113

There are a number of answers to do with entropy (particular with GPG) which recommend running:

rngd -r /dev/urandom

This is VERY dangerous, and anyone following this advice is creating insecure GPG keys (this basically tricks the random number generator into believing it has more entropy by feeding its own data into itself).

I feel such answers are so dangerous that it should be marked in bold as dangerous, or even just deleted. But I'm interested in what the offical policy is.

13
  • 95
    Aww, I was expecting to see a foaming mouthed, red-eyed, knife wielding Answer...
    – James
    Commented Nov 10, 2014 at 18:43
  • 1
    See also: meta.stackoverflow.com/questions/255198/…
    – Gabe
    Commented Nov 10, 2014 at 19:23
  • 1
    A closely related discussion: meta.stackoverflow.com/q/266022/2359271
    – Air
    Commented Nov 10, 2014 at 19:39
  • 8
    @James What, you don't think rngd -r /dev/urandom is wielding a knife? Commented Nov 11, 2014 at 0:54
  • 28
    Your example is bad. I hoped to see a terrible, possibly malicious example reading the title, but was left utterly disappointed. The quoted answer only teaches a bad practice, but is not dangerous at all. Just explain in which cases $USER should not use the answer. Do not say "never use this answer", because you don't know the circumstances. Is it just a test? Are the generated keys not used in production anyway?
    – Kijewski
    Commented Nov 11, 2014 at 7:53
  • Well, saying "this is fine if you just need a key, and are aware the resulting key will be entirely insecure" would be fine, but many of the answers which state this don't say that. Commented Nov 11, 2014 at 11:24
  • What is GPG? GNU Privacy Guard? Commented Nov 11, 2014 at 12:09
  • 15
    Fyi, for this particular case: 2uo.de/myths-about-urandom
    – Ajedi32
    Commented Nov 11, 2014 at 16:40
  • 8
    I feel such answers are... What if you're wrong? Who gets to determine which answers are "just deleted"? Voting is how we decide that kind of thing. If you're really really really concerned about some specific answer, point it out on meta and convince a few dozen people to downvote the offending answer too.
    – Caleb
    Commented Nov 11, 2014 at 17:30
  • 4
    Aw, I was expecting the unholy spawn of rm -fr / having coupled with Tri-Force.
    – Kev
    Commented Nov 12, 2014 at 22:49
  • 3
    @WilliamShakespeare I think convincing people on Meta is generally not the way to go. Meta should be about Meta discussions. It should not be a platform to attract more visibility to an answer. You can use Twitter for that.
    – GolezTrol
    Commented Nov 13, 2014 at 10:59
  • 3
    Excellent example. rm -rf / will merely delete your disk. rngd -r /dev/urandom will leak your uboat positions to the enemy, causing you to lose WW3.
    – Johan
    Commented Aug 23, 2016 at 17:17
  • 1
    calling urandom very dangerous is controversial at best, ref 2uo.de/myths-about-urandom - here is a less controversial example, plain shell injection: stackoverflow.com/a/33926175/1067003
    – hanshenrik
    Commented Mar 5, 2021 at 15:29

6 Answers 6

209

Assuming that the problem is not caused by a simple typo (in which case, you can and should edit, as the answer can be fixed while maintaining the intent of its original author), you should leave a comment and downvote answers that are dangerously wrong.

You could also leave a better answer on the question, presenting the correct/preferable solution. Make sure you include a good explanation as to why the other option should not be used, linking to that answer and crediting its author as appropriate.

Leave it to voting after that. You don't have a veto on what is dangerous and what is helpful, and the best method of battling mis-information is by providing better information. Inform and educate, don't censor!

Note that wrong/dangerous answers should not be flagged for moderator attention. All a moderator will do is tell you to follow the advice in this answer.

14
  • 16
    So we are counting on new answers to long-answered questions and people opening the possibly long conversations under answers to find out an answer will lead their computer crippled and unsafe? I suppose that's democracy Commented Nov 10, 2014 at 15:53
  • 37
    @ChrisJefferson: everyone is free to shoot themselves in the foot and upvote a post on the internet that told them how to aim straight down. But over time the post that show you how to use a laser sight to shoot between your feet while wearing steel-capped shoes and explains the dangers of wrong floor choices and such, might garner enough upvotes to outstrip the other post. Commented Nov 10, 2014 at 15:56
  • 23
    I think the problem with that particular example is that there's a very real, immediate, and obvious consequence for following "shoot yourself in the foot" instructions. That's not necessarily the case for some of these console commands. They can appear to fix your problem (thereby earning your upvote)... while silently screwing you and anyone else who followed your endorsement.
    – canon
    Commented Nov 10, 2014 at 18:54
  • 7
    Also, you want the old one there so people can learn about the bad choice. If it is not there they might see the wrong information somewhere and think it is valid because they never learned otherwise. WRONG answers are often as helpful as good answers if they have comments explaining why they are wrong.
    – Hogan
    Commented Nov 10, 2014 at 19:43
  • 8
    +1 for "You could also leave a better answer on the question, showing the correct answer. Make sure you include a good explanation as to why the other option should not be used." Commented Nov 11, 2014 at 8:24
  • As a side point, if these questions are duplicates also then they may require closing as such
    – Sayse
    Commented Nov 11, 2014 at 8:27
  • 4
    the only reasonable way to distinguish a good from a bad/dangerous answer is voting. what if the person who gave the dangerous answer had the right to veto/just delete other answers? the person shouldn't and as there is no one who can distinguish the one from the other, we have invented voting :)
    – tyrex
    Commented Nov 11, 2014 at 9:07
  • 2
    I really like the phrase inform and educate, don't censor, but in general it doesn't really suit a moderated environment ;)
    – BartoszKP
    Commented Nov 11, 2014 at 11:42
  • @ChrisJefferson If the problem is that there's a thicket of unhelpful comments obscuring important comments like "Shooting oneself in the foot risks severe injury", flag it for comment cleanup. Commented Nov 13, 2014 at 10:48
  • @MartijnPieters is that comment copyrighted? :D
    – James
    Commented Nov 27, 2014 at 17:41
  • @James: it is covered by the same license as all other content here. Commented Nov 27, 2014 at 18:02
  • 1
    I'm a "person that uses this place" and I'm happy that the "official rules" are enforced. The rules are what keep the site relevant and (relatively) safe from a murder of time vampires (grip? pack? I'm not sure what the compendium is for 'time vampires').
    – user559633
    Commented Apr 14, 2015 at 17:48
  • Is it wrong to edit the answer and point out the dangers?
    – Clint
    Commented Jun 14, 2018 at 20:44
  • 1
    @Clint: yes, as it sounds like you want your opinion on the post to be special. Why is your opinion so much more important that a comment and a vote won't do?
    – Martijn Pieters Mod
    Commented Jun 14, 2018 at 21:17
30

Downvote and comment explaining why it's dangerous.

22

In most of the cases where it matters, you should be able to edit it.

Take a made-up example of an offending Q&A:

You can delete the cache directory with:

rm -rf /

This is obviously dangerous. A good edit could then be:

You can delete the cache directory with:

rm -rf /

This command deletes the root folder and all files and directories in it, recursively.

rm - remove files or directories

-r, -R, --recursive
       remove directories and their contents recursively

You shouldn't add opinions to posts nor anything that contradicts the statement of the original answerer; leave those for comments and alternative answers. But chances are most of the problems with

rngd -r /dev/urandom

are people not mentioning what it does. Adding (a small amount of) useful content to an answer should be encouraged.

If the answer, however, says

You can delete the cache directory with:

rm -rf /

This will delete directories explicitly marked to the OS as temporary cache directories.

adding the information from before would not be appropriate and you should fall back on votes, comments and competing answers.

As a real-life example, this edit is not appropriate, but an edit simply stating what the command does would be more than welcome.

6
  • 17
    But rm -rf / is perfectly safe to run and won't delete anything! I do it all the time just for kicks. Commented Nov 11, 2014 at 8:13
  • 7
    You don't have to delete the root, USR alone should be enough.
    – Geeky Guy
    Commented Nov 11, 2014 at 22:30
  • 1
    I like this way. One might downvote and comment the "evil" answer, and even post their own, but in case when the "evil" answer has many upvotes, not so many visitors will pay attention to all what you did. An edit like that will improve such leading post.
    – TLama
    Commented Nov 12, 2014 at 22:59
  • @Renan holy heck Commented Apr 22, 2016 at 20:48
  • Your suggestion to fix the (made up) problem post does not make any sense, nor would it fix anything, because you'll still end up with an empty disk, (but perhaps that was your intention all along :).
    – Johan
    Commented Aug 23, 2016 at 17:06
  • "the question, however, says" :: not question, but answer.
    – user202729
    Commented May 27, 2018 at 9:52
4

As Martijn and Scimonster said, downvote and explain why. Then post a better answer.

I would just like to add that in the long run, people will learn right from wrong. Even if it takes years. About ten to fifteen years ago you could do SQL injections in just every other site, while nowadays everyone with more than a week of programming experience knows how to avoid that. It may be that the error you are pointing (low entropy number generation) will go through the same cycle.

3
  • 47
    I admire your optimism but spend too much time in the SQL tag to share it.
    – Air
    Commented Nov 10, 2014 at 19:45
  • 5
    @AirThomas: I vote for a sql injection free day on SO. I indeed see them on a daily basis. Commented Nov 10, 2014 at 21:31
  • 1
    @AirThomas For what its worth, I see this all the time in crypto-related tags. There is a lot of crypto copy-pasta with huge security flaws out there that seems to keep getting regurgitated in SO questions and answers. I try to do my part by posting comments and alternative answers.
    – Dev
    Commented Nov 11, 2014 at 17:20
-17

Edit the answer to state that the method is dangerous, explain why, and add a method that may be better.

4
  • 2
    Edit the comment? Why can't you just create your own comment? Commented Feb 2, 2015 at 23:36
  • 7
    @PythonMaster People are lazy. They don't look at comments.
    – Joehot200
    Commented Apr 6, 2015 at 17:51
  • Did you mean "edit the answer"? Regular users can't edit comments at all.
    – cigien
    Commented Jan 15, 2022 at 18:47
  • @cigien I have no idea my friend, I was 14 years old when I wrote that and I`m 21 now. But yeah, I probably meant "edit the answer".
    – Joehot200
    Commented Jan 15, 2022 at 22:07
-19

Flag the answer for removal

If code on the site is dangerous and you know it to be dangerous, scream loud about it. Flag it for removal. If you see a flag and you know the code is dangerous, delete it. Seriously, safety first. The community should be safe for new users, and they shouldn't be at the mercy of flawed corporately moderated democracy.

Downvote for me anyway, doesn't mean "this code is unsafe and will destroy things" it means just that -- that I dislike the code. I think safety and security fit into a different category than style, efficiency, and performance.

2
  • 1
    What exactly do you mean by "... flawed corporately moderated democracy"? All the moderators are volunteers, and so are the community members who curate the site.
    – cigien
    Commented Jan 15, 2022 at 18:50
  • @cigien to run in an election you have to pass a background check. You can be denied the privilege of running in an election, for example, for saying that "Israel is an Apartheid State" to a Zionist on a totally different site in the Stack Exchange network, because they conflate anti-zionism with antisemitism (for reasons unexplained) Commented Jan 23, 2022 at 3:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .