2

I found this answer, and it bothers me because it's not just a typical bad answer, but an answer that suggests configuring a database in a way that is clearly insecure. The solution may or may not work, but if it does, it unnecessarily lowers the security of the software's SQL database management system for anyone who uses it.

I made sure to add what I just said as a comment below the answer; however, I feel like a comment is not near enough action, and that something bad is being promoted. I enjoy being part of the Stack Overflow community, and I try to practice excellence, and do whatever I can to make sure the Stack Overflow collective is as good as it can possibly be, so I would like to know what exactly is my role in this, what is it that I should do in this situation? Is it advised that I flag an answer like this, and write what the problem is for the moderator? Should I attempt to edit that answer, and include in it, that this is an insecure solution? Or is a comment the furthest extent to which I should go in an attempt to inform the community about the risk of using this solution?

17
  • 3
    I mean, it's in the name. it's not our place to protect devs from themselves.
    – Kevin B
    Aug 20, 2021 at 17:48
  • 7
    Simply downvote the answers and questions, if they are insecure
    – nbk
    Aug 20, 2021 at 17:49
  • 3
    isn't it better to have it with a warning in a comment than not have it at all? At least then it's obvious, whereas it may not be if the Answer is missing.
    – Scratte
    Aug 20, 2021 at 18:36
  • @Scratte agreed - as with information security, the more openness the better. We just have to make the notice as prominent as possible. For now it is votes and comments, but I guess after the "outdated answers" project we need a "dangerous answer" project Aug 20, 2021 at 18:45
  • 1
    @OlegValter Who defines what is a dangerous answer though? Sure, there are some scenarios where the answer is clearly insecure but what exactly constitutes "dangerous" and how do we define "dangerous answers" as it applies to every scenario? I think commenting is the best path, a fresh answer may be appropriate too in certain scenarios. But there is some onus on the user to have common sense, too. We show them how to shoot the gun, but it's up to them to know not to point it at their foot.
    – codewario
    Aug 20, 2021 at 19:29
  • 2
    I also disagree that the content should be edited by anyone but the content author for such an edit, as it changes the intent of the post. Simply downvote, leave a comment and/or upvote any other relevant comments mentioning the same, and move on.
    – codewario
    Aug 20, 2021 at 19:30
  • 2
    @BendertheGreatest oh, that's a bit too early to discuss details of that :) Let's wait 6 to 8 weeks for SE to note this as a problem. But if we are discussing this, some type of flag, I suppose, that would have to be verified by other users, probably restricted to badge holders in a given tag. Upon reaching a threshold of flags (let's say, 3), the notice appears. May also take post score into account. Aug 20, 2021 at 19:32
  • 1
    Actually, you kind of flipped my position. I would be comfortable with gold tag badge holders vetting posts flagged as potentially dangerous, or a concensus between lesser tag badge holders (similar to how question closure is unilateral for a gold tag badge, but must reach a quorum otherwise). I was more thinking though that these would land in a standard review queue barred by reputation alone.
    – codewario
    Aug 20, 2021 at 19:40
  • 1
    @BendertheGreatest yeah, it would be nice to have some peer-reviewed system like that for dangerous answers - it could fit quite nicely in tags like SQL, methinks. The idea is quite similar to what SE is going to do with "outdated" answers, so let's see how the project goes - if it succeeds, it will likely make sense to start requesting the same for (potentially) dangerous answers - we might only have to wait about 10 years after that, and voila. Aug 20, 2021 at 19:44
  • 1
    I think we can all agree the answer is insecure, it's labeled as such by the package, but it being insecure doesn't mean there aren't scenarios (whether poorly conceived or otherwise) where a dev may want the insecure option. A label is probably fine, or a comment, but removal would be a step too far
    – Kevin B
    Aug 20, 2021 at 20:15
  • I wouldn't mind a dollar for every SO answer with code that contains a SQL vulnerability. A typical case is when the OP asks for help with some code that happens to contain a SQL injection vulnerability. The answer contains a modified version of the OP's code, fixing the stated problem, but without fixing the injection vulnerability, and without even mentioning that the code is vulnerable.
    – PM 2Ring
    Aug 21, 2021 at 6:08
  • @KevinB That is a great observation, as well as a really good point.
    – JΛYDΞV
    Aug 21, 2021 at 9:02
  • @BendertheGreatest I agree, it can be a very opinionated subject, however, in this case, it is "official Oracle copyright protected documentation that not only depreciates the use of this configuration, but also states that using such an option should be avoided, and databases should be upgraded if your db will not work without the option. dev.mysql.com/doc/refman/5.7/en/… This opt implements an auth method that has previously been taken advantage of in DB attacks
    – JΛYDΞV
    Aug 21, 2021 at 9:33
  • @BendertheGreatest Though, this example, is IMO, a clear-cut example of an offered solution that punches a hole in DB security, the line separating opinion from fact is debatable, to say the least, and therefore; I feel that the point you make is extremely valid. As always, there is a flip-side: Is it not the duty of, not just the S.O. community, but the entire WebDev community, to ensure that all documentation, data, and software/apps that create & store, are secured to the best of our abilities?
    – JΛYDΞV
    Aug 21, 2021 at 9:34
  • @KevinB In this case, it is a matter of maintaining compatibility with pre 4.1 versions, but the way the author of the answer, and I am guessing the author of the question since he selected it as the correct answer, is a way to get around authenticating the secure way, so that there code just works.
    – JΛYDΞV
    Aug 21, 2021 at 9:41

0

Browse other questions tagged .