What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 133 Stack Exchange communities.

There's already a question on how to deal with questions/answers with a security vulnerability. But that's not really what I'm asking.

Here's the problem. There's a post in PHP that is highly upvoted with lots of references:

Best way to use PHP to encrypt and decrypt passwords. (>10k only after deletion)

Now, the top answer (and accepted one) has a score of 230. But it also has security issues (as the comments detail).

In fact, every single answer has a security issue in one form or another.

So, my question is how to deal with this?

The obvious answer of "just comment and post your own answer" isn't really effective in this case, because the current answer is so highly upvoted that it's very unlikely that any new answer is going to overtake it.

In this particular case, it just so happened that there was a duplicate one could close this against, which has more secure answers. But in general, that's not a good solution.

So, one proposal would be to add a warning message to each answer indicating that there are vulnerabilities present, and that you should exercise extreme caution. Something like this:

BEWARE! This answer contains various security issues. Do NOT use the code samples presented here.

This question/answer is only preserved to prevent breaking links and for reference value.

What do you think? Is there another better solution to it?

share|improve this question
2  
So what are we discussing here? This one unique example? Or the general case of significantly upvoted answers with security issues? –  Bart Dec 14 '12 at 21:24
    
@Bart: The general case, that could be applied to this issue. More of an overall question related to dealing with highly upvoted answers that contain incorrect information, but segmented to only talk about security issues... –  ircmaxell Dec 14 '12 at 21:26
5  
I guess point at on meta and watch it get nuked is an option. –  Some Helpful Commenter Dec 14 '12 at 21:29
    
Hmm, my question would be though, who gets to decide which post gets the proposed warning added to it? On what grounds? How is this vetted? Should SO act as a security police? Or should we expect common sense of users to not blindly copy code from the intarwebs? And if they still do, do we care? (I'm not doing too well in this discussion, am I ;) ) –  Bart Dec 14 '12 at 21:29
2  
"deleted by PeeHaa, Jack, bažmegakapa, AVD, minitech, Bo Persson, John Saunders, Madara Uchiha, Jeremy Banks, hakre 3 mins ago" -- problem solved! Well, this problem, but the general topic is totally worth figuring out. –  Charles Dec 14 '12 at 21:31
1  
@Bart: No, that's the exact problems that I have with my proposed solution. That's why I posted it here, so that we could have (at least some kind) of community consensus about it... So I think that's on the right track... –  ircmaxell Dec 14 '12 at 21:31
    
@Charles Oh boy, grab your popcorn, get yourself some beverages and sit back until the users come rolling in whose content has just disappeared.... –  Bart Dec 14 '12 at 21:33
4  
@Bart Do we care? I hope we care that over one hundred thousand visitors were given dangerous misinformation from massively-upvoted posts. We can do better than that. –  Jeremy Banks Dec 14 '12 at 21:37
1  
@JeremyBanks Well, not being a PHP developer I particularly don't care. But you know how it goes with content that is "popular" to some extent. That said, I am really not settled on how to deal with this issue. Here we are with our "the community gets to decide through votes", yet on the other hand we're suggesting something along the lines of "yeah, you can upvote all you want, but let us step in now because we know better than those 230 of you". And while that might be entirely justified, I'm stuck on finding a way to make that go over somewhat well and transparently for the general case. –  Bart Dec 14 '12 at 21:40
1  
And I thought deleting pony and unicorn programming threads would bring up heartache, that's like 20 billion in rep that just vanished. Oh the teeth gnashing this is going to bring! –  user7116 Dec 14 '12 at 22:00
    
@sixlettervariables Do they still lose the rep? Wasn't something like that changed recently? –  Bart Dec 14 '12 at 22:01
1  
@Bart: good catch, that answer is older than 60 days. They'll be Ok. I downvoted you to keep you on your toes (jk). –  user7116 Dec 14 '12 at 22:05
    
@sixlettervariables You had a change of heart as well apparently. ;) –  Bart Dec 14 '12 at 22:06

4 Answers 4

These warning signs make the answers probably even more interesting. I mean ideally all answers have this warning sign build in.

It would be better to downvote them probably. That will have a better effect on potential users.

For that particular question, I'd say it's better that wrong information is edited out, not just only commented (although comments are nice normally).

Edit: Now edited out.

enter image description here

share|improve this answer

The solution is to downvote the answer that contains an unnecessary and/or covert security risk and leave a comment explaining your concerns and asking the user to edit in a warning.

If there is no response, you can take the initiative and edit a warning into the answer yourself. You should also add an edit summary that explains why you edited the answer. This is especially important if you are subject to edit review.

Lastly, if your edits are rejected or rolled back, come to Meta. If your concerns are legitimate, many a downvote/delete vote shall be rained upon the post in question.

Important: I am assuming here that you and the OP don't dispute the fact that a security risk exists. If there is an argument about whether a risk exists or not, it is not appropriate to edit the answer. You'll just have to post your own answer and draw attention to it (join a chatroom or something).

share|improve this answer
6  
Yes, but we're talking an answer that has +230. A downvote would do practically nothing. As far as editing the warning into the answer itself, that's what this question is asking about doing... –  ircmaxell Dec 14 '12 at 21:22
    
@ircmaxell Right, so the former doesn't work in this specific case but you can still use the edit. It isn't like all answers with security risks on the website have a +230 score and are immune to downvotes. –  Asad Dec 14 '12 at 21:24
1  
true, but the other question I put at the top of this one addresses that concern. This question is specifically targeting highly voted answers... –  ircmaxell Dec 14 '12 at 21:30
    
@ircmaxell Then you should have tagged your question specific-answer. Additionally, I still don't see why you can't just edit. –  Asad Dec 14 '12 at 21:32
2  
it's not targeted at a specific answer. It's targeted at a specific class of answer (highly upvoted, while having security issues). As to why not editing: because the problem I am talking about isn't related to just one specific answer, but a problem set... –  ircmaxell Dec 14 '12 at 21:36
    
@ircmaxell It isn't just you who has to go around SO editing answers. If anyone sees an answer like this they should downvote and leave a comment asking the user to put in a warning. If the user deliberately doesn't address the issue, edit it in yourself. The third tier is coming to Meta about it, which is the general approach for whenever you see crap content you can't do anything about. –  Asad Dec 14 '12 at 21:40
    
@Asad Random users editing in such warnings into content they deem dangerous, even if entirely justified, is not going to go over all that well in a lot of cases. I'm not sure that is the correct approach to take on this. –  Bart Dec 14 '12 at 21:46
    
@Bart That is why that isn't the first step. Editing the answer is entirely justified if 1) You've already explained to the user why the answer is flawed 2) The user has declined to address the issues you raised or even acknowledge the flaws in their answer. –  Asad Dec 14 '12 at 21:49
    
Even with those precautions, I think it's the wrong approach. For example, I have explained to you that I think this is not the correct solution to this issue. You did not change your post to indicate that. How about I go edit in a warning along the lines of "This is not recommended practice. Please don't do as this post suggests"? I don't think this should be acted out on an individual user level. –  Bart Dec 14 '12 at 21:53
    
@Bart That is a subjective disagreement. The problem here is an objective security risk inherent to the answer which is deliberately being concealed. The answer is not wrong, it carries limitations hat should be stated up front. tl;dr the answerer is not revealing the caveats of their answer. –  Asad Dec 14 '12 at 21:57
1  
@Bart Objective as determined by evidence (documentation, articles etc). My answer here is assuming the OP and the user don't disagree about the fact that a security risk exists but about whether it should be mentioned in the question. If the OP responds with an argument stating why they think there is no security risk, that is a completely different ball game altogether. In that case it is best to post your own "correct answer" and try to draw attention to it (possibly by bringing it up on Meta) –  Asad Dec 14 '12 at 22:05
2  
I think that ultimately won't work. And I don't want tons of Meta discussions on individual questions where one user edited in a warning and another edited it out again. If you implement something like this, it should be a systems thing, triggered by some form of voting. Not individual users going in and editing posts. How that should be detailed I'm not entirely sure, but I don't think it should be an action linked to a single user. –  Bart Dec 14 '12 at 22:10
2  
I agree with Bart here, It isn't at all uncommon for a person to believe something to be "objectively wrong" in error. –  Sam I am Dec 14 '12 at 22:16
3  
@Asad: Again, that's the reason for this post. The "downvote, comment, post your own answer" doesn't work in the real world with answers of this nature (highly voted). I'd even argue that answers with votes higher than 10 are likely to be immune to that style of feedback. The reason is that people see a high voted answer, and stop reading. That's why we're discussing another alternative, since the "downvote, comment, answer" loop isn't scalable for popular quesitons/answers... –  ircmaxell Dec 14 '12 at 22:26
4  
@Asad The highly upvoted accepted answer, and every answer under it are technically bad. Even if he down votes or edits the accepted answer, he's got 9 or 10 more answers to fix. It's rare, but it does happen. All answers to a perfectly good question can and sometimes do become obsolete, if not dangerous over time. He's just asking how we're supposed to deal with that as curators of the content. –  Tim Post Dec 15 '12 at 1:51

One alternative way of handling this would be to add a "Security" flag. It could be part of the normal flag system, or another tab (flag security issues with this post). If there were enough flags of that type, then a warning would be put into the post.

This, of course, is based on the relative value assumption that security of an answer doesn't always play hand in hand with the value of the answer.

For example, there are several posts that I've seen where the answer gives genuinely good advice to the poster along the lines of the question being asked. But that advice has security issues (usually SQL Injection or XSS). When commented on, the person who answered typically says something along the lines of "I know, but the question wasn't about that, so I wanted to be clear about answering the question".

Therefore, this security flag wouldn't be equivalent to downvoting (which indicates the answer is bad), just that "Don't copy-paste, there are security issues with using this code directly".

Now, perhaps there would also need to be a method in the flag of detailing the exact nature of the issue(s) (so people would know what to look for)...

share|improve this answer
    
Should we also then introduce a "maintainability" flag for code that is very likely to be hard to maintain? What about a "compatibility" flag or a "deprecated" flag? –  Asad Dec 14 '12 at 22:42
1  
Kinds of reminds me of the wikipedia flag" the neutrality of this article is disputed –  Sam I am Dec 14 '12 at 22:43
3  
@Asad: No. Because if you use code that's unmaintainable, that has no impact on me. But if you use code that's insecure, I can be affected because of a breach. Maintainability of code is a developer's digression. The security of it is everyone's problem. Then again, maybe I'm just fed up with all the breaches that happen because people who should know better don't. And this style problem contributes to them not knowing better (it panders to the copy-paste crowd who doesn't want to know better)... –  ircmaxell Dec 14 '12 at 22:45
    
@JeremyBanks Non forward compatible code is just as likely, if not more likely to break your software than security is. Every field has its inexcusable poor practices, I assume it is security weaknesses in yours. –  Asad Dec 14 '12 at 22:47

I've been thinking about this for a while, and also doing a bit of digging to see if I could find other examples of this happening. Historically, new features are not added unless they add some kind of immediate value to the site, or solve a wide spread immediate problem.

The problem does not seem to be wide spread, in fact this is the only serious example that I could find. Yet, my domain knowledge is limited in scope and I can't document a negative. In other words, I'm fairly certain that other examples can be found. I'm just at a bit of a loss on how to find them other than purely opportunistically.

Some answers that were once considered good will inevitably fall out of usefulness over time. Things change, yesterday's best can quickly become today's worst. The implications of consuming stale information aren't just specific to security, bad information is bad information.

What I'd suggest is doing the following:

  1. Provide a correct, up to date answer - That goes without saying. We can't just mark a bunch of answers as 'potentially bad' without stating what's good.

  2. Leave a notice stating something like the following at the bottom of each questionable answer, not the question itself:

This answer was at one time considered to describe best practices, however its relevance and accuracy have diminished. Applying this answer today might result in sub-optimal or even dangerous results. If you can improve this answer, please use the edit link below.

Putting the plural version of the above text in the question really doesn't say which answers are questionable, and I don't think we'll find many cases where all of them are. That's why I'd rather address the answers individually.

If this problem continues to surface, we could consider adding that message, or a different one to the same effect to the post notices that moderators can apply. We could also consider letting trusted users cast delete votes on answers that have been wearing that notice for a period of time. While incorrect answers can be extremely helpful, they're typically clearly presented as incorrect by their score.

Still, until more than a few of these actually surface, I don't think we're going to see anything codified. Note also, I'm not saying go do this right now, this is merely my suggestion, among others as to what can be done about the problem.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .