TL;DR; I've just gotten review privileges. What should I do about a PHP question which leads to an auction site which leads to a piracy site?
Very recently I have been given permission to start reviewing questions, and I gave it a try, tackling 'first user' questions. Unluckily, the very first one threw me into an ethical dilemma.
The question, taken out of context, was harmless. Essentially, a new user found an issue with some PHP code that was throwing an error. He pointed out the exact file name and line number that gave the error and posted the relevant lines of code. He didn't add much more — limiting himself to the essential: this is the relevant code, this is the error I get, what can I do to fix it?
My first reaction was, 'oh, I know that one, that's an easy answer!' — because I had encountered the same error countless times before on all kinds of software. The code was in PHP; and, for those of you who aren't familiar to PHP, there have been dramatic changes in the past few years: for around 16 years or so, PHP was next-to-code-frozen, in the sense that there were mostly minor issues dealt over the years, with a few extra goodies here and there, but things remained pretty much the same for a very long time.
Some hosting providers have made the push from PHP 5.5 to 5.6 (a sort-of-transitional version where developers could check if their code was going to be 'future-proof'), then to 7.0 as PHP 5.X became obsolete and unsupported (breaking all unmaintained/sloppily programmed code which ran under 5.6 with tons of notices, warnings, deprecation alerts, and so forth... which were enforced as fatal errors), and, finally, to 8.0 (not a dramatic improvement over 7.X — except in performance! — but which enforces an even stricter style of coding, beyond what 7.X already did). These changes happened quite fast, over the period of just a few years. The main problem these days with 'old' PHP code is that people were writing sloppy code for almost two decades; as soon as the new, stricter, more rigid rules started to be mandatory as opposed to just giving deprecation warnings, code started to break.
For those who have been fixing thousands of lines of legacy code, the question asked seemed to be perfectly valid (taken all the above in context): someone who is not proficient with PHP suddenly found out that their legacy code stopped working, as their hosting provider pushed PHP to (possibly) 8.0. They might have been warned for years, but they ignored those warnings. Now they've got a completely broken site, and are baffled at the kind of errors given to what used to be completely valid PHP just a few weeks or months ago.
Because they didn't say if they had written the code themselves or were using some sort of package or application, my first step was naturally to google for similar errors, just to see if it was related to a package, and, if yes, see if there was an update/upgrade that they could apply, instead of 'hacking' the code directly — which, remember, was really easy to manually fix, but my usual approach is to check first if there is an official patch/update/upgrade available. This is what I do with WordPress plugins, for instance; I just fix them manually if it's clear that the plugin has mostly been abandoned, and leave a reply/comment/new thread of the technical support forums/GitHub repository so that others might find a quick fix in the future, when googling for the same issue. As said, since the push from PHP 5.5 to 5.6 to 7.X to 8.0, all of which happened in just a few years, I have followed this modus operandi consistently for lots of apps/plugins with legacy code out there.
To my surprise, in this specific case, I found not only that this particular error — same filename, same line number, precisely the same code — was not only been asked all over the place (including several questions on SO!), but, even more strangely, there were lots of sites found by Google and Bing that exhibited that error directly on the homepages — basically rendering such sites inoperational, and, worse than that, clearly showing their audience that they had an error and a system administrator/web administrator who was completely clueless about how to fix that.
Interestingly, all those websites were auction websites, and mostly for domain names. While their overall look & feel might be different (I didn't check that many!), the error was consistently the same.
It didn't take me long to identify the source. On Envato, there was an auction application being sold for a small license fee. Envato being Envato, the author was quite engaged with his community of customers on the public tech support forums, and it was quite obvious that the software had been gone through several revisions and upgrades over the years, and seemed to be a reasonably popular tool for auctions, being well-maintained by its author. There was no reason whatsoever for a legitimate customer to have an outdated version which broke down 'unexpectedly'; sure, they might not be very proficient in understanding what was happening and how to fix it — basically, the answer would be 'install the latest version' — but at the very least they would know how to ask for help through Envato. Even a very clueless customer, who had forgotten their login & password for Envato, would, at some point, figure out how to recover those, log in, download the latest version, contact the author seeking help, etc.
Then why bother to ask such a question on SO? (or any other similar site; the question has been asked over and over again at all sorts of Q&A sites, not only SO & friends)
It wasn't immediately obvious to me, but I tracked this common issue to its origin. A popular piracy site in Turkey had a cracked version of this auction script — albeit an outdated one. That site doesn't even need a complex registration to download the software, and their maintainers even take some time to copy a lot of the materials from the Envato's official page for the software. That means that not only do they get hit by search engines by people looking for the legitimate software (the site, however, is quite clearly stating that this is a cracked copy of the software, not requiring a license number to use), but that users of this software will get access to a reasonable amount of support material — some installation instructions, manuals, FAQs, and so forth. Like all pirated stuff, this was by no means complete, but... good enough for a not-so-scrupulous wannabe entrepreneur to start their business and forfeit any payments to the legitimate author and licensor of the software.
Now, I'm not questioning the morals behind such an attitude (especially because the licensed software is dirt cheap, just $59 or so — you'll recover the investment after the completion of a handful of auctions), and I'm well aware that this meta forum is not the place to discuss it. I did contact the author of the software (via Envato) and make him aware of the site that has a pirated copy of his software — without going into details and wishing him good luck in getting his software delisted from it. That's as far as my own ethics can go.
It remained to deal with the actual question made on SO. How should I answer, what was apparently a harmless request, when it was clear beyond a shadow of a doubt that the OP was running an illegal copy of the software?
Remembering Hanlon's Razor, I didn't automatically assume that I was dealing with an unscrupulous user — people are innocent until proven otherwise. Consider the following scenario, which I have encountered so often in my professional career: a potential entrepreneur, SEO-savvy, is looking for yet another way to make money. They follow the many websites with tips and ideas of potential web-based businesses which are cheap to start and easy to become profitable without much investment. They come across some article saying that auctioning domains is 'the thing' these days. Now, they are quite knowledgeable about the marketing side of the business: how to exchange links with other sites in order to push their page ranking up; how to set up mailing lists (without crossing the fine red line that leads to spam), and so forth. But they're not programmers. So they hire someone to make them a cheap website for a handful of dollars.
That 'someone' might not be over-scrupulous, either. They are being paid a pittance; and that means they really cannot afford to spend a lot of time to develop such an auction website from scratch, since they aren't paid enough for that. All they can do is sort of adapt existing software to do what their customer wants. They also know that their customer knows next to nothing about web development, but that they're not stupid. If they were told that they could just obtain a dirt-cheap license for some software that does 99% of what they need... they'd lose their customer, who might just be proficient and knowledgeable enough to do that by themselves. So they resort to grab whatever tool is out there which does most of the work and just tweak it a bit, not telling their customer where they got it. That almost always means pirating whatever is available, since the last thing they want to deal with are licenses — these require explaining to the customer what they're using. Instead, they say, 'Oh, you want an auction site? That's easy and cheap; by a happy coincidence, I just happen to have an open-source script that does pretty much everything you need, I just need to tweak it a bit, that'll cost you at most $500'. And they can even send the customer the open-source code — which, well, is open-source, it's just not free. The devil is in the details. The customer simply doesn't know what they've bought, but they know that it works, it suits their purposes, and, well, they can recover the $500 quickly enough.
All works well until things break. The customer is now confused and asks his former programmer to fix things. Here two things may happen: the not-so-scrupulous programmer knows how to fix things and is willing to provide the necessary changes (possibly for a fee!), or, well, he's clueless as well about what needs to be fixed, but he can't tell that to his customer. So... he asks for help on sites such as SO. Because they know they have pirated software, but also that SO encourages minimalistic, strictly-to-the-point questions, leaving whatever is superfluous and unnecessary out, they provide the bare minimum of information about the error and ask how to fix it — and get the kind of free support they need, without anyone suspecting anything, especially not the customer, and not the original author of the legitimate software.
A variant of the above story is that the customer contacts his former programmer and asks for support, and either they don't get an answer back, or get charged an unreasonable fee for the fix, which they cannot afford; or, worse, the programmer just tells them that they are out of business and moved on to other things or started working for a different company and has no time for fixing 'his' old code (always a safe bet!). The entrepreneur has now a dilemma: he has bought what he considered to be a very reasonably priced bit of software, but has no real clue of what he bought, just that he has all the code, but no way to figure out how to fix it. So what does he do? Not suspecting anything about the origin of 'his' code, he tries to get free support from the only source he knows — SO and similar Q&A websites, full of volunteers who are more than willing to help out. Often they just ask around on as many places as they can (aye, in this particular case, I have found several instances of such requests that could be traced to the very same person — mostly they just copy & paste their question over and over again).
In effect, in the above scenarios, the reason for asking for (free) support is technically legitimate, according to most possible interpretations of the SO code of conduct and terms of service. Assuming that they are clueless about the origin of the code — they're innocent victims, not malicious users — they are just doing what everybody does here: finding a problem, locating the logs for the error, tracing it back to a certain line of code, asking for help to fix it. They might have no malicious or illegitimate intent behind their question and are genuinely asking for help. Even if someone on SO asks back 'what software are you using?' they can answer, in all innocence, 'I have no idea; I hired a developer to do a custom-made website, but unfortunately he cannot help me any longer, and I can't figure out on my own what's wrong with the code, much less fix it. Can you help me? What should I be looking for?'
And because the question, in this context, is so easy to fix, they might get a solution reasonably quickly.
Granted, it's far more likely that whoever is the OP, they are at least partially aware that they're using an unlicensed copy of some kind of software. Many will be fully aware of that — thus, they never mention what they're using, and just let SO users assume whatever they want, neither denying nor confirming anything, and just focusing on getting the code fixed. In spite of their intent, they are deliberately 'gaming the system' by not deviating one iota from the rules of conduct; they are not offering a single hint or clue regarding the nature of their pirated software. They're not endorsing it; they're not even claiming that 'pirated software is ok, because rms'; and they're not even saying that they're using pirated software.
In fact, by not saying anything beyond the essentials, they're strictly following all the rules.
And it's not even possible to flag the question as being irrelevant, not worthy of being asked, or that it's a XY problem — because it's neither of those. Fixing legacy PHP code to work under PHP 8 is currently the trendy thing to ask, because there are so many issues in migrating that code. The answer to this particular question is important to lots of others who have similar issues or errors in their own, legitimate code; and, as a consequence, a good answer on how to fix this particular problem can be applied to lots of cases out there, so, if the answer gets picked by the search engines, in spite of its dubious origin, it is nonetheless useful, pertinent, and may genuinely help out a lot of people (no matter if they're using pirated or legitimate software).
But there is also the flip side of things to consider. By continuing to answer such questions, applying the rules of SO without any regard for its moral and ethical implications, what we are saying as a community is that you're allowed to get free support for pirated software — so long as you phrase your questions in a way that nobody can flag them as invalid, or even vote down, or vote to close. In other words, we're saying: 'Have pirated software and need some free technical support? No problem! You are allowed to game the system here at SO, and, so long as you know exactly how to game the system, you'll get your free support!'
Being European, and living in a country where we have a long record of figuring out ways to cheat others, tracing that back to cultural issues in the 12th century, I'm naturally quite sensitive at these attempts to 'game the system'. As said, in this particular scenario, many people may be perfectly innocent — in which case, my actual answer was to point out that this specific error on that filename on that line of code comes from a not-updated version of a licensed application, and that it's always recommended to get an official download/patch from the author of the application (with links on how to do that). If the person is innocent, they will know whom to contact for support — and figure it out with the original developer. If the person is not innocent, well, they didn't get a free answer to their question, and now they know that others know that they are running pirated software — which is never a good thing if you're a serious entrepreneur dealing with online payments of some sort, requiring a certain amount of trustworthiness to get people to spend money on your site. It's obvious that they do not want their own customers to be made aware that they are running pirated software!
Thus my dilemma. I did flag the question for 'moderator review'; but the moderator, naturally enough, rejected such flagging — since, as said, the OP was 'gaming the system' so perfectly that there is not really anything worth flagging when using a very strict interpretation of the rules.
Nevertheless, there is a guy out there trying to earn a handful of dollars doing a legitimate business, and the way SO can be so easily 'gamed' means that we're pretty much screwing up his business. What's the point in spending months of development, releasing quality open-source software, and solely relying on qualified technical support as a means of revenue — when people can so easily get a cracked copy of the software and get the same quality of tech support from the nice volunteers at SO and related sites?
References to similar (but not quite the same) ethical dilemmas here on Meta:
- Are questions about pirated software acceptable?
- Dealing with questions that openly imply software piracy
- Help understanding declined flags: link to sale, NAA, request to help commit a crime
- How do we handle questions that are potentially or blatantly illegal or malicious?
Now, the issue I describe is a bit different from those cited above. Note that these are more concerned with 'blatantly' illegal issues, i.e. those where there isn't a shadow of a doubt that the OP needs help to commit a crime (which the OP knows to be a crime) and requests assistance from volunteers on SO — thus, for all intents and purposes, wishes to engage them as accomplices or, at the very least, accessories to the crime.
Those are, IMNSHO, much more clear-cut cases, not only from the perspective of the SO rules, terms of service, code of conduct, community practices, etc. — but even from the legal point of view. In democratic countries following the rule of law you cannot help others to commit crimes, period. It matters little how you 'help' them — that's for courts to decide — but the mere intention of helping others to commit crimes is not allowed.
My case is slightly different. By cleverly wording one's question, one is able to conceal that they have commited a tort (in this case, violating the copyright notice of a piece of software that the author licenses — and supports — for a fee), gaming the system by strictly following a literalistic interpretation of the rules, in order to get free technical support of illicitly acquired software.
What should one do in these cases?
There are some alternatives worth discussing:
- Completely ignore the issue, so far as the literalistic interpretation of the rules allow the question to be phrased the way it is. People will vote the question up, down, or vote to close — let the community decide.
- Answer the OP that, if they are legitimate owners of the software they have, they can ask the author for technical support — especially if such technical support is the whole reason for a software license to exist in the first place (this requires a bit of research, but that's part of the 'burden' of wishing to answer a question here!). Furthermore, prevent users from actually providing a fix (discussing the issue itself without providing a technical solution for the problem might be allowed or even encouraged, for educational purposes).
- Flag the question as illegitimate — explaining why — and close it to further answers. The purpose is avoiding volunteers to waste their time in answering questions to fix pirated software...
- Clarify the terms & conditions, code of conduct, or whatever applicable rules to include all kinds of questions designed specifically to 'game the system' as being inappropriate and flagged as such for moderator review. That way, anyone would be able to flag such a question as inappropriate — explaining why — and moderators would be allowed to close it.
- 'Suspend' the ability to answer such questions until a certain threshold of 'up' votes is reached. This could be accomplished in the following way: suppose that there is good reason to suspect that the question is inappropriate, but it is asked in a way that bypasses all literalistic interpretations of the rules. It gets flagged by someone to be 'suspended until there is a consensus on the appropriateness of the question'. SO users could still reply — their answers wouldn't be visible, however (except for their authors, with a notice that the question is 'suspended'). The question would bear a notice that it was temporarily suspended until a significant number of users considers it worthy of being answered because its acceptability is being questioned. If the question attracts a certain threshold of 'up' votes — say, 10, or 20 for first questions from a new user — all the answers collected so far would be visible again, and new answers would be accepted as usual (the whole question would naturally still be subject to the rules to vote to close, obviously).
The last two choices (there are probably more, worth discussing here) resemble a bit the way Wikipedia accepts certain 'polemic' issues to be addressed (which are often vandalised): they are 'frozen', or partially frozen, until there is a consensus on what to do with it. This is different from the vote to close: the information is visible — at least partially — but with notices saying that the page is under review in some form (Wikipedia has an unusually large set of circumstances that may apply to an article...).
However, I'm also aware that this might require not only some additional coding (even if it's implemented using a derivative of currently existing functionality), but also more work for moderators, who, in turn, must receive additional guidelines to deal with these cases.
The benefit, of course, is pushing out a clear message that SO does not allow free technical support to be given to pirated software. I think that's a very important message to pass.
Anyway, just my 2K (way more than two cents...)
Edit: (20210522)
First and foremost, thank you to all who have taken so much time to review my question (aka 'the wall of words'), correcting the many grammatical mistakes that Grammarly didn't catch, and offered suggestions to improve readability. Thanks! You guys truly rock and have infinite patience — there is a special place in Heaven for you!
I'm adding my own answer below as a way to summarise all that I've learned from you guys.