4

There was a question about handling input in a secure way. OP showed how they do it and asked whether it was secure. e.g.,

function secure_input(input) {
  // do stuff to secure the input
  // then return secured input
}

Two users commented that it was secure but then someone else put in an answer that demonstrated clearly how to defeat the function, leading to successful arbitrary code execution.

This post from The Overflow suggests that we, as a community, should do more to educate and raise awareness.

I believe I did that when I flagged these two comments, unfortunately they have been declined. If there were answers I would have downvoted them and left a comment.

It's my firm belief that the users who wrote these comments acted in good faith but the truth is that they are are both incorrect and "harmful".

Was I right to flag these comments?

Would it be possible to flag content as needing security review and create a new kind of review queue?

10
  • 4
    Upvote the counter argument seems like the only good option here. Commented Sep 11, 2020 at 19:44
  • 1
    AFAICT, you can't flag something because it is technically incorrect. That is the same reason why flagging an incorrect answer will be declined. But you are correct to think that the comments are wrong.
    – 10 Rep
    Commented Sep 11, 2020 at 19:50
  • 4
    Related question about insecure answers. I think a comment along the lines of "these comments are wrong, see X's answer below" would probably be enough. Commented Sep 11, 2020 at 19:59
  • 1
    Yeah, I prefer having these answer deleted. They are better studied on a academic setting, not in a site where people search for practical answers to software development questions. There's nothing practical into deploying a security vulnerability.
    – Braiam
    Commented Sep 11, 2020 at 20:03
  • If the question is deleted, the comments will go with it
    – Kevin B
    Commented Sep 11, 2020 at 20:33
  • 4
    Good choice to not link the post. It would most certainly have gone through the meta effect
    – Scratte
    Commented Sep 11, 2020 at 20:47
  • @KevinB There's no reason to delete the question IMHO. Commented Sep 11, 2020 at 21:05
  • @JohnMontgomery Thanks for the advise. Will do Commented Sep 11, 2020 at 21:05
  • 1
    What flag did you use? Also, rather than direct comments to the users, I guess you could have just posted a single comment stating both comments were mislead, comments voting system would have taken care of hiding less voted ones. (I fear your targeted comments have been perceived as aggressive and the answer there got a revenge downvote, but that may not be the case).
    – Kaiido
    Commented Sep 12, 2020 at 5:39
  • @Kaiido Yeah that's probably a better idea. Done. As for the revenge downvotes ¯_(ツ)_/¯ Commented Sep 12, 2020 at 5:44

0