What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 122 Stack Exchange communities.

This question on SO (how to hash a password?) begs the question; How do I answer a question when doing so might facilitate a train wreck?

Eric Lippert's non-answer "Getting password security correct is about a heck of a lot more than getting SHA512 implemented correctly." is more pertinent to the original poster than the actual answer.

Should anyone answering the question have included additional caveats?

share|improve this question
2  
Related: Is don't do it a valid answer? –  ire_and_curses May 11 '10 at 23:10
    
@ire: yeah, pretty related. But I think just enough of a difference - this question really looks at some liability for code examples provided, IMO anyway... –  IAbstract May 11 '10 at 23:17
add comment

4 Answers

up vote 6 down vote accepted

If you want to include additional caveats, sure, go ahead; but I wouldn't feel personally responsible if those using my answers do something Really Stupid™. (I would feel responsible for giving bad advice, so don't do that.)

As far as covering your own legal bases, the license currently used for SO (and linked at the bottom of every page) says:

5. Representations, Warranties and Disclaimer

UNLESS OTHERWISE AGREED TO BY THE PARTIES IN WRITING, LICENSOR OFFERS THE WORK AS-IS AND MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND CONCERNING THE MATERIALS, EXPRESS, IMPLIED, STATUTORY OR OTHERWISE, INCLUDING, WITHOUT LIMITATION, WARRANTIES OF TITLE, MERCHANTIBILITY, FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, OR THE ABSENCE OF LATENT OR OTHER DEFECTS, ACCURACY, OR THE PRESENCE OF ABSENCE OF ERRORS, WHETHER OR NOT DISCOVERABLE. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO SUCH EXCLUSION MAY NOT APPLY TO YOU.

share|improve this answer
add comment

That's always a tough call, and it's hard to give good guidelines on how to handle it. In similar situations, I typically try to answer the immediate question and also point out that the approach to the larger problem may not be correct. Kind of like, "Well, okay, you point the gun at your foot and pull the trigger. However, you might consider whether or not you really want to shoot yourself in the foot."

share|improve this answer
    
+1 for the analogy –  David Z May 12 '10 at 4:25
add comment

I hover around the Security tag quite a lot, and I see a lot of awkward questions.

Quite often its obvious the questioner doesnt really know where to begin, other then they have a vague notion that something should be 'encrypted' (by which they frequently mean hashed). In those cases its hard to give a good answer, because the truthful answer would be 'go away, research what you really need, then come back and ask a better question'. Trying to answer otherwise can often lead to a stream of 'comment questions' such as 'what block size should I use', 'how do I generate a salt/IV' etc etc and you get sucked into a trap of editing your question and tring to write a comprehensive guide to cryptography for newbies.

I do however disagree with the larger point that the answer should be 'get an expert in'. Really strong crypto is hard, but most people dont need government strength encryption. I have a lock on my front door. It will stop 90% of people walking through, but I'm well aware that anyone with a slight amount of determination will be able to get through it. That doesnt make my lock useless. I would consider upgrading it to a steel door with iris recognition slightly overkill.

The danger with crypto is that people see their data being converted to gobbledegook and assume that its safe, without really being sure how safe it is. Thats fairly true of all walks of life though. In cases where we feel there is a risk we ask experts for advice. Stack Overflow is a great place to ask for expert advice. Its just unfortunate that quite often the advice given is bad, or lacking in detail. And that could lead me off onto a rant... lets just say its not ideal (especially around specialist knowledge areas) that all upvotes are equal.

share|improve this answer
    
But there's no way to work out that one person is an expert in a field; tags might help, but they can be wildly out and a person's expertise may not be reflected accurately in what their answers are tagged with. Guess it's just tricky. (The easiest solution is to just let Jon Skeet answer it.) –  Donal Fellows May 12 '10 at 12:40
add comment

To an extent I would agree - yes, some sort of caveat might be necessary where actual code snippets exist. Those answers where only links are included, probably not necessary. However, no matter how cheap the solution, it should not be entirely free - especially when it comes to security (if it's worth securing, it's worth spending some money on).

Now...that said, if I had a manager that made the decision to use code snippets off of any website without some serious consultation (either from a shrink or security expert), I would hire that shrink to have his head examined.

Now, to answer your question - if you supplied any code, I would put a disclaimer just to CYA. Is this overkill? Maybe. But did you hear about the man who decided to use his lawn mower as a hedge trimmer; cut his fingers off; sued the lawn mower manufacturer...and won? Obviously, no matter how ludicrous most of us think an idea is, someone out there is willing to try it.

EDIT: All that said, @The Cat points out that SOFU has a disclaimer. Never hurts to add your own when something is as important as security is concerned.

share|improve this answer
    
It does hurt to add your own. Don't write your own crypto. Don't write your own licenses. Something as important as either should be done by experts. –  Gnome May 11 '10 at 23:22
    
I don't completely agree. Do I need to provide a caveat that explains my answer is not provided by a licensed attorney? –  IAbstract May 11 '10 at 23:34
    
You said disclaimer, perhaps I took that too literally, as in disclaiming liability. –  Gnome May 11 '10 at 23:47
3  
So you're saying I should go buy a lawnmower and a hedge. Interesting... –  Jon Seigel May 11 '10 at 23:57
    
Take my advice at face value :D –  IAbstract May 12 '10 at 0:29
    
+1 @Jon: taking unicorns and waffles out of context is just as humorous. –  IAbstract May 12 '10 at 2:13
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .