A paper was recently published partly about Stack Overflow, specifically relating to how a number of the accepted answers in relation to Java security were out of date and even dangerous given recent exploits and vulnerabilities.
While there is an existing post, How to deal with obsolete answers?, on what to do with old Q&As, the research pertains to how developers learn and google answers in general. Usually people are learning and as is almost inevitable, some bad code is written (some good too mind!).
The articles in question
- Secure Coding Practices in Java: Challenges and Vulnerabilities - paper -
- UK IT news article on above paper
My question is essentially, how do we go about keeping answers up to date or at least flagging Q&As, particularly around security?
E.g., anything using SHA1 should probably be flagged by default given the collision demonstrated earlier this year. Or is this even feasible to retrospectively go back and review Q&As like that?
I realise that this doesn't apply completely across the board on Stack Exchange sites and that the article singles out Stack Overflow by name. However, there are a number of Stack Exchange sites that a situation of "The recommendations here are old, and now potentially dangerous if implemented" that this would apply to such as (but not limited to);
- Ask Ubuntu
- Computer Science Educators
- Computer Science
- Database Adminstrators
- Information Security
- Network Engineering
- Software Engineering
A sub-set of the 171 Stack Exchange sites to be sure, but it applies to more than just Stack Overflow.