0

I think security is a big issue on Stack Overflow. There are tons of old answers with bad advice and some with a high amount of upvotes. We already have everything we need to handle bad answers by downvoting, commenting or adding a note.

But we need to search and review a lot of old posts and we need new mechanics to prevent and find new answers with bad advice.

Here are some ideas I am thinking about:

  • Hints in the editor triggered by bad code like 'verify_peer' => false (static code analysis?)
  • A bot searching for answers that the need to be reviewed.
  • A security review queue on https://stackoverflow.com/review

What ideas do you have how we could reduce security issues on Stack Overflow?

8
  • 3
    You could use the Stack Exchange API to find postive-scored answers with specific vulnerabilities. Then have them judged by a chatroom; not unlike Smoke Detector. You should be careful that this doesn't turn into gang-voting.
    – S.L. Barth
    Sep 5, 2018 at 8:41
  • 2
    I don't like review queues for this; worried about robo-reviewing. Also, review queues are open to all users with enough rep. This "security review" requires domain expertise.
    – S.L. Barth
    Sep 5, 2018 at 8:45
  • @S.L.Barth the queue could explain the suspected issue and link to detail documentation about it. If the user does not feed qualified to answer he could skip. "Suggested Edits" can also require a lot of domain expertise. Some issues are very easy to spot like 'verify_peer' => false. Sep 5, 2018 at 8:50
  • 1
    I feel like there isn't really a perfect way to deal with such issues (on Stack Overflow, at least). Making edits to fix such things are often discouraged, the poster still "owns" the post and may revert the edit if they don't like it, comments pointing out such problems can get ignored and lost in the noise, downvoting may not have much of an effect, another answer may not draw enough attention and people voting or reviewing often aren't really qualified to evaluate anything beyond the obvious. Sep 5, 2018 at 9:13
  • @Dukeling There is no perfect way to deal with spam, hate speak or sexual harassment. It is all about doing something. That is what this question is about. Naming the problem. Encourage to do something about it. Right now with 4 downvotes and no answers meta decided to not care security issues. That makes me sad. But maybe I find the time to write a bot for this. Thanks for those hints. Sep 5, 2018 at 9:29
  • Don't get discouraged; you also have 4 upvotes. I wouldn't conclude that Meta doesn't care. I for one think you raise a good point, but I disagree with the idea of using a review queue.
    – S.L. Barth
    Sep 5, 2018 at 10:34
  • 1
    @S.L.Barth Thanks for your feedback. I picked the wrong headline. It looked like it's all about the review queue but that was just one example... Sep 5, 2018 at 11:07

1 Answer 1

3

we need to search and review a lot of old posts

We really don't. This looks like work. Work is bad. Especially bad when it's unpaid work created out of misplaced sense of duty.

enter image description here

Also, what is wrong with the following dialog:

X: Our company got hacked because someone copy-pasted insecure code they found online into our codebase.

Y: OMG! Let's go correct all the insecure code on the internet so this doesn't happen again.

3
  • 5
    I agree with the first part: We don't need to review all posts. Just those with traffic. The problem is not that somewhere is something wrong. The problem is that you google an error message and the first 3 links are to Stack Overflow and they all contain only horribly wrong answers. In this case we are responsible. We make the internet insecure because we misinform the world. Sep 5, 2018 at 11:17
  • 2
    @PiTheNumber, Agreed. I would go further and say we need to fix canonical Q&A, even if they don't have high traffic today. If users are marking posts as duplicates of canonicals we need to make sure they are high quality. This is a much smaller and more impactful workload.
    – jpp
    Sep 5, 2018 at 13:32
  • 6
    This answer contains an implication that the only way to inherit insecurity from a bad answer is by copy-paste. Not true. An insecure technique learned from a bad but upvoted answer will damage the security of code in which it's used, regardless of whether the implementation is copy-pasted. Even if you try to be responsible and research it further, that won't help if you just find 5 more terrible Stack Overflow answers. Sep 5, 2018 at 18:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .