Timeline for Should "Run Snippet" option have a reputation requirement? (To prevent... user stupidity and SE as an attack vector)
Current License: CC BY-SA 3.0
30 events
when toggle format | what | by | license | comment | |
---|---|---|---|---|---|
May 23, 2017 at 12:38 | history | edited | CommunityBot |
replaced http://stackoverflow.com/ with https://stackoverflow.com/
|
|
Mar 20, 2017 at 10:04 | history | edited | CommunityBot |
replaced http://superuser.com/ with https://superuser.com/
|
|
May 18, 2016 at 12:29 | answer | added | HaneyStaffMod | timeline score: 4 | |
Apr 27, 2016 at 7:49 | answer | added | usr-local-ΕΨΗΕΛΩΝ | timeline score: 0 | |
Apr 26, 2016 at 22:27 | comment | added | Fattie | hey Jezz. I've been helping in the Unity3D tag which is packed with crap questions from new uncaring users - it particularly happens there. I'm probably over-sensitive! | |
Apr 26, 2016 at 22:09 | comment | added | Jeremy Banks |
@JoeBlow and Raju: New users mis-using snippets is a pretty minor concern. They often horribly mis-format their code, or mis -use code style all over the place. If it's in a snippet block, at least it's formatted as a code block! It's trivial for an editor to fix that. That's way less significant than the issue being discussed here. (Though I don't think any change is warranted for either concern.)
|
|
Apr 26, 2016 at 22:07 | comment | added | Fattie | i think the attack vector is irrelevant. But the run snippets are just stupid, and many new users accidentally set pointless code as run snippets (even in the wrong languages, etc). it should be banned unless you have high rep. | |
Apr 26, 2016 at 18:31 | answer | added | Laurel | timeline score: 6 | |
Apr 26, 2016 at 11:33 | comment | added | T J | @RoddyoftheFrozenPeas The problem with your suggestion is that images don't come with external dependencies, but snippets aren't always that way, with code blocks users will likely post references to their local files and the high rep users will have to go cdn hunting for them... | |
Apr 25, 2016 at 22:24 | answer | added | Matt C | timeline score: 17 | |
Apr 25, 2016 at 21:29 | answer | added | Alexander O'Mara | timeline score: 21 | |
Apr 25, 2016 at 21:23 | comment | added | Alexander O'Mara | Was the infection ever actually confirmed? | |
Apr 25, 2016 at 20:33 | comment | added | user1618236 | How about implementing some sort of approval process, i.e 5 reviewers confirm the snippet is good before either the snippet can be run or it is shown at all. With potentially throttling the requirement by rep level and / or heuristics scanning of the code. | |
Apr 25, 2016 at 19:44 | comment | added | Jeremy Banks | @Laurel Here's a screenshot from this post discussing the question. | |
Apr 25, 2016 at 13:50 | comment | added | TylerH | I think in this case we should give the writer of the malicious code (depending on why they wrote that code) with a ban from the site and delete the snippet. Shouldn't Snippets be sandboxed anyway? | |
Apr 25, 2016 at 13:49 | comment | added | Laurel | Hey it's deleted now. Can someone get a screenshot? | |
Apr 25, 2016 at 8:25 | comment | added | Roddy of the Frozen Peas | There's a rep requirement for images, isn't there? (Or there was at one point.) Low rep users just include a link to the image, and a higher rep user later comes along and inlines it. A low rep user could post his/her code, and a higher rep user (who hopefully knows a bit about what s/he's doing) comes along and converts it to a snippet. Same idea I think. It'll hopefully also fix the problem that people don't understand when you should include a snippet as opposed to just code, forcing editors to remove the snippets anyway. | |
Apr 25, 2016 at 8:19 | comment | added | Cerbrus | Don't go out of your way to protect users. Try to prevent malicious code like that from being posted in the first place. The problem with @Laurel's suggestion, though, is that plenty of new users with good intentions make use of the snippets. | |
Apr 25, 2016 at 8:12 | answer | added | GolezTrol | timeline score: 46 | |
Apr 25, 2016 at 7:54 | comment | added | Laurel | Maybe we should reverse things so that you need a certain amount of rep to make a stack snippet. | |
Apr 25, 2016 at 7:49 | comment | added | GolezTrol | I got plenty of rep, but I would click that button too. | |
Apr 25, 2016 at 7:04 | comment | added | Jonas Czech | This would prevent access to code snippets for a large percentage of users, both anonymous and logged-in - is it really worth it, just for the sake of a few dumb users ? I think a much better solution would be to show a warning dialog the first time the user attempts to run a code snippet - something to the effect of "Don't run snippets you don't trust !". That still preserves the functionality for everyone, while at the same time warning dumb users. | |
Apr 25, 2016 at 2:52 | comment | added | nhahtdh | While I agree that this case would have been prevented, how about anonymous users? It's not only registered users who are using the site. | |
Apr 25, 2016 at 2:13 | comment | added | Jeremy Banks |
Snippets allow external scripts to be included, and there's no way to verify their contents before running them. There are also many ways to disguise the use of run-time code evaluation, like an obfuscated reference to the Function constructor on window . I think the marginal security benefits to any blacklist-based approach like that would not be worth interfering with the legitimate use of Snippets for demonstrating that sort of code.
|
|
Apr 25, 2016 at 2:09 | comment | added | Nelson | I'm thinking along the lines of not allowing obfuscated code to be "Runnable". Running unknown code is never the right thing to do, but I'm not sure how to implement it. As a start, I would think to have checks in place to prevent/limit/explicitly warn regarding the eval() function? | |
Apr 25, 2016 at 2:06 | history | edited | Jeremy Banks |
edited tags
|
|
Apr 25, 2016 at 2:05 | comment | added | Jeremy Banks | With respect to this suggestion... it's definitely worth considering, but I'm not convinced. We want to encourage users to structure their posts properly from the very beginning. If they can't include a snippet directly in their post, they might link to a fiddle, or a live example on an external site instead, which could do exactly the same thing, without the viewer even having any possible opportunity to see the code before running it. At least if they're using a Snippet, the code may be visible in advance, and they won't be able to so easily change it to something nasty without notice. | |
Apr 25, 2016 at 2:00 | comment | added | Jeremy Banks | Tangent: I don't mean to be a corporate shill, but... this a big motivation behind the OnHub router platform. Most consumer routers are developed by folks who are way too ignorant of security (there are many terrifying reports about how many are vulnerable), and often don't have the sort of reliable auto-update mechanisms required to maintain safety. Folks often think of them as generic interchangeable components, but they're a key component of your security. Please take this into consideration the next time y'all buy one. | |
Apr 25, 2016 at 1:20 | comment | added | Raju | +1, I have seen people putting java code in html/javascript 'run snippet' | |
Apr 25, 2016 at 1:06 | history | asked | Nelson | CC BY-SA 3.0 |