We are having a disagreement in this meta question about whether a question involving insecure practices is by itself a reason to downvote or close the question. This would hypothetically be on the basis of insecure implementations being not useful. If the asker can learn to do something useful, but the way they want to do this thing is insecure, should the question be closed? Here's a great example.
-
2Low quality is an aspect of in the mouseover for a down vote (lack of research and unclear). Useful is another aspect.– user289086Commented Oct 31, 2014 at 5:38
-
@MichaelT I updated my question to use the language "useful". I also think downvoting my question because we disagree on possible answers wasn't very polite. We both are wondering this same thing!– ErlVoltonCommented Oct 31, 2014 at 5:49
-
4@ErlVolton Voting on meta usually indicates disagreement. It does not affect your rep in any way and is generally not considered impolite. You should not take offense when someone downvotes you on meta.– ivarniCommented Oct 31, 2014 at 6:02
-
1@ivarni: But this is not a feature-request, nor can it be mis-construed as such. It's a discussion (and not a fake one), so what are you disagreeing with?– DeduplicatorCommented Oct 31, 2014 at 9:56
-
@Deduplicator What do you mean? I haven't voted on this question. You need to locate and ask the two people who did if you want to know their motive for doing so. I can't answer for them.– ivarniCommented Oct 31, 2014 at 10:46
-
2Close on insecurity.. you mean burninate the C tag?– Martin JamesCommented Oct 31, 2014 at 12:13
-
@MartinJames LOL!– ErlVoltonCommented Oct 31, 2014 at 13:38
-
@Deduplicator I think what ivarni is saying is that people are downvoting as a way of answering "No" to the question, in other words questions involving insecure practices are useful– ErlVoltonCommented Oct 31, 2014 at 13:40
-
@ErlVolton: Yes, I know. Some people will always try to vote agree/disagree, even if there is not actually a question to disagree with. There was a good post by a mod how one should vote on meta, and that bandying about "dv==disagree" is harmful.– DeduplicatorCommented Oct 31, 2014 at 13:44
-
@MartinJames: Sure you didn't mean php?– DeduplicatorCommented Oct 31, 2014 at 13:46
-
@Deduplicator maybe. I went for bull instead of treble-20.– Martin JamesCommented Oct 31, 2014 at 14:04
3 Answers
whether a question involving insecure practices is by itself a reason to downvote or close the question
That alone is not one of the given reasons for downvoting a question, however, there's nothing stopping me or anyone else from downvoting for that reason. Whether or not someone finds it "not useful" because it's insecure is completely subjective. I could find it not useful for a very broad list of reasons that you may or may not agree with.
Voting is subjective in nature and always will be. If there was a clear always up or down case, we wouldn't need voting in the first place. (that's what close votes are for!)
Based on down votes which ATM we are interpreting to mean "disagree", it is not OK to downvote or close a question based on the security implications of the task the asker is trying to perform.
-
3Downvotes could be that people disagree with the proposition in the title. It could be that people find the question faulty. And the upvotes don't necessarily mean the folks agree. It could just mean the find it is a discussion worth having.– LouisCommented Oct 31, 2014 at 14:17
-
1@Louis So votes are totally ambiguous? I'm still going to interpret them in the way that best suits my personal agenda :) Commented Oct 31, 2014 at 14:21
-
4On Meta it is unclear whether a vote (up or down) is based on the quality of a post, or disagreement with the post, unfortunately.– LouisCommented Oct 31, 2014 at 14:22
-
OK so fair enough and I actually want a real answer, not just what I want to hear. Do you have suggestions for how to get concrete feedback on this because I think it's an important question, it certainly has large implications. Commented Oct 31, 2014 at 14:24
-
There's no voting mechanism on the SE network that would give you a clear yea or nay picture, I'm afraid. On a feature request (rather than a discussion) that is well written, I'd expect votes to closely reflect "yes, I want this feature" vs "no, I don't want it". But for anything else... there's no simple way to know.– LouisCommented Oct 31, 2014 at 14:28
-
@Louis So you're saying that meta, in all of its widsom, is completely incapably of answering this question? Is there a better way for me to ask it or do we just lack the tools needed to collect a consensus? Commented Oct 31, 2014 at 14:29
-
Yep. I recall feature requests made to disentangle the votes so that someone could vote a discussion up to mean "good post and a discussion worth having" and still vote it down to mean "however, I don't agree with the proposition". So posts would be voted on on two criteria: the quality of the post (as we do on the main site) and agree/disagree. No such feature request has ever been accepted.– LouisCommented Oct 31, 2014 at 14:34
-
3@Louis My feature request for feature requests is stalled because no feature request has been passed to change how consensus is collected for feature requests :) Commented Oct 31, 2014 at 14:37
I don't think opinion-based (down)voting is good for SO. By "opinion" I mean :
- because SO is going to be read by newbees looking for easy quick copy/paste answer codes, questions with (obvious or not) security breaches must be closed/deleted ? Newbees doing it wrong takes full responsibility for themselves, not the OP.
- because answering the question can make OP and other programmers less attentive, and do things wrong in jobs and missions ? No ! You're fired (if not more) when you do it wrong; good programmers never blindly copy/paste and always try to write safer code whenever required. If he/she doesn't like rigor, that means he/she isn't a that good (yet).
- because you've encountered countless times the same failure to check security issues doesn't mean it's always the case.
- What is amazing today is that you can think of thousands of patterns to achieve one thing by code. But only few of them are perfect. However, we don't live in a perfect world. "Never create a class B subscribing on events raised by class A, that contains a reference to class A..." Sometimes you can't do otherwise. Failing to help OP in his requirements - even complicating and overloading the code alot - end in a Not answered question. Not because the question doesn't have an answer, but because (some) answerers think that
"a->z"
codes are only the usefull answer, but"abcdefghijkl->z"
codes are total non-sense.
^^ all that are opinion-based and IMHO are irrelevant reasons to downvote/flag a question.
From the moment the OP is notified in comments of the insecure aspects of his doings, and replies I'm fully aware of that
-like confirmation, I will upvote the question if it meets the requirements of SO (clear title, good choice of tags, clear starting context, clear goal, clear issue, some background tries to find a workaround, and a precise question, no duplicate)
But I'll never downvote first without knowing anything about the OP's background in security awareness and coding context.
Why ? -> Because SO is about Q&A. ie, from the moment an answer can be formulated for this question regardless of its nature, poster, aspect, formatting or outer context, ... , answerers should try to provide an answer, or leave a(n usefull) comment if they have an idea (and have time for).
Side note : there are tons of new questions every day on SO. Many of them are questions not meeting the requirements of SO. However, I'm not of the type "downvote and flag immediately" but the type "give hints to improve the question in comments and see if OP is willing to - then come back twelve hours later and downvote/flag if no improvement so far". The SO community is often reffered as a tight group of failsafe super experts type programmers that doesn't want new members (this is a long-lived debate on SO) I'm not adding oil on the fire and I don't want to discuss further, just to underline "The SO community is responsible of the image it gives to newcomer". But since the community is hunderds of thousands of single ones, that makes almost as many ways to think/interpret/behave.. we don't live in a perfect world, but we must deal with.
I'm not saying [Do my Homework/Write me a code (now) pliiiz] like questions have their place on SO either. (in fact I don't like them) But there are some interresting questions that lacks enough attention even with an extensive help of friend Google worth to exist on SO, when almost all researches on the web are garbage...
Back on topic, almost all researches on the web are garbage when it's about obvious security breaches because people tend to refuse to answer the question. Do you think this will stop someone else to ask the same question again (here and elsewhere) ?
Those "Does questions of type X have its place on SO ?" concerns cannot never be settled once and for all because the community grows and evolves. Every community (society/civilization) that failed to adapt tend to disappear.
Wow.. X_X my mind gets so far ?? Sorry ! XP. Just wanting to say : you can always to better example (than not answering)