6

How do we handle questions or answers that include code with severe security issues? Ignoring them is certainly not an option.

A similar question has been asked and discussed before; as “Cupcake” points out precisely:

It would be irresponsible not to, because not only do you let the original poster walk off with vulnerable code, but any other user who stumbles across it may unknowingly just copy and paste the insecure code into their own applications.

But the outcome of the above mentioned and similar discussions isn't really satisfying. The existing means of Stack Overflow to react to this kind of problem are not appropriate.

  • Giving verbose explainations in comments is really tedious, especially if you look at lots of posts, and have to point out the ever same security issues again and again.
  • Also, a mere comment is not obvious enough. Occassional visitors don't read comments; they see a code block and copy/paste it, especially if it's an answer.
  • Users who can't comment, and feel the obligation to “do something about it”, leave answers – which again would be deleted as irrelevant to the actual question. That's especially frustrating for new users who are motivated, but are insecure about the “dos and don'ts” of SO.

So, what to do?

I would propose an additional kind of flagging posts: If posted code has a severe security issue, it should be flagged as such. There flag should result be a big red warning icon/label near the code or at the top of the post.

Also, when the post is edited, the reviewer should be able to tell if the security issue was fixed. That's not trivial, but if we concetrate on severe issues (see below), it should be possible for an averagely skilled developer without too many false positives/negatives.

The security flagging mechanism should provide “template” answers for the most common security issues, as well as a textarea for a brief explaination if the others don't match.

The tricky part is to define what a severe security issue is. If we'd label just any minor issue, then

  • awareness for the real big ones would be numbed down, and
  • we would get caught in meta-discussions about the severity/impact of security problem. (Although – hey, this would be a nice cross-promotion for Security SE!)

Luckily, there are several existing approached to classifying security issues, so we don't have to reinvent the wheel.

An alternative to flagging posts would be to edit obvious issues directly. But that's not really a solution, either: Fixing an issue may be much harder than spotting it, many issues would remain unfixed. Also, a bad edit may “break” the original question, in that the problem to be discussed would disappear.

12
  • 3
    How would the flag be handled? Who will decide if the issue actually exists, and how severe it is?
    – yannis
    Commented Oct 8, 2014 at 10:32
  • Like with other flags, there would be a moderation queue. Users with enough reputation (general or for matching tags) could decide if the security warning should be applied. Finally, moderators could review the flagging and decide if it's appropriate.
    – lxg
    Commented Oct 8, 2014 at 10:47
  • Is this problem (if it's a problem in the first place) really that significant, that it requires a new flag and review queue? (Imo: Nah.)
    – Cerbrus
    Commented Oct 8, 2014 at 11:08
  • 3
    @lxg Moderators? You expect 17 people to be able to judge potentially every security issue there is? I don't think that's going to work...
    – yannis
    Commented Oct 8, 2014 at 11:10
  • 2
    If people are unwilling to read comments on posts and are also unwilling to understand the code they are using, it's seriously not our problem if they decide to use it and face potential consequences.
    – eddie_cat
    Commented Oct 8, 2014 at 13:10
  • Ok, thanks for the feedback. To the downvoters: so you think that the question “does not show any research effort“, or ”it is unclear or not useful”? Please let me know in how far research effort is missing, or why you consider the post to be unclear or not useful. I'll try to improve it.
    – lxg
    Commented Oct 8, 2014 at 14:01
  • 2
    @lxg Downvotes on a feature request can also mean "I disagree with the request."
    – Louis
    Commented Oct 8, 2014 at 14:02
  • @Louis: Thanks for pointing that out. Do you have a source which supports this statement?
    – lxg
    Commented Oct 8, 2014 at 14:18
  • @lxg stackoverflow.com/help/whats-meta Specifically the "Voting is different on meta" section.
    – Louis
    Commented Oct 8, 2014 at 14:19
  • @lxg Your question is a feature request, so the downvotes are users stating "I do not want this feature implementing". As well as downvotes on Metas are more a general "agree" or "disagree" with what you said, than "poor question" or "good question".
    – James
    Commented Oct 15, 2014 at 0:11
  • See also meta.stackoverflow.com/questions/266180/… Commented Sep 5, 2018 at 7:48
  • To push this matter. I am still missing this very much, today again such ab´nswers an questions
    – nbk
    Commented Apr 4, 2020 at 10:07

2 Answers 2

12

No, this would be a bad idea.

The last thing I want to do as a moderator is to review potential security issues in answers. First, we can't possibly be subject matter experts in every single language or framework on this site. Knowledge of vulnerabilities is even more rarified than that, and requires constant updates.

This flag would be horribly misused, based on how people throw around wrong "not an answer" or "very low quality" flags. Those flags are easy to judge when they're wrong. This would require a lot of effort be invested to look into each such case, and would not scale to a site this size.

On the flipside, I imagine review of these flags in a non-moderator queue would be as problematic as all our other review queues. Even worse, in that this requires per-language and per-framework knowledge to judge such vulnerabilities, unlike other review tasks that can be handled without domain knowledge. My bet is that the same people clicking "No Action Needed" on spam would do the same on real security vulnerabilities in this queue.

11

Meh.

A downvote and a comment should usually suffice. Sometimes, it may be appropriate to edit out the problem; sometimes the entire post is worthless and should be downvoted.

The effort required to classify and evaluate security problems in code would be gigantic. If people are dumb enough to copy&paste code from the Internet and not read the comments, it's not our responsibility.

9
  • 4
    If you downvote, the security issue doesn't become obvious. A comment will most likely not be seen by many people, especially those who tend to copy/paste just any code from the internet without understanding what it does. And I strongly disagree that this is not the responsibility of Stack Overflow: SO prides itself in high quality, and if certain posts have less obvious, but severe issues, we should think about good ways to handle this.
    – lxg
    Commented Oct 8, 2014 at 10:52
  • 1
    I agree with this answer. Edit out the security issue if it's a big problem. Otherwise, just comment / dv.
    – Cerbrus
    Commented Oct 8, 2014 at 11:07
  • 3
    @lxg Why should we go out of our way to accommodate "those who tend to copy/paste just any code from the internet without understanding what it does"?
    – yannis
    Commented Oct 8, 2014 at 11:11
  • 1
    Downvoting is the quality control mechanism on Stack Overflow. If a contribution has a lot of downvotes then that is the perfect signal that it's not to be trusted. It works for all kinds of low quality content, including code with security flaws.
    – Pekka
    Commented Oct 8, 2014 at 12:33
  • Though the comment is really important to highlight why it is downvoted, as well as that it is downvoted, and to avoid having everyone and their grandma upvoe it anyway (at least as well as possible). Commented Oct 8, 2014 at 13:11
  • @yannis you're not accommodating them by fixing security issues in answers - you're making them less dangerous. you're helping programmers who have to clean up their mess, and you're helping users of websites who do not want to deal with poor security.
    – sleeparrow
    Commented Aug 4, 2017 at 19:08
  • @sleeparrow ultimately though, the responsibility is with the programmer who copy and pastes the code. It's fair to expect they at least look at the comments to see whether there's any issues.
    – Pekka
    Commented Aug 4, 2017 at 19:09
  • @Pekka웃 i think this point of view, while understandable, is not conducive to the spread of high quality information and the suppression of poor practice. sorry i don't have more to offer in terms of a solution. just came from this question and it has a very unfortunate spread of answers: stackoverflow.com/questions/1912501/…
    – sleeparrow
    Commented Aug 4, 2017 at 19:15
  • I think it is our responsibility if we rank it as the top answer with +70 votes. Commented Sep 5, 2018 at 7:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .