What are we doing here?
Does it benefit anyone?
Do we have a moral conscience/responsibility to think and act about these things (or do the best we can with the time we allocate to helping programmers in distress)?
Before we start I have a 7,500+ rep on Stack Overflow, jon-goodwin. I expect you to express your opinions and views/values since the tags are discussion & news! I must admit the change in mindset required from Stack Overflow main site to the
meta.stackexchange.com was a strain on my brain and nerves but I think I'm getting the hang of it.
Lazy developers who copy solutions to tricky programming problems are creating apps that are vulnerable to attack, research suggests.
A team of computer scientists looked at more than 72,000 chunks of code found on the Stack Overflow website.
But researchers found many of the most copied snippets lacked basic checks that would stop common attacks.
The dangerous code chunks often used obsolete functions, did little to check user responses and did not look for attempts to break the application, said the study.
An Empirical Study of C++ Vulnerabilities in Crowd-Sourced Code Examples
Morteza Verdi, Ashkan Sami, Jafar Akhondali, Foutse Khomh, Gias Uddin, Alireza Karami Motlagh (Submitted on 3 Oct 2019)
Software developers share programming solutions in Q&A sites like Stack Overflow.
The reuse of crowd-sourced code snippets can facilitate rapid prototyping. However, recent research shows that the shared code snippets may be of low quality and can even contain vulnerabilities.
This paper aims to understand the nature and the prevalence of security vulnerabilities in crowd-sourced code examples.
To achieve this goal, we investigate security vulnerabilities in the C++ code snippets shared on Stack Overflow over a period of 10 years.
In collaborative sessions involving multiple human coders, we manually assessed each code snippet for security vulnerabilities following CWE (Common Weakness Enumeration) guidelines.
From the 72,483 reviewed code snippets used in at least one project hosted on GitHub, we found a total of 69 vulnerable code snippets categorized into 29 types. Many of the investigated code snippets are still not corrected on Stack Overflow. The 69 vulnerable code snippets found in Stack Overflow were reused in a total of 2859 GitHub projects. To help improve the quality of code snippets shared on Stack Overflow, we developed a browser extension that allow Stack Overflow users to check for vulnerabilities in code snippets when they upload them on the platform.
I find interesting:
Prof Sami said the team had developed an extension for the Chrome browser that checks when code is copied from Stack Overflow and lets coders know if it is poorly written or insecure.
The most widely used insecure code blocks turned up in more than 2,800 separate projects on the Github website, they found.
Questions on Meta Stack Exchange should relate to features or policies that commonly apply to the network or the software that drives it.