Handling "how can I do [absurdly dangerous thing]" from someone missing a lot of background knowledge?

Question

There's a question currently about doing something rather dangerous (running PHP code, though possibly trusted), and the asker appears to be missing a lot of background knowledge (e.g., referring to "javascript, jquery, ajax" as three separate languages, not knowing about shell execs, etc.). Now, there's certainly value in people who are not yet knowledgeable acquiring that knowledge, but in this case there's also a ton of information we'd have to impart.

My concern here is that a "good" answer (for the stackexchange format) would be far too surface-level, and an answer containing enough information would be too long. This amount of varied information seems like it would be better-suited to a series of related (narrower) questions, or a blog post, or even just "hire a security professional if you need this ASAP". But, where/how is the best way to convey this assessment of the question? (if you are the person who asked that question, hi!)

Answer 1

In general, I think the best way to deal with these kinds of questions is to try to write good, clear answers that highlight the dangers. Explain that this is extremely dangerous, and how easily things could go wrong. Feel free to use colorful language to get the point across, but don't be rude.

If you offer suggestions for how to mitigate the risk, let them be a minority of the answer. And stress their limitations, and make it painfully clear that your recommendation is to just not do it. The answer to "how do I shoot myself in the foot" is "don't do it", not "make sure to have a doctor present".

A recommendation to leave it to professionals could be appropriate some times, but I don't think it should be the main part of any answer. An answer should educate, not just defer to authority.

Personally I would be careful with the close votes in these situations. I think many of these questions can be answered in a good way. As for the one at hand, though, I might consider voting as to broad because there is a lack of context about the need for the PHP upload functionality.

Edit: I made an attempt at an answer to that question, in the above spirit. Don't know how well it worked out.

Answer 2

In typing this up, it occurred to me that I could put in a close vote as "too broad", along with an encouraging comment on the question suggesting that it be asked as a series of questions instead. Is that a good approach here?

Answer 3

If there is a reasonable expectation that the asker does not understand the risks associated with his description, I would concur with and expand upon Anders's response.

It may be appropriate to flag/remove responses aggressively when they advocate insecure solutions or gloss over major security issues since this is a security-oriented forum.

The asker or other readers may assume that a response without caveats represents a safe option. This could lead to the implementation of an insecure design by someone who does not understand it---an outcome diametrically opposed to the goals of this forum.

Normally I abhor censorship, but it becomes a responsibility once platform associates itself with trustworthiness or expertise.