-25

We have beaten this horse too much; let’s put it out of its misery definitively, in a effective way. A way that protects everyone and the children from harm: non-meta edits and deletion.

This answer is the prime exhibit that whatever your go to solution for answers that expose users to self harming practices, is not enough. People manage to still do stuff that only expose themselves and their users/clients to harm.

If it's stupid, but it works, it's not stupid, except when it is

Answers that expose yourself to security vulnerabilities, but "solve" your issue, is just the regex joke all over again: solving an issue while creating other. Except that unlike regex, the harm is not only to yourself, but to others that depend on your service.

Stack Overflow is a learning resource, and it should teach well

The community already considers several books as stuff that you shouldn't read, and that's usually enough to dissuade since there's another step: buying the book itself. But if there's an easily copy-paste answer and is free, demonizing the content is not enough, especially when the user wants to solve the problem fast. Since we are considered a learning resource, we should hold ourself to the same standards. If readers will use us as a learning resource, it should be the best learning resource. A learning resource that could cause vulnerabilities is not a good resource.

Too many words

Basically, we should start removing, if there's a better answer, or editing, if preventing the issue is trivial, answers that cause security issues. Let’s set the example with this answer by removing it from the site, since it has gathered at least 200 upvotes since we tried anything with it.

35
  • 12
    "self harm" has other associations ("1. The deliberate non-suicidal injuring of one's own body".). Perhaps rephrase? Apr 8, 2022 at 17:53
  • 7
    I am really uncomfortable with just saying "this 506 upvote answer is bad, let's nuke it". Especially since this meta is not just about this answer, but vaguely "answers that cause security issues". Where to draw the line? Is there really not any value in having a prominent answer that clearly says "this is a bad idea because of <further reading>"? Apr 8, 2022 at 18:00
  • 4
    I must admit, the amount of upvotes the example answer has had since it was editted to state BEWARE is truly a terrifying example of people don't care about the security of their code (and therefore the security of their data, as well as others).
    – Thom A
    Apr 8, 2022 at 18:03
  • 8
    But "removing" Answers that "once" were "good Answers" is just like practising "Security by Obscurity"... The Answer should remain visible, and with the Warning/Explanation of course... , or "somebody" else will soon come up with the exact same "Answer", thinking they found a "New Answer"... + It helps Users scanning their Code to check if by any chance, they didn't use that Syntax "somewhere"...
    – chivracq
    Apr 8, 2022 at 18:29
  • 1
    I wouldn't called it bodily harm. At worst it's going to be financial (in terms of fines) and reputational harm to the person (fool) who copy pasta'd the code, and the exposure of their and many other people's data; which could also inflict financial harm of all those who had their data leaked.
    – Thom A
    Apr 8, 2022 at 18:30
  • 1
    It wouldn't be the first time, @chivracq .
    – Thom A
    Apr 8, 2022 at 18:31
  • 2
    @Sec, yep-yep, I only reacted to #OP's insisting on "removing"... When I looked at the Answer, it is already Locked (+ Warning), and I find that a "correct way" indeed...
    – chivracq
    Apr 8, 2022 at 18:39
  • 3
    Can, does not mean will, @Braiam . You are mistaking certainty with possibility.
    – Thom A
    Apr 8, 2022 at 18:47
  • 2
    And you can still get run down by a irresponsible driver @Braiam, so by your logic, crossing the road means you'll certainly going to get run down, as you can. Better stop crossing those roads.
    – Thom A
    Apr 8, 2022 at 18:52
  • 3
    Better to design a road that minimizes the possibility of people getting run down. Apr 8, 2022 at 18:56
  • 4
    The notice seems to be pretty educational. Why assume all those upvotes are from people who ignored the warning? Apr 8, 2022 at 19:14
  • 7
    There is no reason to remove that answer. The warning sign is so obvious that anyone not reading it really deserves what they get. Yes, I know we shouldn't teach people bad things, but this answer is a perfect teachable moment. It clearly shows bad practice, but if you don't know how bad code looks like, you cannot fix it in real life if you stumble upon it. Apr 8, 2022 at 20:10
  • 2
    The second highest scoring answer is pretty close to surpassing the accepted answer, knocking it from its post. If everyone reading this meta thread downvoted the accepted answer and/or upvoted the second answer (legitimately, not by mob-Meta-effect), it would surpass it in no time.
    – TylerH
    Apr 8, 2022 at 20:34
  • 2
    @Braiam Well it certainly won't with that attitude. Have you done your part in helping it along?
    – TylerH
    Apr 8, 2022 at 21:04
  • 7
    Or maybe, @user4581301, people still think the answer is useful, despite being flawed. We've had this discussion multiple times. Not every visitor to this site cares about doing things the correct way. Many of them just care about getting code that [appears to] work. Apr 8, 2022 at 21:43

3 Answers 3

20

My role is to put the sign up informing you that the bridge is out.

My role can't be:

  • to prevent you from getting in your vehicle
  • to prevent you from driving past the sign
  • to prevent you from going over the bridge

...because that would imply a degree of control I can exert over you as an individual.

Put in more proper terms - I do get where you're coming from, both as a professional developer and as someone who at least doesn't want to see someone become the next victim of SQL injection. But if the warnings in both the documentation and the place they happened to copy-paste it from aren't good enough, the only sane thing I can assume is that they're committed to write code regardless of the consequences. This is especially true of contractors, depending on the place they work and the contract they're assigned.

So deleting things? Not exactly a fan. Someone's going to find the same damn answer somewhere else on the Internet where people give at least two orders of magnitude less of a damn than you do.

Putting giant warnings? I'm OK with this. We've fulfilled our role.

7
  • The thing is that is not only them in the vehicle, is everyone. Is not only themselves their are putting in danger, is others too, in some cases, ourself.
    – Braiam
    Apr 8, 2022 at 19:55
  • 5
    @Braiam: I'm gonna expressly disagree here. You're trying to avoid a scenario where someone's crappy code makes its way into our healthcare systems or something more critical, and I'm here to remind you that this is already happening at some level for reasons beyond our understand and well outside our realm of control. Thankfully for most of the serious and important industries, there are at least audits that take place to prevent incredibly stupid stuff from happening. But someone's no-name app getting bit by an SQL injection bug isn't really something that impacts me directly.
    – Makoto
    Apr 8, 2022 at 20:26
  • 2
    This reminds me of the user on DIY.SE a while ago who railed against the topic of [electrical] being asked and answered on the site; they claimed SE was morally and legally imperiled by allowing people to give advice and that only licensed electricians could or should even answer such questions online, let alone perform the work itself. Because of some statistic (that they misinterpreted) about house fires being caused by electrical issues. In short, the takeaway is: just because it has happened, or could happen somewhere, doesn't mean we have to disallow talking about it on our site.
    – TylerH
    Apr 8, 2022 at 20:37
  • Oh wow @TylerH, that's interesting. Ironically I take a slightly less aggressive mindset when it comes to those things and I just know that doing anything that contains electricity carries a risk of severe injury or death - to the degree that I own two stud + AC detectors for drilling holes to secure my IKEA furniture to a wall in my apartment. But hey, that's just me having a head on my shoulders. If someone managed to actually sue some online forum for the advice they provided and it turned out to be wrong...to be honest I don't know if there's any precedent for that at all.
    – Makoto
    Apr 8, 2022 at 20:41
  • 3
    @Makoto Here's the link for further reading if you're interested, since there is a close parallel here - diy.meta.stackexchange.com/questions/1604
    – TylerH
    Apr 8, 2022 at 20:46
  • "and I'm here to remind you that this is already happening at some level" AND I'M TELLING YOU IT WAS UNACCEPTABLE THEN AND IT STILL UNACCEPTABLE NOW. Because hunger happens in the world, we should allow people that we can help to suffer hunger too. The same applies here. That bad code somehow managed to reach critical systems, doesn't mean that we should help it spread around.
    – Braiam
    Apr 8, 2022 at 20:52
  • 4
    @Braiam: By putting the sign up, I'm showing a commitment or determination to warn others of the consequences of using this code or practice. I am not and will not ever take responsibility for someone else using code that I put on this site for fitness for a purpose, simply because I cannot bear the financial or logistical burden of such an undertaking. What you're trying to do here is push that burden on me, which I must forcefully refuse.
    – Makoto
    Apr 8, 2022 at 20:55
13

Stack Overflow is a learning resource

This is a common misconception and a mistake I've made myself in the past. But Stack Overflow is a knowledge repository, not a teaching resource. Q&A is fantastic for learning but there are rules around asking and answering for a reason, it's not a free-for-all smorgasbord of questions and answers. In addition, extended discussion or moving the goalposts when asking is frowned upon, although many users (myself included) are happy to expound further in our answers if asked for clarification. Stack Overflow should be the final stop on the quest for your answer, not the first.

(That said, thinking of a Q&A hoagie is making me hungry now 😂)

Basically, we should start removing, if there's a better answer, or editing, if the preventing the issue is trivial, answers that cause security issues.

No, we need to comment, downvote, and potentially edit warnings into answers offering poor solutions if a solution is downright dangerous. If a rollback war ensues, mods are auto-flagged on these so downvote, comment, and let a mod handle it if it comes to that. People shouldn't be using Stack Overflow to have us be doing their work for them, they need to attempt to understand the content they are asking for and consuming. If something confuses you, comment and ask for clarification. Or do an internet search with some of the terms and topics from an answer you don't understand. There are many avenues to making sure you get what you need from an answer.

When it comes to bad ways to do something, there is still value in understanding why certain approaches are bad. It's also good to exemplify these cases so you can identify and fix them in your own code, not copy and paste them as your final solution.

If you implement a solution that you don't fully understand, the consequences are on you and you alone. This is one of the worst cardinal sins of programming and software engineering. Don't implement something you don't understand.

2
  • 3
    I suppose this is a bit of a semantic subtlety, but just because Stack Overflow isn't the only place a developer should go to learn something doesn't mean it's not a learning resource. I'd argue that a knowledge repository is a learning resource—just one which, as you note, has certain limitations. (Similarly, I'd say that flash cards are a learning resource—but they don't replace other learning resources such as books, in-person instruction, &c.). Apr 8, 2022 at 20:18
  • "This is a common misconception and a mistake I've made myself in the past" and yet, here we are.
    – Braiam
    Apr 8, 2022 at 20:47
3

I concur that Stack Overflow is a learning resource. But that's exactly why we shouldn't remove harmful answers. By removing them, we don't allow future readers to learn from the original author's mistake e.g., by reading highly upvoted comments warning of the risks (see @chivracq's comment).

I also concur that, too often, comments aren't a sufficient warning. It's easy for a developer in a rush to copy and paste the answer, confirm that it works, and never return to assess the nuance of the comments. And that's especially true since, in most cases, the warning only exists in the comments, and isn't edited into a locked post, as was done here. As such, I'd like to see a mechanism for elevating the visibility of these warnings.

Alternate Approach

I like the premise of this question, but instead of concluding that we delete these answers, I'd instead suggest expanding it into a feature request to formalize the process of flagging them to include a warning that's prepended to the post. E.g.,

Warning: This post contains potential security issues or harmful practices. Please review the comments for further details.

Ideally, this would have special formatting to really set it apart from typical posts, such as an orange border or background, so it’s more overt than the example you cited.

Potential Issues

Some issues that would need to be thought through:

  1. Is there a single stock warning that encourages readers to review the comments (as above)? A list of common issues (such as SQL injection)? And/or a custom option, similar to voting to close a question, which adds a comment and directs readers to it?
  2. How does a warning get flagged and validated? A queue might not be effective since such warnings likely necessitate subject matter expertise. Perhaps bronze+ badges in related tags can vote to prepend a warning?
  3. How does an inappropriate or outdated warning get removed once it's been established? A moderator flag again assumes subject matter expertise. Perhaps this could be maintained by an ongoing tally of bronze+ badge votes?

If there's interest by the community, I'd be happy to formalize this as a feature request—after, of course, confirming that it hasn't already been suggested (I haven't yet verified this).

5
  • You mention in bold that "comments aren't sufficient warning" but the post linked by the question has a notice in the post, not a comment, warning of the dangers of the answer.
    – TylerH
    Apr 8, 2022 at 20:41
  • @TylerH and none is enough.
    – Braiam
    Apr 8, 2022 at 20:46
  • @TylerH: For sure. My proposal here is to formalize that process a bit. But the current approach—of editing in a warning, and potentially having a moderator lock the post—may be sufficient for these cases. I think it depends on how frequently we expect this to happen, how long it takes for these warnings to be added, and how much of a burden it is for moderators to handle these requests. FWIW: I've seen a lot of warnings (especially regarding SQL injection) which aren't afforded this treatment, but remain critical warnings for future developers. Apr 8, 2022 at 20:46
  • @TylerH: FYI: I've edited my post to acknowledge the current approach, and to highlight that this is a proposal to formalize that process and e.g. add formatting to help highlight the concern. Apr 8, 2022 at 21:07
  • 1
    Yes, like the outdated answers feature. It is close to "now pose security risks or provide code that no longer works.". It is not far from "has always posed a security risk"... Apr 9, 2022 at 13:27

Not the answer you're looking for? Browse other questions tagged .