I am talking about
Image upload vulnerability checking in php script
How do we know that this is really OP`s server? Do we support such questions at all?
-
2It doesn't really matter if we "know this is really OP's server". We should give people the benefit of the doubt, since something that may help a black hat will also help a white hat.– forestApr 6, 2018 at 1:04
Add a comment
|
2 Answers
I closed it under
Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem
With my personal emphasis being on, demonstrate an understanding of the concepts involved being missing... it was basically, "Do some work for me."
Do we support such questions at all?
In the linked question, OP just dropped some code and asked if it's vulnerable. This sounds to me like a blatant request for code review and definitely didn't demonstrate much research effort.
However, I think they could have made it an acceptable question if
they created more of a MCVE instead of just half-pasting, half-linking their original code,
they pointed out a specific part of the code which they are unsure about and
gave their own thoughts on what's wrong with it and why they suspect it may be vulnerable.
How do we know that this is really OP`s server?
We can never be 100% sure a question is asked in good faith. But we can at least demand that askers do their own research, and try to give educational answers that talk about the involved patterns and techniques instead of just providing them with a free list vulnerabilities in their code.
