11

This was spotted first on MathOverflow, but the method works fine here as well so I presume it's also possible on the other SE sites. Someone noticed that a closed question had been answered after it had been closed. The timeframe was a few minutes between closing and answering. There was a bit of speculation on meta.MO as to how this could have been done and to check what the mechanism was, I tried answering a closed question. I managed to do that, and in the process showed that there was no limit on the timeframe: the question I answered was closed last November.

I found this post on meta.stackoverflow which says that what originally happened is Status-By-Design, though the delay of an hour is perhaps a bit long (maybe the answerer took a lunch break?). This post seems to say that there is a block after a short time, but it doesn't go in to any details as to how the block is implemented. This question implies that there is no upper limit.

Given how easy it is, I would have thought that there should be a proper block on not answering closed questions rather than the current method which smacks of security-by-obscurity.

The MO question where I managed it is: Is it best to run or walk in the rain?.

Improve this question
15
  • 4
    Steps to reproduce?
    – user27414
    Sep 3, 2010 at 16:51
  • @Jon B: I wasn't sure if I should say. If it is deemed not worth fixing (I can't see that anyone would significantly gain from doing this, except in that it would annoy the moderators), then putting the steps somewhere public (which are really easy once you know) rather defeats the object. Whilst I object to "security by obscurity" in principle, I'm aware that in practice, every form of security is really just security-by-obscurity, but some are more obscure than others. So if a moderator or SE official asks me for the steps, I'll supply them (and I'm happy to be contacted by email).
    – Andrew Stacey
    Sep 3, 2010 at 17:06
  • "closed" is only used to disable the client side new-answer UI, it is not enforced server side when you post an answer. You can post answers to questions that have been closed since months, though it doesn't work for locked questions IIRC.
    – sth
    Sep 3, 2010 at 17:29
  • Apparently some people are less concerned about explaining it somewhere public :)
    – Michael Mrozek
    Sep 3, 2010 at 17:31
  • sth's comment only told me which of the two obvious methods to try first. People who can leverage that would be able to figure it out for themselves if they were motivated...
    – dmckee --- ex-moderator kitten
    Sep 3, 2010 at 17:59
  • 1
    @Andrew - if you want to, you can post more details in an answer and then delete it. Only mods and 10K users will be able to see it.
    – user27414
    Sep 3, 2010 at 18:18
  • @Jon B: Okay, done. Except that I did it the other way around: I deleted the answer and then posted the details in it. That way, the details aren't exposed at all! Hope that's acceptable.
    – Andrew Stacey
    Sep 3, 2010 at 19:01
  • 2
    Thanks. Given the amount of work necessary to exploit this bug and the limited benefit of doing so, I think this one belongs low on the list of changes.
    – user27414
    Sep 3, 2010 at 19:05
  • 1
    @Andrew - Another way to look at it is that if you post the info publicly, it'll give people less motivation to go out and try it for themselves. Since, you haven't explained exactly how to do it, I may well go and try it..... which I wouldn't have done had you posted instructions (mystery of the unknown and all that).
    – Peter Ajtai
    Sep 3, 2010 at 19:05
  • 1
    By the way, this is the actual eldest closed question. At least, the oldest live one currently. Tossing it here since I can't throw it at the place you made the actual inquiry.
    – Grace Note StaffMod
    Sep 3, 2010 at 19:09
  • I will admit that when I first realised it could be done it was a "My word! How can that be possible??" reaction, but now that I've thought a bit more about it then I agree that it's not really a Major Bug. However, I would say that mods on SE sites should be aware of it so that if it happens then it won't surprise them. The details of how I did it are in a deleted answer to this question. If one of the Big People agrees with Peter and wants to undelete it then that's fine by me, but it's not my place to make that decision.
    – Andrew Stacey
    Sep 3, 2010 at 19:12
  • @Grace Note: A-ha! Maybe I should have asked a question about that first to find the best place to demonstrate the hack. (I just did a search for "closed" and then sorted by reverse date to find the first one with "closed" in the title.)
    – Andrew Stacey
    Sep 3, 2010 at 19:13
  • 1
    I did similar, except I used a search for "closed:1", which returns only closed questions. It's one of the advanced ninja search options you can find over here.
    – Grace Note StaffMod
    Sep 3, 2010 at 19:16
  • @Grace Note: Thanks for the link! That's very useful. And although MO doesn't have those, presumably tex.SE does so as I'm a moderator (pro tem) there then those look like useful skills to acquire.
    – Andrew Stacey
    Sep 3, 2010 at 19:32
  • Actually, thinking about it some more then it would be very easy to fix this. Simply embed an encrypted string in the form such that part of what was encrypted was the question number. Then if the question number doesn't match the encrypted string, it's an invalid answer.
    – Andrew Stacey
    Sep 4, 2010 at 15:20

1 Answer 1

Reset to default
1

We now block answering after a reasonably large amount of time has gone by.

Improve this answer
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .