-1

RE: Is moving wp-config outside the web root really beneficial?

This question, and its accepted answer, lead readers to the dangerous conclusion that a common security practice – moving sensitive configuration files outside the web root – is dangerous, rather than beneficial.

  • The question incorrectly states that the practice is a security risk itself – and despite the asker acknowledging in a later comment that this is incorrect, the question has not been updated or redacted, nor the answers reconsidered.

  • The asker appears to be seeking agreement with his implied conclusion, not answers to his question. And the accepted answer reinforces the asker's conclusion by including a number of questionable security notions – it's no big deal if somebody gets their hands on your configuration files, it's no big deal if somebody gets into your database, and so on.

  • There are other answers, with more votes than the accepted answer, that disagree with the accepted answer; the question's asker has responded to them with incorrect information.

I've posted what I think is a very thorough answer that debunks the many myths throughout the question and its accepted answer; it immediately received a downvote, presumably from the asker, with no further comment.

Question:

Is it acceptable for a question and its accepted answer to specifically promote poor security practices? Where is the line drawn?

Obviously a question and answer designed to encourage an unknowing user to sudo rm -rf / would be deleted (right?).

In this case, it's possible (though unlikely) that the authors of the question and accepted answer, and the accepted answer's upvoters, are using StackExchange to encourage poor security practices, in order to increase the ease with which WordPress installations can be exploited.

In the general case, it seems irresponsible to allow a question and its accepted answer to promote poor security practices.

6
  • 5
    If you feel that the answer promoted poor practice, vote it down. If you feel you can contribute a better/correct alternative, do so. You seem to have done the latter. I don't think we need anything beyond that.
    – Bart
    Dec 4, 2012 at 21:21
  • 3
    "Obviously a question and answer designed to encourage an unknowing user to sudo rm -rf / would be deleted (right?)." no.
    – Servy
    Dec 4, 2012 at 21:23
  • 1
    I would agree with @Servy there indeed. Let the community downvote it into oblivion. But if it's an answer (albeit a poor one) deletion is not necessarily warranted.
    – Bart
    Dec 4, 2012 at 21:25
  • This is dupeish meta.stackexchange.com/questions/119822/…, though about a different topic Dec 4, 2012 at 21:40
  • @Ben I did read that one. I just didn't think it was quite applicable. Dec 4, 2012 at 21:44
  • That's why I've only linked it and not voted to close :-). Dec 4, 2012 at 22:12

1 Answer 1

7

Is it acceptable for a question and its accepted answer to specifically promote poor security practices? Where is the line drawn?

Absolutely. Go right ahead and post your answer promoting poor security practices. But if you do so, be prepared for the community to downvote you. That's what the whole voting system is for. You think the answer promotes poor practice? Vote it down. Add a comment if you must. Or an alternative "proper practice" answer.

Obviously a question and answer designed to encourage an unknowing user to sudo rm -rf / would be deleted (right?).

Nope. Once again, vote it down. Vote it into oblivion as a community if you must. But if it's an answer (even if it's a very poor one with practice no sane person would recommend) deletion is not necessarily warranted.

Heavily downvoted dangerous answers (if not ultimately deleted by the author) have a function as well. It's a pretty good "don't do that" signal.

In this case, it's possible (though unlikely) that the authors of the question and accepted answer, and the accepted answer's upvoters, are using StackExchange to encourage poor security practices, in order to increase the ease with which WordPress installations can be exploited.

Mwah, that's a whole lot of assumptions right there. Ignoring for a moment that I have no clue what they speak about in that question (not my topic) stupidity is a possibility as well. (Assuming you're right here).

In the general case, it seems irresponsible to allow a question and its accepted answer to promote poor security practices.

And we have the community to prevent that. And you as an expert to contribute your expert knowledge, clearly stating where the problems lie. This is not something that needs to be moderated. And an accepted answer only reflects helpfulness to the OP. Not necessarily correctness. I can see how this is somewhat at odds with the initial perception of outsiders, but I don't feel the need for strong intervention beyond the community voting already in place.

7
  • Excellent answer. One question, though, specifically on voting: this mechanism works well on Stack Overflow, but in a comparably small community, isn't it possible for the voting to be gamed relatively easily? I realize it requires reputation to upvote, but it seems it would really only take a malicious user a few hours' work to generate a Stack Exchange page with a question, write a malicious answer, accept it, upvote it several times, and essentially take advantage of the community's excellent PageRank to spread an exploit. Dec 4, 2012 at 21:43
  • the example answer would probably get deleted reasonably fast, its an actively harmful answer. There is a difference between answers advocating not installing a lock on the front door and answers saying you should burn the hose down.
    – Ryathal
    Dec 4, 2012 at 21:43
  • @AaronAdams I am not a moderator, so am unaware of the moderation tools and filters in place, but from what I know there are quite some tools in place to detect the inappropriate behaviour you mention.
    – Bart
    Dec 4, 2012 at 21:44
  • @Ryathal Yeah, and that particular example is extreme and comes close to a "troll answer" which might indeed be deleted at some point. I give you that. Though in the general case "this is dangerous" is not necessarily enough for deletion, assuming the answers are made in good faith.
    – Bart
    Dec 4, 2012 at 21:46
  • @Bart Great, I figured as much. And in the case of this specific question, I do believe these posters are acting in good faith. They just don't quite understand everything they're talking about. Dec 4, 2012 at 21:47
  • @AaronAdams Such cases can be a source of frustration, but just do the best you can. If a downvote is warranted, go ahead. And provide your insights in any which way possible. It might be an uphill battle, but at least you've done what you could.
    – Bart
    Dec 4, 2012 at 21:50
  • @AaronAdams When things like that happen (not usually maliciously, usually just a lack of downvotes because the question is old or the tag not very active) usually someone will come across it and "spread the word". Someone will start posting links to the question in chat, start a meta post discussing it, posting it on external social media sites, etc. all to bring in people who know that the accepted answer is a terrible idea and to either vote it down and/or upvote the proper answer.
    – Servy
    Dec 4, 2012 at 22:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .