8

A paper was recently published partly about Stack Overflow, specifically relating to how a number of the accepted answers in relation to Java security were out of date and even dangerous given recent exploits and vulnerabilities.

While there is an existing post, How to deal with obsolete answers?, on what to do with old Q&As, the research pertains to how developers learn and google answers in general. Usually people are learning and as is almost inevitable, some bad code is written (some good too mind!).

The articles in question

My question is essentially, how do we go about keeping answers up to date or at least flagging Q&As, particularly around security?

E.g., anything using SHA1 should probably be flagged by default given the collision demonstrated earlier this year. Or is this even feasible to retrospectively go back and review Q&As like that?

Edit

I realise that this doesn't apply completely across the board on Stack Exchange sites and that the article singles out Stack Overflow by name. However, there are a number of Stack Exchange sites that a situation of "The recommendations here are old, and now potentially dangerous if implemented" that this would apply to such as (but not limited to);

  • Ask Ubuntu
  • Computer Science Educators
  • Computer Science
  • Cryptography
  • Database Adminstrators
  • DevOps
  • Information Security
  • Network Engineering
  • Software Engineering

A sub-set of the 171 Stack Exchange sites to be sure, but it applies to more than just Stack Overflow.

  • 1
    I bet there are a bunch of old academic papers that contain out-of-date security advice. Why doesn't anyone ever talk about that? Both papers and answers are time-date stamped. I don't see how or why this is a real problem. (Also, I don't see how the reviewers of that paper missed the fact that it is "Stack Overflow", not "StackOverflow".) – Cody Gray Oct 2 '17 at 10:39
  • @CodyGray, I guess their point is that when a developer is googling something, the higher rated answers are listed at the top and are the first clicked upon - not unreasonably. The (potential) danger lies in a naive developer implementing what they find not realising that the info is out of date/insecure – DiskJunky Oct 2 '17 at 10:41
  • 6
    There are indeed massive risks involved in letting naive developers implement secured subsystems without oversight. I don't think Stack Overflow is making that problem any worse. The focus is being placed on the wrong party here. – Cody Gray Oct 2 '17 at 10:47
  • 1
    @CodyGray the primary focus is always the developer themselves. In the context of the question, I'm generally asking if there's anything that can be done on the SO side to help mitigate. You can't solve stupid but you can nudge it in the right direction :) – DiskJunky Oct 2 '17 at 10:49
4

One part of your problem seems to be that some no longer useful, and even now dangerous, answers still occupy the top spot on older questions, and will continue to stay there even if downvoted heavily.

There is a reluctance to remove the special status that accepted answers hold, but a while ago I made a proposal for Keeping special status for Accepted Answers without sticking them to top forever? which seems to be gaining traction.

If accepted answers can age away, when not renewed by their askers, I think there is much more scope for downvoting to take care of wrong, and even dangerous, answers by placing them so far below top spot that their deletion becomes likely.

  • I had read that and it goes some way to helping, certainly. However with security, perhaps some kind of flagging mechanism could be added to warn visitors that the accepted/voted answers may be out of date. This particularly pertains to older answers advocating out of date algorithms such as SHA1 or the like. It's a hard one to see how to tackle though – DiskJunky Oct 2 '17 at 10:53
  • 1
    @DiskJunky, are you looking for something automated? How would SO know if a question or answer is related to security, and whether or not it's out of date? If manual, who do you propose should trawl through the archives reviewing these old answers? If they should they search for sha-1 tags, what else should they review? I'm not saying they can't be addressed on an ad hoc basis, but SO has hundreds of thousands of answers, so this may be an unsolvable problem. – John Deters Oct 2 '17 at 17:34
  • @JohnDeters, those are good points and part of why I was raising this as a question to be asked. In practice, a manual approach would be more feasible - assuming the following reasoning. a) it's not practical to revisit 100,000's(+) of posts to flag, b) it's likely that the most susceptible to misuse/bad implementation are the highly voted/old answers now out of date. Particularly in relation to b), is it possible to add a new flag type such that a warning would display to the user that the info displayed is out of date and potentially dangerous? We already have a flag system in place, so... – DiskJunky Oct 3 '17 at 8:59
  • 1
    @DiskJunky why you dont just edit that answer to reflect new security policy ? or add a new answer. As security measure available now was maybe not available for those version – yagmoth555 - GoFoundMe Monica Oct 3 '17 at 12:02
  • @yagmoth555, that's always an option but the danger there is that it'd be missed/not read. You don't often see an upvoted, up to date answer on an old question. Likewise, editing the question is generally frowned upon (for good reason), and editing the accepted (or upvoted) answer is similarly dubious. If there was a facility to leverage the existing flagging system which displays prominently but not invasively, then that seems like a possible way to go – DiskJunky Oct 3 '17 at 12:06
1

Keeping on your SHA-1 exemple, a naive approach would be to flag every question/answer about it, but then you'll flag posts like:

Removing the git tag you'll find things like Java String to SHA1 where's there's no goal stated, it could be to store a quick hash of a directory to notice a change and a collision could be harmless.

I think there's too much overhead in trying to classify Q/A pair into security/not security categories, and then categorizing answers into outdated or still relevant.

In a manual approach, adding a new flag and a box adds a lot of complexity into the system where you can edit the outdated answers to add a warning at its top.

I didn't go out of SO for the exemples, but from the top of my head I'm pretty sure there's a lot of q/a about cisco admin password from old switches where the hash is reversible also which may fit your concern.

1

Maybe this is a naive answer, but perhaps a system could be implemented where if a certain tag was present, there would automatically be a "caution" message (similar to the open bounty or on hold messages) about using outdated security measures and that even if it's not outdated, it's not guaranteed to be secure, etc...

Having a unique tag which implements a message would be better than a flag though, as users posting new questions could use the tag to enable the warning without moderator intervention.

The tag would have to be something specific and obvious, and users posting questions would have to both know about it, and have the right judgement to use it or not use it.

Relatedly, a subset of existing tags could be chosen to activate this behavior (eg. security).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .