15

There's a question currently about doing something rather dangerous (running PHP code, though possibly trusted), and the asker appears to be missing a lot of background knowledge (e.g., referring to "javascript, jquery, ajax" as three separate languages, not knowing about shell execs, etc.). Now, there's certainly value in people who are not yet knowledgeable acquiring that knowledge, but in this case there's also a ton of information we'd have to impart.

My concern here is that a "good" answer (for the stackexchange format) would be far too surface-level, and an answer containing enough information would be too long. This amount of varied information seems like it would be better-suited to a series of related (narrower) questions, or a blog post, or even just "hire a security professional if you need this ASAP". But, where/how is the best way to convey this assessment of the question? (if you are the person who asked that question, hi!)

9

In general, I think the best way to deal with these kinds of questions is to try to write good, clear answers that highlight the dangers. Explain that this is extremely dangerous, and how easily things could go wrong. Feel free to use colorful language to get the point across, but don't be rude.

If you offer suggestions for how to mitigate the risk, let them be a minority of the answer. And stress their limitations, and make it painfully clear that your recommendation is to just not do it. The answer to "how do I shoot myself in the foot" is "don't do it", not "make sure to have a doctor present".

A recommendation to leave it to professionals could be appropriate some times, but I don't think it should be the main part of any answer. An answer should educate, not just defer to authority.

Personally I would be careful with the close votes in these situations. I think many of these questions can be answered in a good way. As for the one at hand, though, I might consider voting as to broad because there is a lack of context about the need for the PHP upload functionality.

Edit: I made an attempt at an answer to that question, in the above spirit. Don't know how well it worked out.

  • Agreed on lack of context - I can't tell if the PHP code in question is trusted, hostile, or trusted-but-insecure; and I also can't tell how important it is to run that code, or whether there's a different approach that would work. – Ethan Kaminski Mar 22 '18 at 9:45
  • @EthanKaminski Exactly. I tried to write an answer anyway, se above edit. Not sure if I should have close voted instead, though. – Anders Mar 22 '18 at 9:53
7

In typing this up, it occurred to me that I could put in a close vote as "too broad", along with an encouraging comment on the question suggesting that it be asked as a series of questions instead. Is that a good approach here?

  • Absolutely, was about to answer that. You could also throw on a comment about the mass of background topics they need to catch up on, and honestly a link or two to some basic resources would probably be more useful than any answer. – AviD Mar 22 '18 at 9:35
  • I don't understand how it has a bunch of votes and a meta thread and hasn't been closed as "too broad". I don't know anything about PHP, but this question seems the epitome of "too broad" for any language or technology. – YetAnotherRandomUser Mar 29 '18 at 22:37
-1

If there is a reasonable expectation that the asker does not understand the risks associated with his description, I would concur with and expand upon Anders's response.

It may be appropriate to flag/remove responses aggressively when they advocate insecure solutions or gloss over major security issues since this is a security-oriented forum.

The asker or other readers may assume that a response without caveats represents a safe option. This could lead to the implementation of an insecure design by someone who does not understand it---an outcome diametrically opposed to the goals of this forum.

Normally I abhor censorship, but it becomes a responsibility once platform associates itself with trustworthiness or expertise.

  • 1
    Mods don't remove answers (I think) unless they are particularly problematic, e.g. advocate illegal practices or are rude, etc... Incorrect answers or answers that promote insecure practices are supposed to be voted down by the community, so that they trickle down to the bottom. but it becomes a responsibility once platform associates itself with trustworthiness or expertise -- I agree, but it's down to each individual to engage with this idea. – korrigan Mar 23 '18 at 19:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .