12

Background

The formatting sandbox is used to test out odd/unusual/interesting formatting, however it is also used for dangerous browser breaking experiments. For example I have been warned that Opera was previously crashed by that page and this experiment in nested quotes causes a painful unresponsive page problem on Android which persists even after the page is closed.

These are just the ones I know about.

The question

What is the preferred behaviour for browser breaking experiments, especially ones that may need to be left in place as evidence supporting a bug report or question.

  • 1
    This is not limited to the formatting sandbox, of course. But experiments there won't be cleaned up as noise either. – Martijn Pieters Dec 11 '13 at 14:21
  • 11
    I know a guy that went on that page.. and never came back.. be careful out there. – ʞunɥdɐpɐɥd Dec 11 '13 at 14:32
  • 1
    Where else should experiments be conducted? For now that's the place that makes most sense, and for sure they are needed. How would we know if something we suspect is really happening before reporting a bug? – Mołot Dec 11 '13 at 14:40
  • @Mołot Thats pretty much my question, if there is or should be somewhere else to post them. It's not a feature request but a discussion because I'm not sure of the solution myself. I can imagine a few solutions (post dangerous experiments in their own question on meta, seperate test-stack etc) but none of them seem like very good solutions/require too much developer effort – Richard Tingle Dec 11 '13 at 14:44
  • @RichardTingle maybe meta-tag like dangerous-experiment - with the same status as discussion, bug etc? Then one could experiment all he wants and others would clearly see it's a case of "don't go there unless you know what you are doing". And it would prevent too many experiments on one page, giving a bit of isolation. – Mołot Dec 11 '13 at 14:47
  • 1
    @Mołot I think that's quite nice, it would be nice if such a tag prevented the question turning up on the front page as well; although that might provide a place to hide spam – Richard Tingle Dec 11 '13 at 14:49
  • Well formatting sandbox is sometimes my favorite place to go. – Junior Sync Dec 11 '13 at 15:04
  • Is it needed to keep the experiments persistent, or could we have a (self deleting)/(user filtered)/(browser only) sandbox. I'm not familiar with the possible techniques. – bummi Dec 11 '13 at 15:08
  • @bummi Experiment should persist as long as related bugreport is not closed. So, to avoid problems and too much logic in the machine, auto-deletion is not what I would use. – Mołot Dec 11 '13 at 15:16
5

I think we need to clear up one thing first: It does not break your browser. Fullstop.

Now as far as it comes to being slow and/or unresponsive and/or crashing, yes, that can happen...but that can also happen on every other page on the internet. All modern browsers can recover from such a disaster in one way or the other, and I haven't heard of a data loss or even an OS crash, caused by a browser, in a long time. So a crashing browser is not a problem, it's an inconvenience, annoying, yet not problematic in 99% of cases.

So, should we stick a warning sign on that question? No, I don't think so, visiting random pages when flicking through your Google results is more dangerous then visiting this question.

Should we do something about this question slowing down or even crashing browsers? Absolutely! We have the opportunity to report it as a bug to the developers with a reproducible and secure site. Remember, most sites which slow down your browser or make it crash are not exactly of the trustworthy kind, but with this question we can give developers a safe site which they can use to reproduce and track problems in.

Should we allow "actively malicious" stuff in that question? No, never, flag and remove on sight!

  • If someone can put anything "actively malicious" on stack exchange without being an editor or an employee, I want to know about it. Where should it be documented? – hildred Dec 11 '13 at 15:37
  • @hildred: Anything regarding security/leaks/vulnerabilities should go directly to the team via e-mail. If you find something malicious (I'm not talking about an attempt) you would do best by removing it (if you can edit, that is), flagging it and maybe even e-mailing the team about it. – Time Traveling Bobby Dec 11 '13 at 15:40
  • ok so let's say sln found a post with malicious code in it. how do I find out about it? – hildred Dec 11 '13 at 15:44
  • @hildred: If it is important (f.e. your account is in danger), I'm sure they'd tell us (here, in the blog, via private messages). – Time Traveling Bobby Dec 11 '13 at 15:46
  • 1
    and the nsa is not listening to our phone calls. – hildred Dec 11 '13 at 16:01
  • @hildred: So, you've been around for what? A month? And already accusing the team of concealing security problems? – Time Traveling Bobby Dec 11 '13 at 16:06
  • no, stack overflow's model of transparency is very nice. I am arguing that your argument makes for an environment of security by obscurity, which may appear secure, but is not. many eyes make all bugs shallow. – hildred Dec 11 '13 at 16:12
  • @TimeTravelingBobby I actually agree with you, but you're better than "who's been here the longest" arguments – Richard Tingle Dec 11 '13 at 17:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .