2

In a former question I got the advice to post deleted answers here if I don't understand why they were deleted. I'm not sure how this should work as only users with enough reputation can see deleted posts, but however, I'll try.

Here comes the link to the question: Avoiding apache to run as root

My answer was this: https://stackoverflow.com/a/17220070/171318

What is wrong with this answer?

Improve this question
5
  • 2
    3 users have decided to delete the answer. Why they decided? Don't know, but there were plenty of comments on it explaining the issues with it.
    – Oded
    Jun 21, 2013 at 11:36
  • 2
    @Oded does that warrant deletion however? Downvotes maybe...
    – Bart
    Jun 21, 2013 at 11:37
  • @Bart - I have not said the deletion was warranted. In this case, I don't have enough expert knowledge to tell one way or another. Deletion of answers tends to be reserved to spam/offensive and actively harmful (which may very well be what the opinion about the answer was).
    – Oded
    Jun 21, 2013 at 11:38
  • @Oded Ah true, didn't consider the "actively harmful"....
    – Bart
    Jun 21, 2013 at 11:39
  • 2
    @Bart - In this case, since this is a permissions issue involving root, I feel that may be the reason.
    – Oded
    Jun 21, 2013 at 11:40

1 Answer 1

Reset to default
6

In this specific case, I believe the users who cast the delete votes felt that the content might do more harm to other people who view the post in the future.

It might get the job done, but it would also add a huge vulnerability. I'm sure your heart was in the right place, you were trying to help the OP... no doubt about that.

Might be an extreme example, but what if someone posted an answer containing code that would perform some "malicious" things - in extreme cases, a downvote might not be enough. We'd want to remove it ASAP as to not let untrained users blindly execute some code they found on Stack Overflow.

Q: How can I ensure that port 21017 is open?

A: sudo service ufw stop ( completely disable the firewall )

It's an answer, it'll work... but it should never be done. period.

Improve this answer
7
  • Note that I didn't asked the question. I thought it was funny that the question itself didn't get any downvotes or delete votes. Only my answer which tells a lot about the security issues. Btw, just teoretical, how will you create a folder that is owned by root without using sudo? You might answer: This isn't necessary and can be / should be worked around in application design. Yes, I'm with you and I wrote this in my answer as well (in bold). But what if the question is just so simple: 'How to create a folder that will be owned by root using the web server?`
    – hek2mgl
    Jun 21, 2013 at 11:42
  • 1
    Well It all depends what you are trying to accomplish... you might not actually need the root account but rather a different user who happens to have the correct permissions.. suEXEC might work...
    – Lix
    Jun 21, 2013 at 11:48
  • 1
    The question could be so simple because the OP simply doesn't grasp the topic too well or understand the implications. IMO, the best answer in a situation like that is to explain the problem and possibly suggest an architectural change as opposed to just providing the OP with a "dangerous" method.
    – Lix
    Jun 21, 2013 at 11:51
  • However, as I've read the post again, I think the most problem might be that the OP - although one could understand this - didn't wanted that the folder should be owned by root. He just wanted to circumvent permission problems. Therefore root privileges are just not necessary in this case and this might harm others which don't understand my general answer. Sometimes others understand things in a different manner than the author (me). So your answer might be the explanation I've searched for.
    – hek2mgl
    Jun 21, 2013 at 11:53
  • I supposed architectural change, in bold. However I think the answer was just too much for his simple problem. He just searched for something like chown -R www-data /path/to/folder . But I didn't got that it is so simple when writing the answer. However I think the post was good anyway and therefore not deleted myself
    – hek2mgl
    Jun 21, 2013 at 11:55
  • Yep - sadly, some employers still demand quick and dirty fixes as opposed to "doing the right thing". There very well might be some other constraints that we are not aware of preventing him from any big changes.
    – Lix
    Jun 21, 2013 at 11:57
  • Yep - sadly, some employers still demand quick and dirty fixes as opposed to "doing the right thing". hehe, why I chuckle? :) ... yeah I know. But however it is not so important. Just wanted to have a little feeback on this. Thanks for your time! +1 Can I ask a last question?: Beside from any security and architectural considerations, how would you create a folder that should be owned by root using the webserver? I see only 2 options: Using sudo, or the suexec flag. But note that the second approach will not work for shell scripts. That's why I told sudo is the best solution..
    – hek2mgl
    Jun 21, 2013 at 12:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .