Implement the Hacker Badge

Question

When Jeff first explained the badge system, before Stack Overflow was even in beta, one of the badges he described was a "Hacker" badge.

_{from Stack Overflow Badge Feedback - Blog - Stack Overflow}

I’m specifically referring to the secret Stack Overflow hacker badge. It does exist, though it has yet to be awarded. (There might even be some other secret badges out there.. who knows?)

It’s just taking a while to get around to implementing it*, as it doesn’t behave like any other badge; it’s a manually maintained key-value pair of users who have “contributed to Stack Overflow in an unusual way.” Typically this means you’ve found a serious security exploit and sent it to us privately rather than making it public or exploiting it and harming the site. But that’s not the only way to earn it!

* more than our usual 6-8 weeks.

_{from No, We Have Not Forgotten About the Hacker Badge - Blog - Stack Oveflow}

It apparently even existed in the database at one point:

<Id>29</Id>
<Class>2</Class>
<Name>Hacker</Name>
<Description>Contributed to Stack Overflow in an unusual way</Description>
<Single>true</Single>
<Secret>true</Secret>

In the end the Hacker badge was developed into a joke instead of a feature, but it was a good idea. Particularly if a potential hacker is already a user, this may be all it would take to motivate them¹ to report bugs responsibly instead of having a laugh at the site's expense.

May I just add that the concept of the Hacker badge (if implemented as the anonymous emailer suggested) is one of the best security Hacks ever. Find something of little value you can give people to get them to attempt to hack your site and admit it.

_{from a comment by Bill K on I Just Logged in as You - Coding Horror}

Badges are supposed to encourage positive behaviour. This seems like a good fit. It should be implemented in some capacity.

_{¹ In order to continue to motivate users who have previously earned it, it should probably be awardable multiple times.}

Answer 1

I'm against any badge awarded manually as subjectiveness gets in the way.. I think awarding them automatically was a great idea and let's stick to that.

Answer 2

Any way to get people to spend more time looking for security vulnerabilities and disclosure them responsibly is an obvious win. Not just for the Stack Exchange network admins, but for everyone using the site.

Answer 3

This is not behavior we should be encouraging. The awesome software and network engineers at Stack Exchange are sufficient to the task, and we shouldn't encourage another thousand or million people to perform random attacks on the site in the hopes of exposing a weakness.

Further, who gets to wade through all the "lol, I used a userscript to change the logo, gimme the hacker badge" and "Hey, I found that if I send thousands of requests a second the server stops responding, gimme a hacker badge" messages?

Lastly, while being proactive about exploits is generally a good thing, it's possible that there are hundreds or thousands of tiny little things that could be better, and verifying a given problem, and fixing it takes resources that are better spent on features that will positively impact the site. Yes, we can fix that last 1%, but it's going to take months of man hours for work that ultimately isn't going to improve the site as much as putting that same effort to work on other features.