24

Right now I am talking about this one. But I have seen similar answers before as well. My concern is not the obvious low quality (links tend to go stale) of such answers but security implications. The linked executable file could legitimately solve the problem in the question at the time of posting. But later on that file could be easily replaced by malware. And if in the meantime such answer gets a few upvotes - that would seem like an endorsement of legitimacy of that linked file by SO.

I am not sure what is the best way to deal with the issue. Possible solutions could range from adding a disclaimer to all posts with links (maybe besides some whitelisted domains) to banning some known file sharing sites.

2
  • 3
    If you try to actually download the file: "Sorry, this file is infected with a virus Only the owner is allowed to download infected files." The alternate download link is offline too. Yeah... Commented Aug 20, 2016 at 21:45
  • 3
    Yet my custom flag was declined by a moderator. I flagged it as NAA since then
    – Alex P.
    Commented Aug 20, 2016 at 21:52

2 Answers 2

8

You can use the tools that you have at your disposal, i.e. comment, down-vote and vote to delete. I don't think flagging for moderator attention is necessarily appropriate, unless you have evidence that the link has been replaced.

If you really think that people need warning not to run unknown executables they find on the web leave a comment to that effect. Making sure that the answer contains enough information so future users can find the tool independently could also be an appropriate response. That way future visitors aren't reliant on the link and can verify that what they are downloading is the real thing.

If you are sure that the link has been replaced then edit it out (with a suitable explanation in the edit summary if you are suggesting an edit) - just like a link that 404's a link to malware is not something we want to keep around. If removing the link makes an upvoted answer meaningless then it's probably appropriate to flag it for a moderator to delete. Please make sure you tell us exactly why you're flagging to avoid any misunderstandings.

If the answer is little more than the link then a down-vote is also appropriate. However, if the answer provides potentially useful information then down-voting is not an option.

If you have enough reputation (20k) you can vote to delete negatively scoring answers.

14
  • 2
    That doesn't work when the post is locked like here
    – Braiam
    Commented Aug 20, 2016 at 21:23
  • 1
    @Braiam - locking stops all regular user activity on a post - I'm not sure how that's relevant to this question.
    – ChrisF Mod
    Commented Aug 20, 2016 at 21:26
  • 16
    Judging by the quality of majority of questions I come across - those people would run anything if it would promise to solve the problem at hand
    – Alex P.
    Commented Aug 20, 2016 at 21:27
  • 4
    "How to deal with post that pose a security issue?" > "Comment and vote" > "Can't neither because the post is locked." If it isn't clear, I don't know what else I have to say.
    – Braiam
    Commented Aug 20, 2016 at 21:28
  • 4
    @Braiam the question makes no mention of locking which is why I was surprised you brought it up. If you have any concerns about a locked post you can flag it for moderator attention
    – ChrisF Mod
    Commented Aug 20, 2016 at 21:32
  • 2
    In this case, apparently Google things they are distributing malware. Commented Aug 20, 2016 at 21:48
  • @AlexanderO'Mara - in that case that's different.
    – ChrisF Mod
    Commented Aug 20, 2016 at 21:49
  • You need to up your game... nothing can be done to a locked post: no votes, no edits, no comments and no flags.
    – Braiam
    Commented Aug 21, 2016 at 0:08
  • 2
    @Braiam it's only locking for historical significance that prevents flagging. In that case ask a question here on meta about it.
    – ChrisF Mod
    Commented Aug 21, 2016 at 0:17
  • Which tend to be the more problematic ones...
    – Braiam
    Commented Aug 21, 2016 at 1:08
  • 1
    so the process to edit an answer that was locked for historical significance is to post it on meta? the missing tarball in the linked answer seems like a pretty useful vector if you manage to snap up john trammel's domain when it expires next year.
    – worc
    Commented Aug 22, 2016 at 21:33
  • The whole point, @Braiam, is that you are not supposed to flag a post for moderator attention because a link is dead. Doubly so for posts that have been locked for historical/hysterical significance.
    – Cody Gray Mod
    Commented Aug 23, 2016 at 8:11
  • 4
    @AlexP. Maybe we should encourage posting infected links to such questions ... a software equivalent of the The Darwin Awards :-)
    – TripeHound
    Commented Aug 23, 2016 at 9:04
  • @CodyGray nah, I just want to flag them as naa.
    – Braiam
    Commented Aug 23, 2016 at 11:46
-2

I am the one who posted that answer (to my own question).

The linked executable file could legitimately solve the problem in the question at the time of posting.

About the links: One is an open-source project and the other one from clockworkmod. The tools also are well known among those who have at any point of time needed it. I myself have used it several times.

But later on that file could be easily replaced by malware. And if in the meantime such answer gets a few upvotes - that would seem like an endorsement of legitimacy of that linked file by SO.

I believe, anyone (even a beginner) would read a little before running any executable.

More over, what do u suggest should be an answer to this question if not a link to the tool that the developer needs to get it working.

3
  • "I believe, anyone (even a beginner) would read a little before running any executable" well don't agree with that statement, but it doesn't really matter - its not SO's task to educate people to think before they do. I mean if an answer contains code which will delete all files, then running that code will delete all files. Should all file deletion code come with disclaimers and bright warnings? Heck no.
    – Gimby
    Commented Aug 24, 2016 at 8:26
  • @Gimby Sorry, I am confused by Your comment. Why not to warn? Sounds very reasonable proposal to have such warnings, though maybe not the main topic of current question. Commented Aug 25, 2016 at 10:06
  • @RolandPihlakas if you want to do it go ahead, I am a firm believer of personal responsibility and reasoning skills and consider it unnecessary padding. The target audience of SO should know better.
    – Gimby
    Commented Aug 25, 2016 at 10:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .