What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

from Stack Overflow Badge Feedback - Blog - Stack Overflow

I’m specifically referring to the secret Stack Overflow hacker badge. It does exist, though it has yet to be awarded. (There might even be some other secret badges out there.. who knows?)

It’s just taking a while to get around to implementing it*, as it doesn’t behave like any other badge; it’s a manually maintained key-value pair of users who have “contributed to Stack Overflow in an unusual way.” Typically this means you’ve found a serious security exploit and sent it to us privately rather than making it public or exploiting it and harming the site. But that’s not the only way to earn it!

* more than our usual 6-8 weeks.

from No, We Have Not Forgotten About the Hacker Badge - Blog - Stack Oveflow

This was developed into a joke instead of a feature, but it was a good idea. Particularly if a potential hacker is already a user, this may be all it would take to motivate them1 to report bugs responsibly instead of having a laugh at the site's expense.

May I just add that the concept of the Hacker badge (if implemented as the anonymous emailer suggested) is one of the best security Hacks ever. Find something of little value you can give people to get them to attempt to hack your site and admit it.

from a comment by Bill K on I Just Logged in as You - Coding Horror

Badges are supposed to encourage positive behaviour. This seems like a good fit. It should be implemented in some capacity.

1 In order to continue to motivate users who have previously earned it, it should probably be awardable multiple times.


Related: a "Hall of Fame" of people who have reported serious security vulnerabilities has been added on StackExchange.com. The page does not include all reports from before the Hall of Fame was added.

share|improve this question
10  
Public knowledge of this kind of badge would get people like me more interested in diving into page sources and looking for vulnerabilities in my spare time. I think it's a great way to leverage the resources (userbase) SO has available to it. –  darvids0n Feb 17 '12 at 4:41
10  
I realize it is necessary for the context of your feature request, but please don't confuse cracker with hacker. Real hackers don't like that :) –  Tim Post Feb 17 '12 at 13:14

3 Answers 3

I'm against any badge awarded manually as subjectiveness gets in the way.. I think awarding them automatically was a great idea and let's stick to that.

share|improve this answer
6  
A security vulnerability is a security vulnerability. No subjectiveness there. –  Mathias Bynens Feb 21 at 8:00

This is not behavior we should be encouraging. The awesome software and network engineers at Stack Exchange are sufficient to the task, and we shouldn't encourage another thousand or million people to perform random attacks on the site in the hopes of exposing a weakness.

Further, who gets to wade through all the "lol, I used a userscript to change the logo, gimme the hacker badge" and "Hey, I found that if I send thousands of requests a second the server stops responding, gimme a hacker badge" messages?

Lastly, while being proactive about exploits is generally a good thing, it's possible that there are hundreds or thousands of tiny little things that could be better, and verifying a given problem, and fixing it takes resources that are better spent on features that will positively impact the site. Yes, we can fix that last 1%, but it's going to take months of man hours for work that ultimately isn't going to improve the site as much as putting that same effort to work on other features.

share|improve this answer
10  
lol, I used a userscript to change the logo, gimme the hacker badge -- HA –  Adam Rackis Feb 17 '12 at 18:19
2  
“The awesome software and network engineers at Stack Exchange are sufficient to the task” Nobody’s perfect. Google, Microsoft, Facebook, GitHub etc. employ some very smart people too, yet still it’s beneficial for them to run a bug bounty program. –  Mathias Bynens Feb 21 at 8:03
2  
“while being proactive about exploits is generally a good thing […] fixing it takes resources that are better spent on features that will positively impact the site” — you don’t think making the Stack Exchange network more secure has a positive impact? –  Mathias Bynens Feb 21 at 8:05
    
There has to be a balance between security and ongoing development. If the site were in poor hands, I would worry about security more. Given that the developers are aware of security risks and develop in a way to reduce exploit possibilities, though, then there is little reason to encourage hundreds of people to actively attack the site in an effort to obtain a badge. As far as security, the site contains little valuable information that it doesn't already give out. It's not a high value target. It doesn't need the same security one might use for credit card processing. –  Adam Davis Feb 21 at 17:44
2  
Ooh! Look at me! Winterbash is over, but I still have a hat on! Give me the hacker badge! –  neminem Feb 25 at 17:24
    
@AdamDavis Stack Overflow Careers is at least a bit more sensitive: it knows users' addresses, phone numbers, and real names. It's also used to manage paid ad campaigns. –  Jeremy Banks Feb 26 at 6:37
1  
@neminem If you found a way to keep a real Winterbash hat after the event, you'd deserve the badge. –  Jeremy Banks Feb 26 at 6:38
    
@JeremyBanks It's totally a real Winterbash hat. I mean, look at it, doesn't that look just like a Winterbash hat? :p (Spoiler: it's not actually a real Winterbash hat.) –  neminem Feb 26 at 14:22

Any way to get people to spend more time looking for security vulnerabilities and disclosure them responsibly is an obvious win. Not just for the Stack Exchange network admins, but for everyone using the site.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .