It might be very useful to give users the possibility to mark/tag/signalize answers (and questions?) as "insecure", eventually even with a short notice why (SQL injection, outdated code that might create security risks, etc.). I think SO has a natural responsibility NOT to promote insecure code.

Especially highly upvoted php/mysql-questions/answers, some of them even wikis, are using critical/insecure/outdated code/tutorial links.

Note: This is not about outdated code, it's more about potential security risks.

  • 4
    You could always leave a comment on the question/answer warning that it is insecure – StephenTG Aug 6 '13 at 11:54
  • @StephenTG But in reality this is not happening! Just have a look. – Sliq Aug 6 '13 at 11:55
  • 3
    If you see a question or answer that's insecure, and no-one's commented to say so, YOU could comment – StephenTG Aug 6 '13 at 11:57
  • @StephenTG I'm doing this, permanently. But as I said, SO promotes a lot of insecure code, simply because people don't know. It's inresponsible to leave stuff like that unmarked. – Sliq Aug 6 '13 at 11:58
  • 6
    If no-one else is commenting to mention that the post promotes insecure behaviour, no-one else is going to use the "insecure" flag/marker – StephenTG Aug 6 '13 at 11:59
  • I'm really shocked by the intolerance on META about making things better. SO is probably the #1 "source" for insecure code, and a lot of applications on the web are bad because SO wrongly (!) promotes this code. We all know that most of the php/mysql wiki answers are extremely outdated, bad and insecure. It's not right to leave this untouched. Sometimes hundreds of thousands have seen those answers. Yeah, you have comments, but the answers are still online, still upvoted, still being used by a lot of newbies. If people would notice the comments, then the answers would not be so upvoted. – Sliq Aug 6 '13 at 12:05
  • 5
    Stack Overflow does not promote any code. This is not the job of the site. Use the downvote arrow to share your opinion on the quality of the answer. – Cody Gray Aug 6 '13 at 12:08
  • @CodyGray Sorry, but this is the totally wrong approach! As i said before, totally wrong answers are highly upvoted sometime, simply because most people are not security experts (me neither btw). Democracy is wrong when it comes to special knowledge. – Sliq Aug 6 '13 at 12:10
  • 3
    "Intolerance on Meta about making things better" that is such bullcrap. Cody's point is that your suggested feature wouldn't actually change anything. – Pekka Aug 6 '13 at 12:11
  • 2
    So, what? What do we do about it? Who is going to evaluate this code and make the "official" determination about it quality? Who decides that they are qualified to do that? What if you disagree with their decision? Indeed, democracy is an imperfect system. Sometimes dumb stuff gets voted up, sometimes dumb decisions get made. But it's better than all of the alternatives. – Cody Gray Aug 6 '13 at 12:11

We already have such thing.

You can downvote such answers. If 3 people do so and the score of the answer is -3 or lower then the answer will be displayed differently (light grey) which indicates an untrustful answer.

But we can't allow single persons disgrace answers as they like. Such heavy actions need to be made by multiple persons.

What you can do is:

  • downvote the problematic answer
  • leave a comment
    • you can ask the poster for updating the answer
    • you can state in your comment that there is a problem with that answer
  • you can change the answer yourself (but beware not to vandalize the post)
  • post a better answer yourself
  • But that's not happening. I've seen a lot of bad, insecure answers that were highly upvoted. – Sliq Aug 6 '13 at 11:53
  • 4
    All we do here is community driven. We can't allow a single person disgrace answers. – juergen d Aug 6 '13 at 11:54
  • You are wrong again. SO allows to tag/mark/flag stuff by single persons. – Sliq Aug 6 '13 at 11:54
  • Yes, but that will only lead to an action if multiple people do that (flagging). – juergen d Aug 6 '13 at 11:55
  • But @Panique, such flag would probably not be honoured. – Arjan Aug 6 '13 at 11:55
  • 1
    And that's exactly what i asked for. – Sliq Aug 6 '13 at 11:55
  • @juergend Btw Stackexchange is NOT really community driven like you think, it's a big company with 100+ employees and paid moderators that sort out stuff that has negative SEO effects. It's totally okay like but, but the site does not work like you think. – Sliq Aug 9 '13 at 10:14
  • Moderators are not paid. They are elected by the community. But whatever... – juergen d Aug 9 '13 at 10:28

Flags (asking a moderator to step in and take action) have never been appropriate for decisions which require a technical opinion. They are for things which are in the wrong place (questions in the answer section, non questions in the question section, ads for purses or movies) and which can be seen to be "in the wrong place" by any one person who looks at them.

Dangerous and insecure code, whether in an answer or elsewhere, is not special. It is in the same category as really slow code, code that wouldn't actually compile, code that would run but not do what the OP asked for, code that looks ugly, code that will be hard to maintain, code that is vulnerable to not working any more when a new framework is released, and code that works with today's version but not with the version the OP said they were using. All of this is "not useful" and earns the answer a downvote. If you're a nice person, you comment on the answer saying "this is vulnerable to SQL injection" or "question says for version 3.7 - this was introduced in 4.1 so it's not going to help" and so on.

Flagging an answer as insecure would introduce three problems:

  • how would a moderator know, without expertise in the subject, if the flag was valid or not?
  • if they did find it valid, then what? Do you want the answer removed, or just a banner on it saying WARNING: a qualified person has determined that this code has security vulnerabilities, do not use it - you can have that any time by commenting, of course. Would you like it utterly removed? Why, if there is good stuff in the answer (like parameters to an API or meaning of some options) that the OP could use?
  • once SO takes on responsibility for assuring users that no answers will contain dangerous code, what happens on the day some dangerous code goes unflagged, is shown to users, and is relied on? Is SO somehow responsible for that now, on the grounds that mechanisms were in place to remove insecure code from answers and should have been used for this one?

I see a giant hassle with loss of information for askers and later readers, liability for the network's owners, much harder work for volunteer moderators, and no benefit. Comment on the insecure answers, provide a different version of the answer yourself that is more secure, downvote the insecure answers, promote links to the question encouraging others to answer or downvote or comment as well, and make the internet better that way, instead of trying to get a feature added that would enable you to ask a moderator to do all that.

  • I want ads for purses and movies!!! Please don't flag those! – Taryn Aug 6 '13 at 12:05

Not the answer you're looking for? Browse other questions tagged .