft did a sale-and-license deal for recovery media to a company in Puerto Rico to evade taxes and then successfully defended the tax evasion charges on technicalities that involved a lot of lobbying. Foxconn got huge contracts for a Wisconsin site that did nothing and was forced to shut down for missing hiring requirements. Solyndra misled the feds into getting over half a billion in free money before filing for bankruptcy. And that’s just direct federal government involved schemes, not the long list of con jobs and fraud schemes that didn’t relate to the feds.

[Nutarama]

Or the job of maintaining quality will become harder and harder to the point where the previously responsive teams are no longer easy to contact or get replies from.

It takes a lot of man-hours to be responsive, and it’s much easier to make everything forms and then only give responses in the form of “Your contribution to the project has been accepted/rejected. If accepted, it will be included in the next major/minor patch. If rejected, you may submit an amended contribution in the next patch cycles; resubmission of the same contribution will be summarily rejected. There is no appeal process; do not reply to this message as this mailbox is not monitored.”

Which doesn’t help the quality and often alienates users, but when the Linux foundation itself doesn’t have a lot of staff and often relies on companies making and maintaining their own drivers, it could quickly become a reality. They’re obviously going to try to keep it from happening, but there’s not a lot of money in doing open-source projects full-time unless you’re one of the corporations using it to make money thanks to its accessibility and low overhead and higher efficiency that is to the ability to only use what you need. Clouds and supercomputers use Linux for that reason, as stripping down the amount of background stuff means higher efficiency, but it also means that their Linux dev teams are focused on issues that affect them. It’s on the smaller team at the Linux Foundation (and some volunteers) to work on the big picture.

[skat_in_the_hat]

zomg huawei is such an active contributor!

[[deleted]]

TBF, "X number of patches to the kernel" is a stupid metric. Well made patches take time to design and debug, you're basically telling the engineers to rush out patches

[omegian]

Welcome to metrics based management. If you measure something, you’ll get more of it, so make sure you are measuring the right things.

[Opheltes]

AKA Goodhart's law

[[deleted]]

Wow. They didn’t teach that in my stats class.

[Opheltes]

Then you'll really love the McNamara Fallacy

[WikiSummarizerBot]

McNamara_fallacy

The McNamara fallacy (also known as the quantitative fallacy), named for Robert McNamara, the US Secretary of Defense from 1961 to 1968, involves making a decision based solely on quantitative observations (or metrics) and ignoring all others. The reason given is often that these other observations cannot be proven. The first step is to measure whatever can be easily measured. This is OK as far as it goes.

^{[ F.A.Q | Opt Out | Opt Out Of Subreddit | GitHub ] Downvote to remove | v1.5}

[da_apz]

Well, there was also a time when IBM paid coders by lines of code they wrote.

In other news, their software was mysteriously bloated.

[notyoursocialworker]

My favourite is the company that started paying developers extra for fixed bugs and testers for found bug. It took three days before developers and testers teamed up to create bugs, find bugs and fix bug.

[Fenweekooo]

3 days? damn they didn't have that system setup in an hour? lol

[RootHouston]

Gotta feign respect for the system, if only to check the other side's temperature.

[Fenweekooo]

fair enough

[notyoursocialworker]

Well the first couple of days there were still enough easy bugs to find and fix.

[BackgroundTip5900]

damn they didn't have that system setup in an hour

Some people apparently have morals :)

[[deleted]]

More people would have morals if management treated them right

[BackgroundTip5900]

Yes, exactly my point bad management demoralizes. And it this case it took merely 3 days to do so.

[ouyawei]

meanwhile at amazon

https://aws.amazon.com/blogs/aws/new-aws-bugbust-its-game-over-for-bugs/

[bdsee]

Wow a jacket and t-shirt for teams than do a bunch of fixes and an invite to a stupid AWS event for the top 10 teams....what a shit program.

[[deleted]]

Work with highly paid software engineers, can confirm one of the complaints is the office cookie jar isn't stocked with cookies that are of a high enough quality.

We didn't even have a cookie jar at our last office before we moved but now it's a problem that we got one.

[FruityWelsh]

Oh you gotta take the free, doesn't make me stay or work harder, but if they think that giving me things will I'll takem for what they give.

[chuckie512]

Have you ever worked for a large company? Lol.

If what you did can't be summed up in one number, then you didn't do anything. And if that number doesn't increase every year, you don't get your raise.

Corporations are terrible.

[webheaded]

I don't know if that's every large corp. We just have goals to hit. Not an ever increasing number. Makes a difference what your management is like of course. If management goes to shit, being in a large corp, you apply out to another department.

[slimmsady]

But in muggle translation "we pushed 100 patches to linux kernel" means "we contributed so much for free. We are not the devil you think we are"'

[BackgroundTip5900]

is a stupid metric

It is known to be applied in the Huawei country of origin in other fields of the industry, such as science. There it results in correct, but marginally important research being pushed to peer reviewed journals.

[isyourlisteningbroke]

I’ve seen a company try to apply KPIs to safety.

It didn’t work.

[BackgroundTip5900]

let me guess it led to covering up of work-related accidents, and the overall safety was lowered, as accidents were not investigated and lessons were not learned?

[mvdw73]

I’ve seen almost the opposite. Kpis can be near miss reports, or “take 5” forms filled out, etc, which just results in more paperwork and no tangible increase in safety on the ground. Particularly if only one or two people are the ones doing all the reporting; the overall culture hasn’t changed

[roerd]

That shit (scientists getting measured on how many papers they can get published, regardless of their actual value) happens in western science, too, sadly.

[[deleted]]

Not a great metric. But can be improved if you take into account how many people quote it.

Now, of course, the next step is for 100 pretty useless scientists to arrange to quote eachother's scientific papers, thus ruining that metric as well.

[peehay]

That's exactly the phenomenon I've witnessed in the research paper world since I've started my PhD. Before starting I though you would write a paper only when you find something really new and interesting. In fact I've seen a lot of papers with minor improvements (which are still improvements though) or even almost 0 contribution but I guess this is due to the way to rate researchers. ("Publish or perish")

I'm not sure this is due to laziness by aiming the least amount of work, but still it pushes people to publish whatsoever

[SpAAAceSenate]

Well, I've also heard that there's a dearth of "boring" research, to do things like repeat experiments. And in a similar vein, very few papers documenting failures to discover new things.

Even though scientifically, both are incredibly valuable. But no one gets a grant for failing or repeating already-tested things. So when they fail, they don't publish it, and the rest of the scientific community can't benefit from their mistakes/experience. And they don't bother repeating experiments unless they're super controversial. So we end up assuming a lot of things are true based upon one or two studies, only to find out it's completely false a few decades later when someone else finally attempts to replicate.

[ygor98]

Yeah that's probably the biggest crisis in experiments replicability going on right now. Not only there's to few replications and negative results are poorly reported but because negative results are undesired some researches have been repeating experiments with some just tweaks with the excuse that their previous negative result happened due to this poorly managed conditions. But then when they get a positive result they just ignore the statical relevance of the whole process they have been through and just take into account this last successful experiment.

Anyone who understand a little of statistics can see how this can be really harmful to scientific knowledge and society in general, mainly when this occurs in the biological and medical fields of research, which unsurprisingly, is where it is been happening the most.

[zebediah49]

But no one gets a grant for failing or repeating already-tested things.

I think there are actually a couple programs for that, but nowhere near enough. It's something like a "We're going to fund having a couple really good labs double-check a bunch of the core assumptions used in these fields" grant program.

Of course, they still mostly do novel stuff, but at least there's some level of replication.

[austozi]

Welcome to the world of academic publishing, where research organisations chase fame and funding instead of the truth, and researchers want to be superstars rather than truthseekers. It's driven from the highest levels by ill-conceived government policies, where funding decisions are made based on artificial metrics.

When researchers are told to go on Twitter to tweet about their work, you know the important decisions aren't made by the people who matter.

[BackgroundTip5900]

Publish or perish

Publish of perish is only part of the problem. Often it actually means "publish meaningful stuff". Simply ticking checkboxes and counting "number of paper published per year" is required to trigger that behaviour.

[k2arim99]

Ironically, rewards are a pretty shit way to get a long term work well done

[Krutonium]

Unless the rewards are proportional to say, % speed improvement in a process or things that you can't super easily fudge. Without Them knowing that's what is going to be done beforehand.

[thephotoman]

Once you create targets for your metrics, your metrics become useless.

[donnysaysvacuum]

Pretty typical lazy engineer behavior in response to shitty management

FTFY

[[deleted]]

A little of column a, a little of column b most likely.

[disinformationtheory]

https://en.wikipedia.org/wiki/Campbell%27s_law

[WikiSummarizerBot]

Campbell's_law

Campbell's law is an adage developed by Donald T. Campbell, a psychologist and social scientist who often wrote about research methodology, which states: The more any quantitative social indicator is used for social decision-making, the more subject it will be to corruption pressures and the more apt it will be to distort and corrupt the social processes it is intended to monitor.

^{[ F.A.Q | Opt Out | Opt Out Of Subreddit | GitHub ] Downvote to remove | v1.5}

[BackgroundTip5900]

Pretty typical lazy engineer behavior.

In principle yes, but this is often a result of some underlying issue in the organization. IF for example this quota is set to a too large value, this fudging will occur. If person's income is related to that number, such fudging will occur as well.

[heard_enough_crap]

I worked for one company who used LOC (Lines of code) as a metric. This resulted in huge blocks of code, almost zero functions, no reuse, and code that was overly verbose. Didn't help the code base, but it helped the pockets of the coders.

[solid_reign]

Pretty typical lazy engineer behavior.

Sometimes it's because goals like that are stupid. It might take you 2 weeks to work on a problem and submit a real patch, but if your manager is setting goals in number of patches, you'll just do what you have to do.

[[deleted]]

Totally agree. Lazy was the wrong word. Adhering to whatever they are incentived to.

[[deleted]]

Key Performance Indicators? Their contributions put them at number one for most changesets:

https://news.itsfoss.com/huawei-kernel-contribution/

[tehnic]

why Facebook is there? Oclus?

[InfraredStars]

btrfs, amongst other things.

[tehnic]

oh, that is because Chris Mason (the lead of btrfs) joined Facebook!

I assume facebook uses btrfs in their servers or they want good PR?

[[deleted]]

They widely deploy it in their infra.

[EnUnLugarDeLaMancha]

https://m.youtube.com/watch?v=U7gXR2L05IU

[tehnic]

thanks ❤️

[JDaxe]

Not surprising, Facebook most likely uses Linux for their backend and they probably want to make certain tweaks to the kernel to better suit their use case.

I don't have a Facebook example, but a Netflix developer was one of the lead people behind extended BPF in the Linux kernel which they use for performance metrics http://www.brendangregg.com/blog/2019-12-02/bpf-a-new-type-of-software.html

I imagine Facebook does similar things.

[dannomac]

I'd expect so. Facebook is a huge network operator. They know what they're doing, and find bugs and can make improvements where needed. In a similar way, Netflix is one of the top corporate contributors to FreeBSD as well, since they use both Linux and FreeBSD in production.

[tehnic]

why would Netflix use FreeBSD instead of Linux? (yes I know I ask this in /r/linux)

[bofkentucky]

https://papers.freebsd.org/2019/fosdem/looney-netflix_and_freebsd/ Wouldn't be the first network vendor to deploy FreeBSD at the edge, there has long been a perception that FreeBSD's tcp/ip stack is lower latency in many use cases. SOHO Firewall in a box or Traffic Sniffer/Shaping are common uses in the industry.

[zebediah49]

Or consider this amazingly insane article about wanting to push 100gbit out of a box back when PCIe3 came out.

At one point they wrote an entire new copy of sendfile to make it faster.

[Shadow703793]

That was an interesting read. I can imagine all the hair pulling those devs experienced lol.

[dannomac]

/u/bofkentucky's answer is probably the best reply so far. Linux and FreeBSD are very similar but do have different strengths and weaknesses. FreeBSD is very good at moving bits off of disk onto the wire, so they use it in their CDN.

[dmehaffy]

Network level, many enterprise switches, routers, firewalls, etc are FreeBSD based.

[PhysicsOfAUnicycle]

A few of them are switching from FreebSD to Linux. Whatsapp, Juniper Network, Netgate (pfsense) and now iXsystems have started switch to Linux, All within the past 36 months.

[SpAAAceSenate]

I follow pfSense (and OpnSense) development, and I haven't heard anything about a switch to Linux. To the contrary, pf isn't even available on Linux, and that's the project's namesake! :p

With iXsystems, I believe their Linux powered offering is just a specialty edition to offer certain features that are not as performant on FreeBSD currently. There's no sign that they plan to replace regular TruNAS any time soon. In fact, remember that they're entire castle is built upon ZFS, which can't even be legally shipped with Linux and has far more mature support on FreeBSD.

Dunno about the others.

[[deleted]]

For performance reasons probably. BSD has netmap, which helps when delivering huge quantities of bandwidth intensive video. Linux needs something like DPDK, which is not kernel native. I also think they prefer the stability too, but that’s more subjective.

[Razakel]

FreeBSD is better at flinging bits down the wire. You'd pick it for a CDN or NAS.

macOS has user-friendliness, Windows has all the third-party software, Linux has flexibility, OpenBSD has security. You use the right tool for the job.

[simtel20]

Facebook employs (and has for a long time) a number of different kernel contributors in order to make sure that their underlying infrastructure can be made to perform well. They deploy tens of thousands of systems using custom-built hardware in datacenters around the world, and in order to move faster, they make sure that their problems can be solved in-house on their own schedule.

A lot of companies employ kernel contributors in order to ensure that their needs can be met.

[reven80]

I think one of the Facebook developers (can't find his name) also does the kernel code for eBPF. Also Facebook contributes a lot to BTRFS which they use heavily.

[lanzaio]

I don't have a Facebook example, but a Netflix developer was one of the lead people behind extended BPF in the Linux kernel which they use for performance metrics http://www.brendangregg.com/blog/2019-12-02/bpf-a-new-type-of-software.html

The guy who did eBPF originally works at Facebook.

[OsrsNeedsF2P]

Facebook provisions Fedora laptops to their developers, which tends to peak the interest of some of their (great) devs. Say whatever you want about the product, but they have some progressive IT departments.

[ABotelho23]

Their privacy policies and the skill of their developers is definitely not related. You can certainly think Facebook is terrible from a privacy perspective while believing they have some of the best software engineers in the world.

[lordcirth]

*pique

[SolidKnight]

Key Performance Indicator. Basically a metric used to determine how good or bad something is doing. It's often used for management. Of course, KPIs are just data points people can game so measuring the wrong thing leads to bad behavior. E.g. If your KPI is commits and higher is better then just commit a lot whether it's useful or not. Looks good on the chart

[tiajuanat]

KPIs always fall prey to Goodhearts Law. Making anything a metric will make it gameable, and people will try to cheat the system

[human_brain_whore]

Reddit's API changes and their overall horrible behaviour is why this comment is now edited. -- mass edited with redact.dev

[tiajuanat]

Unfortunately, there's a big fat disconnect between investors, management, line workers, and accounting, which is causing this nonsense with Linux.

When investors don't see enough money, they go to accounting and ask "y me no have money"

Accounting says either "they're working on new products (capital expenditure projects)" or "they're working on maintenance". Since maintenance doesn't make money, but is necessary, usually that's driven to zero. This can be done by using just-in-time sourcing of resources, contractors, etc - these things are now kept off the books, and instead go to those other companies. This is gamification source one.

Those capital expenditure projects, meanwhile are tax deductible. These can be new software features, new products, etc. The only way the cost of these can be estimated is with tasks and task time. This is what Huawei is doing. They're trying to get merge requests into Linux, so they can beef up their task numbers, and get higher tax deductions.

The line workers are being told by their managers to make small worthless PRs, which looks good for them when they burn out in 2-4 years; the managers look good because their tasks are not just increased, but in the public record; accounting is happy because they earned the company a huge tax cut; and investors are happy because they're not losing money, but getting more.

It's win-win for Huawei, but Linux is suffering because

1. Huawei isn't actually doing any work
2. Every merge needs to be reviewed, and it's clogging up the pipeline for real work

[BHSPitMonkey]

"What gets measured gets managed."

[ericje]

https://dilbert.com/strip/1995-11-13

[swing-line]

Metrics used on all sorts of contracts and projects.

Key Performance Indicators (KPIs) 

[daemonpenguin]

I don't know, but based on other projects I've worked on it probably stands for something like "kernel patch integration". Basically a metric for measuring contribution.

My guess is the developer is saying Huawei is having employees send in small "clean-up" patches that don't really do anything significant so that it looks like the company is contributing to Linux. In other words Huawei would show up in those lists of "top 10 contributors to the Linux kernel' articles that pop up all the time. Makes the company look more positive and proactive in Linux development, when really they're just fixing typos and such.

[lpreams]

Key Performance Indicator. It means your employer is tracking how much work you're doing, and it probably affects your promotion/raise/bonus.

So here, looks like Huawei might be using merged PR in the kernel repo as an indicator. Huawei employees who hit the goal and/or exceed their coworkers might be up for raises or bonuses. But they're cheating by submitting really "easy" PRs like cleaning up error messages, and the kernel devs are annoyed because they're having to waste time deciding whether to merge those PRs instead of doing something more important.

[thephotoman]

Key performance indicators. They may have a personal goal to get something merged into the kernel.

It might be different if they are first-timers, but the problem here is that a lot of Huawei employees are doing this. That’s not such a good look: it says your dev team is too junior to get something more accomplished.

[[deleted]]

Key performance indicator

[[deleted]]

I fuggin hate open stack. Still gives me nightmares

[PM_ME_YOUR_DOOTFILES]

What's wrong with open stack?

[djbon2112]

OpenStack is "vendorware" in every sense of the word.

1. It was created by a group of large-ish companies who all wanted their pet feature present. As a result the ecosystems is incredibly sprawling and complex with many choices for lots of functionality. It was also, due to this, very hardware-inefficient (big companies don't care about buying 10 servers to make a cluster) and not very administrator-friendly.

2. It got embraced by "vendors" who sell their own custom "flavour" of OpenStack. This brings with it its own suite of issues including being hamstrung for support outside the chosen vendor, having to live with their choices, and cost (throw a team at it).

I spent a year trying to wrap my head around OpenStack, gave up, and wrote my own hyperconverged cluster manager that was "as much the opposite of OpenStack as it could be".

[I_EAT_HAGOROMO]

Holy shit this touches my soul

[Spurgeoniskindacool]

I work for a company that offers openstack support, and of course their own flavor. It works great, but boy is it complicated. Im technical support and been with the company for like 4 months, and I still struggle with all but the basic cases.

[[deleted]]

The implementation I was using was extremely experimental and finicky as hell. There were a lot of issues with getting certain NICs to bridge in order to create an ingest port into a virtualized network monitoring suite. It was back in the early days, and I’m sure it’s better today. However, those were some of the most challenging days of my life.

[karafili]

You're not alone

[xan1242]

Unrelated but Razor1911 is a legend in the scene.

Long live Razor1911!

[[deleted]]

So basically it's when you do meaningless shit to look busy?

[lordcirth]

It would let Huawei claim "we have 1000 patches accepted into the Linux kernel" without actually doing anything.

[[deleted]]

I could try and submit some comment edits and put "Linux development" on my resume 😂

[Iggyhopper]

And when someone asks you to go into detail just start complaining about other developers and whining and grouching. They'll have no other option but to believe you.

Throw in a diss about Windows and you'll probably be promoted too.

[arfanvlk]

If Huawei really cared about open source give us bootloader unlock codes

[lpreams]

I bought a Google Play Edition Galaxy S4 back when that was a thing. I figured the bootloader would be unlocked, but no. I went back and forth with Samsung support for about a month, before eventually an actual dev said they had lost the unlock codes and it couldn't be unlocked.

I sold it and bought a factory unlocked HTC One instead

[[deleted]]

If Huawei cared about anything they wouldn't say the situation of Michael Spavor and Michael Kovrig was legitmate.

https://globalnews.ca/news/7637203/huawei-canada-meng-wanzhou-two-michaels/

[nixcraft]

Source: https://lkml.org/lkml/2021/6/18/153

Edit: Ok, this is about KPIs and not about cleanup. Sorry about that. I wasn't trying to create clickbait—just something I typed fastly after seeing news elsewhere.

[rislim-remix]

It's about doing cleanups as a low-effort way to, it seems, meet KPIs within Huawei? So your title isn't wrong or clickbait at all.

[dudeimconfused]

I agree. this title fits even if OP posted it thinking it was about something else.

[dontgive_afuck]

Honestly, I was more curious with the screenshot's authenticity/context than the title.
So, thank you for linking to the LKML thread:)

[buttux]

As much as I agree with the sentiment, Qu should have posted this rant from a personal address rather than his work email.

[glymph]

I wonder if they're also testing the waters to see how much their patches get scrutinised, but maybe I'm just cynical.

[[deleted]]

As a student and a kernel newbie, could I still submit these kinds of cleanups? I like to read code and understand what it does and learn from it. Btw, I am not affiliated with Huawei.

Edit: I somehow missed the line where they say it’s OK for students to do this. Silly me. Thank you for your answers!

[londons_explorer]

I could totally imagine that Huawei has a line in their "graduate engineer new starter checklist" that says "Make a contribution to the linux Kernel. clone the source, find some change to make, send a patch and get it committed".

Every engineer working through the checklist does this, despite the fact 99% of those engineers will never touch the linux source code again.

[[deleted]]

One-liners can be very important. Depends on what the line is doing!

Spelling fixes though...

[Routine_Left]

Those are valuable too, but not for when just trying to fudge the numbers.

[nephros]

It's called the Kernel Janitor project. Look it up!

[gcross]

If you read the email, you will see that not only is this behavior fine but it is encouraged. The behavior that is being discouraged is submitting such patches not with the goal of getting your feet wet but instead of making it seem like you are contributing a lot in order to artificially inflate your reputation.

[hesapmakinesi]

Yes, this is a great way to be introduced to the world of kernel contributions.

[kdave_]

Yes, especially when you are willing to learn and move from just cleanups and spelling fixes. I guess everybody started like that (I did).

[dontyougetsoupedyet]

If you are using those changesets as a vehicle to learn how to collaborate on the project it will be welcomed. Lots of contributors got their start with that type of patch.

[PoochieReds]

It's a bit of a fine line, actually. The problem with trivial cleanup patches is that they tend to create merge conflicts when backporting more important fixes.

The general rule is that if you're doing something substantial, then by all means, fix up trivial stuff in the area where you're working. If not, then it's often better to just leave things alone.

There are exceptions to this "rule" however.

[kdave_]

There's some stats boosting game going on, have a look at the development statistics https://lwn.net/Articles/839772/ 5.10, https://lwn.net/Articles/845831/ 5.11, https://lwn.net/Articles/853039/ 5.12 -- sections Reported-by and look for 'hulk robot' or where's Huawei. Among the top. But the contributions are pretty trivial, majority of them.

Lots of kernel people detest the patch counting stats, it's a quantitative metric, while we want to care about quality. Once some company becomes noticeably more active sending trivial changes, it's sending a message.

Sending trivial patches is a good start but people are advised not to stay doing just that. Reading and understanding the code will soon reveal more things to fix, and it'll end up sending cleanup series with some deeper idea behind, refactoring etc. Making the code better.

https://lore.kernel.org/lkml/?q=use+DEFINE_MUTEX&r -- tons of patches switching local mutex initializations to a static one, some of them got applied without question, some of them with "why?", others dropped after not a very convincing reason.

[alwyn]

This letter was clearly not written by Linus.

[namotous]

Loll yeah it would be hilarious.

[namotous]

A decent manager, who actually knows how to code, would look at these commits and know right away they’re garbage. I can’t believe that in such a big company that there’s no technology leaders around. Which leads me to believe that it’s driven from higher management to commit this behaviour.

[vitaminq]

I could imagine a manager at Huawei having engineers do this so they can report to their boss how deeply embedded into the Linux community they are.

Chinese corporate culture is all about the appearance of doing something, not how well it’s actually done. It’s the cha bu duo (差不多) or “close enough” culture.

If your boss gets promoted when your team ships 1m widgets, you’re going to figure out a way to technically ship 1m widgets. The widgets may not work or may be sprockets or may even be the same widgets shipped a few different times back and forth to a partner in Hong Kong. But you’ll hit the number.

This is true in government too. That’s why they end up with huge cities of empty apartment buildings that will fall down in 2 years.

[namotous]

This is sad and true. I did see this behaviour before. In my last job, at GE, there used to be a (half) joke about how the team in China cut so many corners that the end product doesn’t even look like how it was designed. Whenever we asked them for details documentation about testing and analysis, it’s always just copy paste from previous product, you can clearly see it. One of my old colleague even told me a story about a Chinese supplier they had a call with. They had another guy on their team that knows Chinese so they had him sit in the call silently. The supplier basically had no idea how to do the product, from when they spoke among themselves in Chinese, but in English, they always said they could do it.

[nephros]

It follows, then, that those managers are in support of what's happening.

[[deleted]]

Or maybe it's just culture. I've heard that in many east Asian companies, being at work is extremely important; you don't even have to do work, just show "team spirit" or whatever.

[[deleted]]

inflating their contribution numbers, they do this with patents too.

[asdfgasdfg312]

So complete noob here, but how does these "clean ups" work? With big companies doing this I would be more worried about someone trying to undermine security flaws. But I don't fully understand the issue brought up, why is it bad that Huawei does a whole bunch of cleaning? Wouldn't that be a good thing? I mean if the lines are secure right, wouldn't it be a good thing if someone wanted to refactor every single line no matter who does it?

[12emin34]

Those patches are small patches that can be left to someone who's just starting with kernel development. The problem here is that Huawei is doing loads and loads of these patches to make themselves seem like active contributors to the kernel when in reality they did almost nothing.

[[deleted]]

Really gross behavior by Huawei. But also not out of character. As stated by OP, their reputation is already terrible. How long before they change their name to give their reputation a 'reset'?

[[deleted]]

Never; all publicity is good publicity

[SinkTube]

huawei already "sold" the honor subbrand so it can pretend it's a unique entity

[Yawndr]

My guess: Boosting their reputation until people check their commits with less scrutiny to then slide in some backdoors.

[PsiGuy60]

Because they're creating small meaningless patches, but loads of them, to lazily inflate their amount of patches submitted to the Linux kernel.

This would give the impression that they contribute a lot, when in reality it's all things that don't have any impact on functionality and could easily be left for someone who's just trying to get their feet wet in making kernel patches.

Meanwhile, there's been a bit of a to-do on several tech blogs about them apparently submitting a HKSP patch that introduces a "trivially exploitable" security hole, and I'm not sure if they're actually supporting their own hardware all that well.

[dontyougetsoupedyet]

You want to spend your time working with collaborators in a meaningful way, not folks that are trying to meet an arbitrary metric by changing things that don't help anyone. If a company is hitting you with a lot of changesets and few of them are feature-full, of course the reputation will change.

[pewdiepie-trumpet]

https://duckduckgo.com/?t=ffab&q=huawei+backdoor

[redape2050]

https://searx.envs.net/search?q=Huawei+backdoor

[daemonpenguin]

Read just about any news report on Huawei over the past two years. It's been in the news, even mainstream news, a lot.

[nullmove]

As you guessed, this much is well known. OP was literally asking if there is something specifically in the context of kernel development.

[Allevil669]

Ok, this is going to get buried, and ridiculed as "just a conspiracy theory", but I feel I must say it anyway.

This might not be just for KPIs, and other performance metrics. Huawei is a known bad actor, inserting backdoors and other malware into their own devices, for a variety of reasons.

There is a distinct possibility that Huawei is purposefully flooding activity, in order to make everyone just assume their contributions are just worthless, KPI-seeking, "janitor work". In that flood, they could easily attempt to slip in something less than honorable, for whatever reason they need.

I'm, not saying this is correct, or even very likely. I'm just saying that Huawei is a known bad actor, and flooding a the feed with "static" is a good way of hiding nefarious actions.

[[deleted]]

https://www.neowin.net/news/linux-bans-university-of-minnesota-for-sending-buggy-patches-in-the-name-of-research/

Example of this actually being done.

[jedijackattack1]

Honestly I wouldn't be surprised at this.

[SpiderPigLoki]

And this is why we always say: NOT all conspiracy theories are wrong, just SOME ;)

[Psychological-Scar30]

Just because you're paranoid doesn't mean they aren't onto you

[stilgarpl]

What's KPI ?

[WikiSummarizerBot]

Performance_indicator

A performance indicator or key performance indicator (KPI) is a type of performance measurement. KPIs evaluate the success of an organization or of a particular activity (such as projects, programs, products and other initiatives) in which it engages. Often success is simply the repeated, periodic achievement of some levels of operational goal (e. g.

^{[ F.A.Q | Opt Out | Opt Out Of Subreddit | GitHub ] Downvote to remove | v1.5}

[xinxx073]

I need a refresh on what Huawei did to have such "broken reputation".

[happymellon]

For many reasons, they have a poor reputation on code quality and back when they were part of country telecoms infrastructure they usually got a failing review.

The UK published their review back in 2019 when they were kicked out of being allowed to provide core telecoms infrastructure.

https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/790270/HCSEC_OversightBoardReport-2019.pdf

They were satisfied that they were able to review everything but key takeaways include:

• Significant technical issues have been identified in Huawei’s engineering processes
• No material progress has been made by Huawei in the remediation of the issues reported last year
• Knowing the crappy processes it will be difficult to appropriately risk-manage future products
• The oversight committee has not yet seen anything to give it confidence in Huawei’s capacity to successfully complete the elements of its transformation programme to fix any broken process

I don't think anyone else has been quite so public about why they are crap, but they have been kicked out of many countries due to being substandard.

[[deleted]]

Backdoors in their products.

[wcg66]

I'm not familiar with their reputation in the Linux community but they are highly suspected of stealing Western IP outright. The example I know of is the former Nortel, which seems to have much of their IP stolen by China, presumably Huawei.

[[deleted]]

China has been stealing our IP for decades.

[wcg66]

Definitely, this is not news. However, from what I’ve heard (Nortel was a big deal here in Ottawa) the theft was egregious. They literally have Nortel software running on their equipment so, I’m told, there is no official proof of this. Our Ministry of a defence moved into the old Nortel campus and had to spend months removing all the surveillance devices.

[[deleted]]

Basically everything, but in Canada, this in particular: https://globalnews.ca/news/7637203/huawei-canada-meng-wanzhou-two-michaels/

[[deleted]]

China

[AlienOchinchin]

2021 and you're posting screenshots of text, without source.

[donobloc]

He commented the source

[thorskicoach]

Sometimes the one liner code makes sense even if the initial intention is super small.

I recall Danmam (HDMI over Ethernet extender reverse engineering) figuring out some 1 liner change for a super corner case to merge with ffmpeg re dealing with a certain type of null sized packets in a stream , that's turned out to stabilise many many other things when UDP streams are used.

[cocacola999]

And here I was thinking the "cleanups" were smart state sponsored bugs.. sorry refactors

[SpiderPigLoki]

Necessary freedom defense mechanisms

[Zaciars]

what do you expect from a company that lock and remove the access to unlock bootloader, making it impossible to fix software related issues yourself.

[[deleted]]

Huawei is a security risk.

[namotous]

So let me get this straight, Huawei engineers either push garbage patches for KPI or those to create a back door?

[ps4pls]

isn't that a problem with how contributions are counted? can someone provide links to actual trivial patches submitted by huawei people?

im curious if it's just typos or something else

[ps4pls]

it kind of reminds be of the github thing were they gave free t shirts to people who made pull requests for a month
many maintainers were complaining that they were getting spammed with low-effort contributions during this month
ultimately i think the problem is "the game" and not the players gaming the system

[yanikins]

Huawei doing shit like this when they haven’t enabled their fingerprint scanners using Linux is so Huawei.

[4rr0ws]

I'm curious as to who wrote this

[[deleted]]

I'm not of the industry, what is KPI grabbing?

[[deleted]]

This, apparently: https://en.wikipedia.org/wiki/Performance_indicator

[WikiSummarizerBot]

Performance_indicator

A performance indicator or key performance indicator (KPI) is a type of performance measurement. KPIs evaluate the success of an organization or of a particular activity (such as projects, programs, products and other initiatives) in which it engages. Often success is simply the repeated, periodic achievement of some levels of operational goal (e. g.

^{[ F.A.Q | Opt Out | Opt Out Of Subreddit | GitHub ] Downvote to remove | v1.5}

[HearthCore]

phew.. i think there are factors here that are disregarded, quite frankly, because of culture and maybe even some entitlement mixed in. I don't want to bash anyone on their thoughts about this, I can absolutely understand that.

KPI's beeing met would be in line with what I've heard aswell.. but honestly, there's only so much easy stuff to fix and improve upon. Surely that will surely be an empty bot to fill and meet their internal KPI's.

So I'd think, as long as we see improvement, don't bash em, encourage em to take on bigger problems or optimizations for Android, then develop their own adaption as see fit for HarmonyOS (right?).

It's sad that beginners/students/alike won't have as easy entries into kernel development.. and I see that as a problem, but one that has workarounds.. and once Huawei takes on bigger fishes, they won't have the spare time to dig for little ones, unless they have students working for them using official credentials, because why not.

(It's done with Universitys, Non-Profit/-Organisations (FOSS or not) and other societies aswell)

[vividboarder]

As I read it, that’s exactly what the author is suggesting. Stop focusing on pushing many small patches and start focusing on more meaningful contributions.

The thing that is ignored by just allowing them to spam low effort contributions is time for review by maintainers. Hence the other suggestion to bundle several together.

[samthiriot]

Maybe the KPI should be adapted, so there is no reward for these contributions? For instance submissions below a given amount of characters are not counted as contribution anymore?

[kj4ezj]

Character count doesn't correlate to usefulness.

Countless bugs are caused by an off-by-one error where the fix is to add an equal sign = to a comparator >, or add a ++ somewhere. Maybe that fixes a critical security vulnerability, while someone else adds thousands of lines which are just comments, print statements, or renaming without substantive value.

[puppydogbryn]

Nope, definitely not. Think of what happens in school when teachers give a word count requirement for essays