Skip to main content
10 events
when toggle format what by license comment
May 11, 2017 at 19:03 comment added Servy @CodeCaster The problem with the idea of letting anyone change anyone's answer when they think it's wrong/bad is that it works both ways. If you post an answer to a question like this in which you implement the security correctly, and ensure the system is actually safe, someone else could come along and "improve" the answer and "simplify" it to remove "unnecessary" steps (since the question doesn't require the code to be secure). The real problem in this particular situation is that way more people wanted the insecure solution over the secure one; there's no way to fix that.
May 9, 2017 at 17:54 comment added Malt @CodeCaster Also, note that finding many of these answers is fairly easy. Just turn over the obvious stones - tags and keywords such as Encryption, Authentication, Validation would be a good start. Yes, it won't catch all code out there that's vulnerable to SQL injection of buffer overflow, but I think that if we at least do the obvious stuff, we should do it. Half a solution is better than no solution at all.
May 9, 2017 at 17:51 comment added Malt @CodeCaster I've now read your answer in the first link. I understand your argument, and it's not without merit. However clearly, down-voting isn't enough. Similarly to XKCD's ToradoGuard, we too can't always rely on averages and popularity. Who's going to place such banners? Similarly to "close" votes - reputable users, maybe ones with certain bronze/silver badges in the are. Does a highly-voted answer without the banner secure? No. But let's at least make the ones that aren't, especially if they are popular.
May 9, 2017 at 17:47 comment added CodeCaster @Malt banners have been proposed before, and are a solution. Maybe a better solution than doing nothing. It still has its drawbacks and things that need to be figured out: who is going to place such banners, and on whose authority? On which topics exactly? Does a highly-voted answer not bearing such a banner mean it is secure, correct or whatever we're bannering for? What if an unbannered answer gets outdated, or a bannered one updated? It's going to be a maintenance hell while not offering much in return.
May 9, 2017 at 17:42 comment added Malt @CodeCaster I can't suggest "not having them on the site" because that's impractical. But handling at least the popular questions that contain glaring security issues is easy. We can edit them and simply add a prominent warning. Bonus points for a link to a more secure implementation. Ideally, maybe we should have some flagging system that would change the answer's background or add a colored border around it if enough reputable people claim that the code is insecure.
May 9, 2017 at 17:30 comment added CodeCaster @Malt I don't know what point you're trying to make. What are you proposing? That answers with security flaws shouldn't be on the site? Do note that in this answer I'm merely summarizing earlier discussions about this very subject; I've posted an answer in the first of the linked questions if you want to read more about my stance on the subject.
May 9, 2017 at 17:30 comment added Malt If someone copy-pastes insecure code without understanding it, it becomes the user's problem. It's an important distinction. Both you and I might be one of the users of someone who used that piece of code. Buggy code is mostly the developer's problem, so it might be fine to leave broken code here and there. Security related stuff has a tendency not to show up until it affects real people; people that don't know, and aren't expected to know how to properly encrypt something.
May 9, 2017 at 8:13 comment added CodeCaster @David if you click the first link and read my answer, you'll realise I also don't like having insecure code on the site, just like you. It's just that according to the current rules, there's nothing we can do other than post our own answer and hope for the best. I don't see why we should add exceptions to that just for security-related questions, I'd rather change the quality standards altogether.
May 9, 2017 at 8:10 comment added David Conrad It really isn't fine.
May 9, 2017 at 7:59 history answered CodeCaster CC BY-SA 3.0