I think the problem is not with the owner of the router, but with the snippets.
Now, the reason I am going to talk will seem like a bit of a stretch at first, but it's still a valid argument.
Why something has to change
Before reading about this post, I thought that I could feel safe running snippets here on Stack Overflow. When I download torrents, I know that I have to look out for all of the obtrusive ads that blast "Download NOW" or "Start download" and carefully tread through whichever sketchy website I'm on to make sure that I download the torrent I'm looking for, from the website that I'm expecting to download it from.
Compare this experience with using Stack Overflow. When I log onto Stack Overflow, I don't have to look through ads pretending to be the login button which would really lead me to a phishing site. Instead, I look for the only "login" button on the page, and I type in my credentials without worrying about the security involved.
Now imagine if Stack Exchange one day decided to allow advertising on their network. If the same advertisers from the torrent websites came to advertise here they could have their ads exclaim, "Log on here!", or even worse, they could mimic the actual login button/form. If an ad was obtrusive and well designed, it could possibly stand out and seem as though it was the actual legitimate login form.
Without being warned about this new advertisement, and without ads on any other page, a user could visit the login page, click login, and unknowingly be lead to a phishing scam.
Now, would this ever happen? NO.
So, what point does it make? This:
If the above scenario ever did happen, if Stack Exchange allowed advertisements and didn't care who advertised and didn't check the ads and allowed the ads to be absolutely too obtrusive, then I think many users would visit the site and see this fake login button and without noticing any difference, fall for the scam. Not because the scam was just too perfect, but because they weren't looking for possible threats. Why not? Because they're on Stack Overflow, not CoolestLegitTorrents.gov.net.biz.
Users trust Stack Exchange to not present them with any possible malicious threats.
The bottom line
I told you it was a bit of a stretch. But it makes the point that users on Stack Exchange are not only not looking for threats, they're browsing the site thinking that nothing can go wrong. Maybe not nothing, but at least thinking nothing is likely to go wrong.
The scenario I talked about would never happen. But, let's apply this situation to the snippets.
If I was given a link to a jsFiddle, I would want to look over all of the code before running it. I would at the very least, give it all a glance over to make sure I had some idea of what each part was doing. I don't know how much I should trust jsFiddle, so I exercise the same caution I would when I visit any site I'm not familiar with.
However, if I was presented with a snippet on Stack Overflow, I wouldn't know how much caution to exercise. I trust Stack Overflow more than I trust a site like jsFiddle, so I'll be less wary of snippets here than I would of code there. Surely SO has implemented something to prevent malicious code from getting through. Surely the code is ran on their servers and I only see the result... right?
The bottom line is, I don't know how much to trust snippets on Stack Overflow, so I'll trust them as much as I trust Stack Overflow. I don't expect the possibility of a virus, or a hack, or anything malicious, from any link on this network that doesn't take me away from the page I'm on, so I'll apply that logic to snippets as well. Stack Overflow never told me how much to trust them, so shouldn't I trust them as much as I trust SO? It's only default.
Since Stack Overflow never gave me any warning or any advice on this feature, I'll only assume that is because they've made it safe enough for me to not worry about.
Why the opposite argument is illogical
If we went with the "well any user smart enough should know better" argument, then we wouldn't have any new users. Any user smart enough would know how to make a good question, but we still have a "How to ask" guide. Why is that?
If we only wanted users "smart enough to know better" then we wouldn't have any guide or material for new users and we would simply delete every question that wasn't "good enough" for the network and not give the user a reason for doing so.
We don't do that though. If a question isn't found to be on topic, or isn't clear enough, it's put on hold for a few days and the author is told how it can be improved. We want these users. We want their questions. But, we know that making a good question on your first try isn't always the easiest thing to do so we have resources like guides, and perhaps most importantly... we have warnings.
Before posting a question, users see not one but two large panels with information and links on how to ask and how to format their questions. Why is this there?
The warnings are there because SO doesn't expect its users to be perfect.
Since SO knows that its users aren't perfect, it provides resources to make sure that users don't make the mistake of posting a low quality question.
Since SO knows that its users aren't perfect, shouldn't it at least warn users that the snippet feature isn't guaranteed to be safe?
What can be done?
It is very clear that the SO users aren't perfect, and aren't expected to be either. But what can be done, and why?
First:
- Why does anything need to be done?
Until being told otherwise, I think that features on the Stack Exchange network should be treated the same. Unless a link/feature takes you away from the site you're on, you can trust it to not be malicious.
I think that this is perfectly reasonable.
I wouldn't expect clicking on a question to end up being malicious. I wouldn't expect reviewing to be able to lead me anywhere malicious.
I wouldn't expect any feature on this site to be malicious, but if one could possibly be malicious, I would expect Stack Overflow to give me a warning.
If every feature on Stack Overflow is safe and has virtually zero chance of being an attack vector, except one, wouldn't you warn users about the one not being as secure as the others?
Second:
A simple warning.
- Maybe a little bit of text below every "Run Snippet" button that says, "Remember to exercise caution when running snippets. Don't run unless you know what the code does." or anything like that.
Or,
- A warning that pops up the first time you run a snippet.
Or,
- Some text somewhere when you sign up, or when you read a post with a snippet.
But something, at least.
This argument is the same for users who have been here any amount of time, with any amount of reputation, so I don't think reputation is going to solve the problem. Everyone needs to know.
Function
constructor onwindow
. I think the marginal security benefits to any blacklist-based approach like that would not be worth interfering with the legitimate use of Snippets for demonstrating that sort of code.mis
-usecode
styleall
overthe
place. If it's in a snippet block, at least it's formatted as a code block! It's trivial for an editor to fix that. That's way less significant than the issue being discussed here. (Though I don't think any change is warranted for either concern.)