22

After reading Panique's well-intentioned idea on Signalizing/tagging INSECURE answers (and questions), I started wondering if there wasn't a better, simpler way to address this problem.

We've all seen calls for tag clean-ups and link clean-ups here on Meta. This normally works out pretty well, since everyone here on Meta knows how tagging and linking work on Stack Exchange sites. I also once made a post asking for ideas and help cleaning up the quality of a particular tag, which was at least moderately successful.

What I'm thinking now is a bit different, so I want to hear what the community has to say about the following ideas.

  • Could a community effort be started to apply the principles of How to prevent SQL injection in PHP? to fix answers found on Stack Overflow? (This is just one specific example.)

  • What would be the best place to post a "call to action" for this sort of clean-up effort? (Meta? The main PHP chat? A chat created for this specific cleanup effort?)

  • What should that call to action be? (Change code? Downvote? Leave a comment? Add a new answer?)

Note: I do have serious reservations about changing code in other people's answers, but I think the benefits outweigh the costs in certain situations. In the example link I gave above, I think a clear improvement can be made to a lot of answers without changing the intent of the code at all.

3
  • 3
    What about another option to add a more secure answer, if one does not exist? – psubsee2003 Aug 6 '13 at 13:42
  • 2
    @psubsee2003 Yes, that should always be the first step, but often the accepted, top-voted answer has a security flaw. A lot of people who don't know any better will still use the method from the top answer if it works, without looking further down the page. – Bill the Lizard Aug 6 '13 at 13:45
  • 2
    The call to action should be a new answer tailored specifically to the question at hand. As it stands, the comment "Please don't use..." comment is spam, being thrown at any answer that it may stick to. Changing the code is changing the intent of the author, which we don't do here. Calling people to action to downvote is really a vote ring in another form, something which Stack Exchange explicitly forbids. Adding a new answer is the only solution here. Answer it and let it bubble up to the top. It's worked for millions of other questions, no need to call special attention to these. – casperOne Aug 6 '13 at 18:26
4

What would be the best place to post a "call to action" for this sort of clean-up effort? (Meta? The main PHP chat? A chat created for this specific cleanup effort?)

I would say all of the above, though I would guess that Meta and the tag specific chat would be the best places to start.

What should that call to action be? (Change code? Downvote? Leave a comment? Add a new answer?)

I think commenting to the original author would probably be a good first step. Allow the author the opportunity to update the code or add a notice that their solution may have been good at one point, but the technology has changed and there may be specific security risks now. I would also recommend posting a link to the related Meta discussion or chat room so they have a clear idea of where you're coming from.

Along with commenting adding a new answer pointing out the flaws of the outdated or insecure answer would be an excellent solution. I can't speak for everyone but before I implement anything I find on SO I read the comments and check the other answers, particularly when I'm looking at a post that's more than a year old.

I would hold back on the downvotes at least until the author has a chance to respond to comments. That's just me, trying to be nice. Chances are that a user who posted a highly upvoted solution in the past will be able to fix it, and may even want to help you along in your crusade, no need to alienate them with a sudden heap of downvotes.

I have the same feeling about changing code as I had about downvoting, give the original author a chance to fix it, before you mess with it. Adding a new answer is probably a better alternative.

-3

I don't think a downvote or changing code is the correct thing to do. The answer is correct (I assume) and could be very helpful to the OP and changing that would change basically what SO is. Currently a comment or answer is way better, but you're right, if they first answer works for someone, they probably aren't going to try looking elsewhere.

If you're looking for a drastic solution, I like the idea of being able to flag an answer as "Insecure" that creates a notification (or actually however a flag currently shows up, I'm sure you all don't want a million new red dots on your screen) that shows up for, say, 500 rep users and up (don't we need a new privilege there anyway?). After having 5 people choose it as insecure/secure, a special tag/color/sticker is added to the top of the answer acknowledging it as such. Now, clearly this has issues since it allows anyone with decent rep to answer, even if they have no idea what they're talking about but I think its on the right track.

However, if SO starts taking responsibility for having a "secure" version of an answer, I worry that people will begin to associate all posted answers as "secure" e.i. all the top voted/accepted answers will be perfect, even if they were posted years ago. I think my solution is a step in the right direction (clearly differentiating a secure/insecure/normal answer) but I still worry about the association.

3
  • 3
    "changing code ... would change basically what SO is." -- wat??? – John Dvorak Aug 6 '13 at 14:15
  • @JanDvorak no no no, I mean changing an answer even though its insecure. That problem should be addressed for sure but isn't the accepted viewpoint that you don't change someone's code? – Daniel Aug 6 '13 at 14:19
  • 1
    the accepted viewpoint is that you don't change the meaning, or intention, of somebody's code. It's just that substantial edits are likely not to pass the review queue. – John Dvorak Aug 6 '13 at 14:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .