10

People do silly things. Developers as much as anybody, if not more. Sometimes they run into problems, and unwittingly reveal the silly things they do. Sometimes, they don't care much about the core silliness, and just want to get past the specific problem they're having. No problem - people on SO are pretty good about answering the problem being asked, and (gently or not) prodding the asker to fix the deeper problems.

Should we do anything different if the core silliness is actively harmful?

Case in point. This developer is trying to fix problems with his login code. The code could have been taken directly from a "don't do that" section of a web development book, with big tasty SQL injection and cleartext password storage vulnerabilities. This code should never be used anywhere, and should be dropped in the nearest star. I and others made that point in comments to the question and answer.

I don't like that this question exists. Someone will arrive from Google from a search triggered by that code, ignore the comments (as the OP seems to have), and copy-paste pieces of that code into their own application. That happens all the time, no big deal, except that here, it'll cause more news articles, and more problems with passwords shared between amateur sites and bank accounts. I want to do something to this question - either put a giant header on top ("NEVER EVER USE THIS!"), or delete it outright.

But, this question was asked in good faith. Truth is, lots of sites use code like this, much as we'd prefer that they wouldn't. It's a reasonable question with an answer, that'll get the OP past his problem. I can't really vote to close or delete it, or even downvote it.

We've discussed what to do if a question is asked in bad faith ("I want to hack this website. How to?"). What about questions asked in good faith, but with such problematic content that we want to prevent other newcomers from ever using it? Remember that warnings tend not to be read. Do we have a responsibility to protect the world from actively harmful content, or are we a common carrier that tries to answer everything answerable?

EDIT: The referenced question has another, more reasonable answer now, and on reflection, I think my issue was more with the first answer, which attempted to fix the immediate problem without addressing the core issue. Voting may work here, and may prod the answerer to fix up his answer.

Improve this question
1

4 Answers 4

Reset to default
10

Code in questions I think we should leave be, no matter how broken it is. Whoever is dumb enough to copy code from a question deserves whatever consequences it brings. (Exception: truly harmful rm -rf kind of stuff).

Code in answers is a different issue.

We have a user in a tag I frequent who has huge anger management issues, but makes a lot of good points. One of the things he does as a rule is downvote answers that contain code with vulnerabilities, even if it was copy+pasted from the original question, fixing or demonstrating something completely unrelated to the vulnerability.

This seems unfair at first glance, and people usually take offense ("I just showed the OP how to do xyz, why are you punishing me for his broken code?"). However, his reasoning is that people will blindly copy+paste stuff, so you shouldn't post anything that shouldn't be copy+pasted.

I tend to agree with that more and more. People will trust code posted by a SO user, especially a high-rep one. If you post code, make sure you can stand behind every aspect of it. If the code has issues other than what was asked about, make sure you fix them before you incorporate it into your answer.

Improve this answer
5
  • Yep, on reflection, I think that's a reasonable thing to do here.
    – Michael Petrotta
    May 1, 2011 at 18:51
  • I don't agree with "Whoever is dumb enough to copy code from a question deserves whatever consequeses it brings" Especially when the question describes something working to a degree.
    – Wes
    May 1, 2011 at 20:32
  • 4
    @Wes if we start censoring questions for the code they contain, we're lost. That simply won't work. At least 50% of the code posted contains some flaw or another. I can't see any way to fix that
    – Pekka
    May 1, 2011 at 20:36
  • 1
    I think a disclaimer is worth it. See below
    – Wes
    May 1, 2011 at 20:42
  • 1
    Bad code must be able to be posted here. How else can people learn to recognize it? How else should we point out its flaws?
    – Joachim Sauer
    May 2, 2011 at 9:11
7

In that case I would try to answer his question but as part of the answer I would in big letters put something to the effect

This code has multiple other problems I strongly suggest you get it peer reviewed for security purposes. You can post it at http://codereview.stackexchange.com to get such a service.

If you can't answer the question then I wouldn't put anything.

You can't in conscience delete a question that doesn't violate any rules. After a while you can edit the post to say "Also posted to code review for security problems". Assuming the author takes you up on your suggestion.

Improve this answer
5
  • 1
    With the caveat that such a warning may put people off reading it. Of course, anyone put off that way is probably the cut/paste coder we want to steer away.
    – Phil Lello
    May 1, 2011 at 20:31
  • 1
    I find the disclaimer an interesting suggestion. I don't agree with the second part though: the people over at code review are hardly going to like it if we start dumping terrible copy+pasted atrocities on their site. Because that's what most of the code that needs the warning is going to be.
    – Pekka
    May 1, 2011 at 20:45
  • @Pekka I think that's a service to the community at large. The origional poster and to the readers of the question. If its not reviewed then someone is going to see it and the responses and think its a correct way to go. at the moment CR could do with traffic though. If someone with experiance sees the origional question linked to the new question they can also participate in the new conversation. that way CR also gains.
    – Wes
    May 1, 2011 at 21:08
  • 2
    try being active in SO's PHP and HTML tags for two weeks and we'll talk again. :) The amounts of utter crap that comes in every day (most of it, as said, copy+pasted from some other atrocity) is plain unsalvageable. Code Review would become a trash within a week.
    – Pekka
    May 1, 2011 at 21:16
  • I'm not experienced enough generally, sorry. You can see my profile on SO its pretty much a vampire.
    – Wes
    May 1, 2011 at 21:45
6

This is the path I usually follow:

  • Add a comment in the question (you did)
  • Add a comment in the answer (you did)
  • downvote the answer (I presume you did, I did too)
  • post a better answer or upvote an alternative, existing one, perhaps adding also a comment "this is the right way to do it".

A couple more downvotes and nobody will trust that answer when reading it. It may also force the answerer to delete it or reformulate it.

Improve this answer
3
  • Succinctly stated, Aleadam. I was focusing too much on the question, when it was the first answer that triggered my ire.
    – Michael Petrotta
    May 2, 2011 at 0:56
  • @Michael well, voting did work: +3 on Cylon's answer vs -7 on Muhammad's... If somebody still uses that code, then, what can I say, that person deserves the SQL injection :/ . I'd say the job's done on this one. What I'm not really sure is whether this post in meta helped in gathering enough downvotes; I'm sure there are other answers as bad as this one still around just because they did not get enough attention.
    – Aleadam
    May 2, 2011 at 3:45
  • @Michael update: it's gone. Case closed. Now, about that anger management course... :P
    – Aleadam
    May 2, 2011 at 7:51
5
  • Answer specific question. If and only if you need code from the question as a context for your answer, then do not copy & paste parts of the code which you know are wrong. Correct the code and explain what and why you have changed.
  • Point out mistakes unrelated to question in a comment. If it's a valid point, your comment will be upvoted and will stay on top.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .