1

I read this blog and have the following questions and feature request. Please help.

Most of the times, the answers are approved by users who might just want "a" solution to the problem. They might not be knowledgeable enough to know the performance/security threats in those answers.

  1. Is commenting on such answers the best way to notify the future readers? If there are many comments, it might just get drowned in it

  2. Or is downvoting a better option? I don't think it is

  3. Would SO consider adding a tags section into the answer? This is probably a feature request, but I don't know whether there is something in the works already.

  • 2
    @WeareMonica. I guess Code Review and Software Engineering could also be examples of sites that could potentially have this issue – Justin Krejcha Nov 30 at 0:33
  • 1
    @JustinKrejcha Also, there's StackOverflow in languages other than English, e.g., Stack Overflow en español. – John Omielan Nov 30 at 0:35
  • What's a "tag section"? And how is that supposed to help here? – Jonas Wilms Nov 30 at 1:12
  • Hopefully developers working on production applications aren't copying code found online without understanding it. – dustytrash Nov 30 at 1:21
  • Here's an earlier question about that study: meta.stackexchange.com/q/334811/334566 – PM 2Ring Nov 30 at 1:39
  • 2
    @dustytrash Some do, some don't. That study certainly found plenty of evidence of carelessness. Here's one example involving Samsung, stackoverflow.com/q/48610180/4014959 which got reported here. – PM 2Ring Nov 30 at 1:52
5

It seems like the accepted convention is to comment and/or edit the post so that any vulnerabilities are identified, as long as the criteria for editing (it should not significantly change the answer) is met.

Something like...

One should take care to appropriately mitigate [...]

...should be sufficient. An alternative could be to add your own answer that has the vulnerability identified and fixed.

It's hard to find data for this, but I've seen this on some answers across SO.

Not the answer you're looking for? Browse other questions tagged .