12

The tag-badges exploit was an old exploit in Stack Exchange: at the time, a total of 1000 votes across all your answers on a tag would give you a gold tag badge for that tag. This lead to an edge case where an answer with 1000+ upvotes would break the badge system – you could edit a tag on to the question just before the tag-badge updating job was about to run (it runs at a predictable time each day), and the person would get a gold badge in that tag.

Nowadays, the problem would be worse if it hadn't been fixed – gold tag badges actually do something to the software (by allowing their owner to wield the dupehammer), so if the same issue still existed, it would effectively lead to a privilege escalation exploit.

Of course, we don't have the same edge-case scenario any more; the fix was to require both 1000 votes on answers in a tag, and 200 answers in the tag, so you can no longer just find a 1000-point answer and start manufacturing artificial gold badges. Still, if the edge case isn't there, there's still a corner case: if someone has made 200 answers to the same question, and they have a total score of 1000 or more, then exactly the same exploit exists. After all, all the answers to a question use the tags of the question when they decide which gold badges they're working towards, so editing the question tags effectively edits the tags of all the answers. But surely this is only a theoretical concern, right? What are the odds of someone legitimately answering the same question 200 times, and consistently getting upvoted for it (thus reaching the 1000)?

Well, the reason I'm writing this post is because this ridiculous theoretical scenario has actually happened: at the time of writing, this question has 206 answers by the same user (out of 347 total), which have a total of 1026 net upvotes. Although obviously a special case, this doesn't seem to be a particularly undesirable outcome, or even an abuse: each new answer is an improvement on the previous answer, but needs to be explained separately (because the explanation is basically "everything covered in the previous answers, plus some extra information about what's new in this version of the answer"), and you can't exactly put it all into a single community wiki answer because there's a size limit on answers, so the question having 347 answers is the most natural way to approach answering it (and the best way to understand the most recent answer is to read all the preceding 346, in order, so in that sense the answers are all necessary and the question would be worse off without any of them).

I'm nonetheless not convinced that any sort of software fix is required – questions with this many useful answers are incredibly rare on Stack Exchange, and we can probably mostly trust the community to not abuse this sort of corner case when it does occur. However, the gaining of a gold tag badge from a single question is such an unusual event that I thought it would probably be worthwhile to let people know that it had occurred, thus this post.

3
  • 1
    It doesn’t appear as though the user has received any tag badges for [answer-chaining]. Jun 17 at 1:25
  • 1
    Tag badges are only awarded for tags with a certain minimum number of questions, and [answer-chaining] is a rarely used tag. (However, this doesn't have much of an impact on the exploit, because it's rare for a question to have only rarely used tags, so you can just pick a common tag that's on the question you want to dupehammer and manufacture a gold badge for that.)
    – ais523
    Jun 17 at 1:26
  • 3
    This made me think of another edge case that is probably not as rare: if a user has 199+ answers in tag [x] with minimal votes and has one answer in tag [y] scoring 1000+ points, they can add [x] to the parent question and get a gold [x] badge. Jun 17 at 4:23

0

You must log in to answer this question.

Browse other questions tagged .