-4

This is related to How to handle influx of [log4j] support questions, but it's been weighing on my mind and expressed in my conversations on Meta for quite some time now.

In simple terms: Stack Overflow leadership needs to set the expectations of question askers when they come to this site. The ability to do so at a curator's level is no longer sufficient.

We have a massive vulnerability with a popular logging library on our hands. In typical internet fashion, lots of technically inclined users are looking everywhere for information. In the void of vendors providing information, they are looking to the crowd to help gather that information for them - often in the form of, "Is X software vulnerable to this CVE?", or "how do I mitigate this CVE?"

These questions are not on-topic, and never have been. We have never purported to be the vendor or the party responsible for maintenance of these libraries. We have never been a definitive source of knowledge on what the mitigations for any vulnerability is or was.

However, because it's convenient to do so and the repercussions for doing so are light, people will ask on Stack Overflow anyway. At best, someone who's in the trenches with them (figuratively speaking) will provide a helpful answer for them. In a sense, this means that The System Works™, but in reality this is only furthering to mute actually on-topic questions about these logging libraries that don't pertain to us having to Google for a concerned technically inclined individual about whether or not their software they bought five years ago and never bothered to update or maintain is vulnerable to this CVE.

But this is a common thing I've identified over the last ten years here on Stack Overflow. We're a convenient resource, so we get these kinds of questions.

Right now though, we're at a crossroads. We're going to get a lot of these questions. We're going to continue to get a lot of these questions. And the few volunteer curators and diamond mods who know a thing or two about this enough to know to close it are going to be overwhelmed - it's not a matter of if, but a matter of when.

So I'm calling the leadership out on this one.

Make it clear to everyone asking questions that we cannot directly help them mitigate CVEs, and that they should be directing their questions to the software vendors and their appropriate communication pipelines instead.

If you value your product and have respect for the curation and moderation that has to happen, you'll at least say something about this. Not saying anything is going to make this swamp a whole lot more swampier.


Some clarifications and responses to comments:

Cody Gray: The sentiment of this vulnerability is that the attack vector is well established - a message that is logged out in any capacity is susceptible to this. What is not well-established is how that vector is exposed, or if it's exposed at all just based on someone's usage of the library. If they don't write logs at all even with this library, they're probably not vulnerable. If they don't write specific logs out based on human interaction, they're probably not vulnerable. So questions that ask "Is X vulnerable to this" fall flat on its face as lacking more details - we require more information than we are typically suited to get from a question asker.

The same thing applies to mitigation. "How do I mitigate X" depends on so many factors that it becomes a proper essay on how to deal with this. I would know; I'm working at a place that has to do this kind of triage. To me, mitigation based on individual circumstantial usage of Log4j or a vendor's usage of Log4j reads like the security equivalent of how to build a forum.

But more to the point, Cody - canonical dupes are only effective if there's enough people marking the sign post to it. If the company were to put some kind of message or something that detected if someone were talking about Log4j's vulnerability in their question, then maybe this form of curation could actually work. These days I have seen diminishing returns from canonicals such that, while they serve a purpose, if they're not amplified enough, we're going to be playing whack-a-mole this entire time.

Lastly...this is something I really do want to stress - when it comes to matters of security, Stack Overflow shouldn't be an option. Trusting disinterested strangers on the Internet with the security viability of your application is begging for trouble. Getting good and accurate and up-to-date information from the vendor is better. Case in point - Apache recently updated their guidance to explicitly discredit one popular and quickly-spread approach which would not close all attack vectors. Do you really think Stack Overflow's gonna update quicker than Apache on matters like that?


cigien: I think I'm looking for that extra amplification factor I explained above. Amplify the message of this being a serious CVE and this is a better place for you to get help with it. Casual users of Stack Overflow expect far too much of the site or the service when we're all just volunteers, likely dealing with this on our own, but we can't be relied on for accuracy or correctness unlike Apache could be. That's the expectation people should get when they come to Stack Overflow - the actual maintainers on this know this better, and while we're volunteers who might know a thing or two, we're not the authoritative source on this, and you really need to go looking over there, instead.


Ryan M: We already do some limited Regex word detection and provide guidance in select occasions when asking a question; why not there so that it's right in their faces?

27
  • 62
    Wait. "how do I mitigate this CVE?" is definitely on-topic, if adequate information is provided. That's a practical programming question which would be asked by a practicing software developer. We definitely are a definitive source of knowledge on mitigations for software vulnerabilities. I agree with you that "Is X software vulnerable?" is off-topic. Although, as I stated elsewhere, the real solution to this is fully within the grasp of curators and requires no action on the part of the company or executive leadership. Dec 15, 2021 at 4:10
  • 35
    Could you clarify what exactly you expect staff to do about this? Typically, content curation is handled by the community, so it's not clear to me what you want to happen here. What does staff putting their foot down going to mean here? Unless, of course, you literally just want staff to say something. That shouldn't be a problem; they're good with words. It won't make any real difference on the ground though.
    – cigien
    Dec 15, 2021 at 4:54
  • 33
    Which of the various locations that people don't read before posting should this be added to?
    – Ryan M Mod
    Dec 15, 2021 at 10:17
  • 16
    I'm fully on board that "Stack Overflow leadership needs to set the expectations of question askers when they come to this site" but I really don't see why "These questions are not on-topic, and never have been". Dec 15, 2021 at 10:18
  • 2
    And what is the real difference between "how do I mitigate this CVE?" and "Is X software vulnerable?"? Can't the latter just be edited into "how do I mitigate this CVE in X?"?
    – Laurel
    Dec 15, 2021 at 13:37
  • 25
    I'm not with you on any of this. I don't think anything is inherently wrong with the kind of questions you describe (though many may of course be crap for idiosyncratic reasons), nor see why it would otherwise be a matter for the staff to deal with. And even if I accepted those premises, I don't see how an "influx" of... [checks]... 100 questions in 2 days, on a site that already gets multiple crap questions per minute, is a significant enough problem to warrant "calling out" the staff or characterising a failure to take the action you want as showing a lack of respect for curators.
    – Mark Amery
    Dec 15, 2021 at 13:44
  • 8
    There's a difference between being on-topic and being too broad. I don't see how these questions could be off-topic. Some may be too broad/unclear and should be closed, some might be more suited for Code Review.
    – Lundin
    Dec 15, 2021 at 15:07
  • 6
    @Braiam nothing prevents providing instructions/explanations and properly source them. In fact, that’s what any question should normally do.
    – Didier L
    Dec 15, 2021 at 16:24
  • 2
    @Lundin: A point of umbrage: "too broad" is "off-topic".
    – Makoto
    Dec 15, 2021 at 17:42
  • 4
    @DidierL: To what end? Imaginary unicorn points, or actually solving a very real very impactful problem? That's the line you have to draw when consciously duplicating information that's available elsewhere on the Internet.
    – Makoto
    Dec 15, 2021 at 18:33
  • 6
    @Makoto well, that’s how SO is built: centralizing all programming-related knowledge (build a library of detailed, high-quality answers to every question about programming) by giving imaginary unicorn points. We don’t have much choice but to accept that fact. We have the option to downvote questions which do not show sufficient research effort, but that does not mean closing them.
    – Didier L
    Dec 15, 2021 at 19:48
  • 5
    @Makoto, that’s quite a bold statement! Vendors are not always the best ones to explain an issue, especially in the FOSS community and when there is little time and a high pressure due to the whole world looking at them. Moreover people have different understanding levels, they may have misunderstood some details in the vendor communication and get confused. Rephrasing is also a very important part of SO’s objectives, hence the benefit of keeping duplicate questions visible and generally allowing very similar answers.
    – Didier L
    Dec 15, 2021 at 21:58
  • 3
    @Braiam Something being a copy, or mirror, of another resource doesn't impact it's "quality"
    – Kevin B
    Dec 16, 2021 at 16:03
  • 3
    I haven't seen black holes. That doesn't mean they don't exist
    – Kevin B
    Dec 16, 2021 at 16:05
  • 3
    I don’t see why you are discussing the question of "copying" (which could even come with licensing problems). I was only stating the fact that SO is full of content that is duplicated from elsewhere, often with rephrasing, and that’s perfectly OK. You cannot answer every possible question without doing that, at some point.
    – Didier L
    Dec 16, 2021 at 18:30

1 Answer 1

-8

What if you are the software vendor? Shouldn't you be able to find answers on Stack Overflow related to fixing the vulnerability? I think you should be able to.

Regarding questions seeking support from the vendor, e.g. is this specific library version vulnerable, yes, I agree, they should be closed as off topic.

15
  • 21
    Maybe it's just me, but if a software vendor has to rely on Stack Overflow to fix a major vulnerability in their own software, that's... not a good look for them.
    – F1Krazy
    Dec 15, 2021 at 12:39
  • 20
    @F1Krazy: SO is used by all programmers, regardless of the size of the company they work in. In any case, here the vendor isn't just the developers of log4j library, but also the developers of countless projects/libraries that use log4j as one of their dependencies.
    – user000001
    Dec 15, 2021 at 12:56
  • 1
    The thing is that SO isn't the channel to do so, there's no guarantee that anyone has authoritative knowledge of the issue. Heck, last time Jeff had to verify the mail of a user to make sure that it was the person it purported to be. Jeff isn't here anymore, and the only source of authoritativeness is the references that you can provide on your post. SO doesn't need to be the be all, end all of every issue a programmer find. There are questions that are on topic about this library, customer support isn't one of them.
    – Braiam
    Dec 15, 2021 at 13:52
  • @Braiam: I agree with what you said, is there anything wrong in my answer?
    – user000001
    Dec 15, 2021 at 14:04
  • "Shouldn't you be able to find answers on stack overflow related to fixing the vulnerability? I think you should be able to." that statement says that you don't agree with what I said. Giving guidance on how to fix vulnerabilities is a vendor responsibility, not internet randos
    – Braiam
    Dec 15, 2021 at 14:09
  • 22
    @Braiam: The same could be said about almost every programming question, "ask the developers of the framework, don't ask random people on SO". I don't see why mentioning a specific vulnerability in a programming question makes it automatically off topic. Feel free to add an answer with your point of view though.
    – user000001
    Dec 15, 2021 at 14:13
  • 2
    @F1Krazy Agreed, it's not a good look, but it's a shockingly common one. For example, SO is the premier catalog of Android bugs and their mitigations and workarounds, since Google's policy is to ignore them for years and then close them as "obsolete." Dec 15, 2021 at 17:25
  • 3
    This reads a bit like whataboutism. I cannot see how asking questions about how to fix or improve code is related to addressing and fixing issues related to a zero-day exploit. The way it came across was that a maintainer was literally asking Stack Overflow how they go about fixing their CVE, which is horrible. If that does happen then perhaps that's a wake-up call to users of that library to start looking into (and potentially funding) some other library that can accomplish the same thing with more competent development and triage practices.
    – Makoto
    Dec 15, 2021 at 17:39
  • @Makoto: Wouldn't fixes for the exploit involve updating code? (or at least, dependencies)
    – user000001
    Dec 15, 2021 at 17:42
  • 2
    @user000001: Yes, but that is code within the domain of the maintainer. At least it should be. If a maintainer doesn't know how to maintain or update their code, I really don't see how it's Stack Overflow's duty to then usher them through this process.
    – Makoto
    Dec 15, 2021 at 17:43
  • 1
    @Makoto: For the maintainers of log4j itself I can see your point. But for the developers that just discovered that one of their dependencies, or a dependency of a dependency of their code is affected by a serious CVE, and need help with the resolution of the issue, I don't see why I good canonical question about it would be harmful.
    – user000001
    Dec 15, 2021 at 17:49
  • 1
    The thing is that the canonical is just "update and hope" or "use this workaround that may not totally fix it". Also that presumes that you control the complete stack, on most case you do not. Most people asking these is the sysadmins, rather than programmers.
    – Braiam
    Dec 15, 2021 at 17:51
  • 1
    Ok, so exception for ~10 people out of a million people :-P
    – einpoklum
    Dec 15, 2021 at 22:39
  • @einpoklum: Please read the previous comments. Way more than than 10 developers have log4j as a dependency (direct or indirect) in their projects.
    – user000001
    Dec 16, 2021 at 3:13
  • 1
    To be fair any developer who does not understand all you need to do is make sure any user-provided content is cleaned (escaped) before writing passing it to Log4J, the same as you would if it's going into a DB, however that is the be-all and end-all of the answer one you answered them all,
    – Barkermn01
    Dec 16, 2021 at 11:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .