The scenario:

A dangerously incorrect answer contains advice that has the potential to cause harm. The danger is missed, misunderstood or underestimated by some members and the answer receives some upvotes. Due to the 125 reputation downvote requirement, the number of downvotes is underreported. Entirely contradictory and cautionary answers receive vastly more upvotes. Against the weight of community opinion, the OP accepts this answer meaning that it is sorted to the top of the list and receives the endorsement of a green tick. The answer is bombed with critical comments, the first chunk of which are hidden away in chat where they are invisible to the vast majority of future readers, while later warnings are simply deleted. The advice with the potential to cause harm remains.

(Assume in your answer that the potential for harm is real and supported by documentary evidence. Do not point to the thread that prompted this question and argue that it isn't harmful. Imagine a hypothetical post that is harmful.)

The questions:

  • Within existing site policy, what can the community do to indicate to future readers that the potential for harm exists if this advice is followed?

  • Is this remedy sufficient? Is it actually visible to future readers?

  • If not, could this be resolved by a change in policy or would a new site mechanic be necessary?

  • 2
    just for the record, for the specific question we are speaking of I am entirely opposed to your opinion that it is dangerously incorrect. As a parent, I would insist on the school providing MITM services to mitigate the risks against my children. – Rory Alsop Aug 31 '18 at 17:41
  • 1
    @RoryAlsop First I'd like to apologise for the tone of the comment I left - I couldn't previously without leaving yet another. One danger is this line: "If the laptop is only used for school work, then there is really no harm here." - even then it can still capture video, audio, passwords and location data or be used to compromise the home network and expose personal devices to attack. Your argument is fine as far as the school protecting children from the outside, but dangerous as far as protecting against threats from within the school, in an era when new reports of this threat emerge daily. – DeveloperInDevelopment Aug 31 '18 at 20:15
  • 1
    @RoryAlsop I know it's risky saying this, but I have seen up close and personal the kinds of vulnerabilities that can be exploited when a school tries to "protect" children by installing software or a root certificate. It's a very strange feeling to see, at your fingertips, access to what is effectively a botnet composed entirely of elementary school children that you obtained only because the school decided to install some benign filter software on their laptops and you were bored. The risks that are "mitigated" may be greatly exceeded by new risks that are introduced. – forest Sep 1 '18 at 1:58
  • 1
    @forest - all depends on threat model. In many cases it dramatically reduces more serious risks - I have seen it make students much safer. But the chat over on that post would be the better place to discuss – Rory Alsop Sep 1 '18 at 13:26
  • 1
    Simple parental controls are more effective in doing that without the same risks. But you're right, the (unwieldy and long) chat may be the only place for this. – forest Sep 1 '18 at 21:09

I don't think this is, in fact, a significant enough issue to require a change.

In the vanishingly rare case were there's clear and present danger of substantial real world harm due to an answer, flagging for deletion is probably the correct mechanism, and that works just fine as is.

For anything less, the perception of the potential for harm to some subset of the user base is likely far more significant than the actual potential for harm, and in my opinion, the existing voting and commenting mechanisms work quite well enough to deal with issues that are merely controversial.

  • 1
    My concern is that once the flag is declined (as a courtesy to established users or to avoid creating a hostile environment for new users) there is no lasting warning to future readers. In the case that prompted this question, the potential for harm was proven in a court of law, and is significant in scale. I'm surprised by your statement on comments - on controversial posts they are quickly hidden or deleted, so I have no idea what you mean by "work quite well enough". – DeveloperInDevelopment Sep 1 '18 at 9:45
  • @DeveloperInDevelopment That is indeed a problem, even more so given that the comments were migrated to chat. – forest Sep 1 '18 at 22:44
  • @DeveloperInDevelopment And my position is that shouldn't (and doesn't) happen when answers do in fact meet a reasonable bar of being harmful. Downvoting and commenting do work well enough for other cases. They may not work exactly to your liking in some specific case, but as a rule, they do a perfectly adequate job. – Xander Sep 2 '18 at 18:59
  • @forest That speaks more generally to the purpose and design of commenting on the platform. I'm not a huge fan myself, but it is what it is and is working as intended if not exactly how i and some others would like. – Xander Sep 2 '18 at 19:00
  • Within existing site policy, what can the community do to indicate to future readers that the potential for harm exists if this advice is followed?

Upvote a contradictory answer. Post one if none exists.

  • Is this remedy sufficient? Is it actually visible to future readers?

Not from what I've seen of the shift in the balance of new votes as a thread ages. All indications are that the top post is read by many, many more people than those lower down. I've been looking for a poll of answers read per thread, but without luck.

  • If not, could this be resolved by a change in policy or would a new site mechanic be necessary?

Frankly, SE has far outgrown the original context for which its interface was designed. It is ill-equipped to handle controversial or potentially harmful content. This potential for harm is particularly apparent and most frequently an issue on IPS, parenting, DIY, etc., but the superficially technical veneer of security.SE makes it seem more similar to the relatively safe Stack Overflow for which the interface was designed and is a near perfect fit. But in terms of the stakes, the behavioural component, the existence of an adversary, security.SE is vastly different.

A technically literate answer may appear appropriate to many, despite profound misunderstanding of the behavioural component. An apparently strong answer might accurately evaluate the risk a given policy poses to the individual and characterise this as low, but fail to account for a population size that would imply a large number of expected victims. As security professionals, an alarming number of high ranking site users place undue trust in the motivations of other security professionals (if not always in their competence). Such issues create the potential for harm and can provoke the kind of community dissent for which the SE format is ill-equipped. I am sceptical that the problem can be resolved within the format.

But if questions with such potential are to be asked and answered, I believe that the simplest approach to restore some measure of community protection is to modify the stock comment left by mods when deleting comments on the most controversial posts. Instead of:

Comments are not for extended discussion; this conversation has been moved to chat.

I suggest something to the effect of:

This answer has received a large volume of critical comments and may be considered controversial. Please read and consider all answers in your decision making. Comments are not for extended discussion; this conversation has been moved to chat.

where "controversial" is a link to a community-sourced definition as it should apply to posts on security.SE

Personally, I'd prefer "harmful", but I don't imagine mods being comfortable labelling answers as such. (Actually I'd prefer to see whole SE sites closed down and potentially harmful content aggressively removed, but that will clearly ever happen.)

  • 4
    I think you have a slight misunderstanding of how these sites work. Security.SE has significant content that could be harmful or beneficial. We will not judge it on the presumed aims of the poster. – Rory Alsop Aug 31 '18 at 17:43
  • @RoryAlsop I'm afraid I don't understand your comment: "We will not judge it on the presumed aims of the poster". Who is "we"? Mods? Experienced site users? All users? The lay-person trying to work out if something they've been asked to do is safe? What do you mean by "presumed aims"? My question assumes that the poster aims to help, but has simply missed, misunderstood or underestimated a significant risk. – DeveloperInDevelopment Sep 1 '18 at 9:51
  • the problem is that you think that post is dangerously wrong. Others think it is absolutely the right thing to do. We are not going to take sides and post something like you suggest on a post because you disagree with it. This isn't like some of the stuff over on DIY where there are very definite "do not plug the mains into your head" messages that can be given. – Rory Alsop Sep 1 '18 at 13:32
  • 1
    @RoryAlsop You stress "you", and I'll admit to being the one making the fuss, but 260+ other people agreed by upvoting the contradictory answer that stressed the dangers. I don't normally make a fuss - this was the thread that broke the camels back after dozens of others... – DeveloperInDevelopment Sep 1 '18 at 16:21
  • Personally, I think it's wrong and that hooking up a bunch of children to a centralized system that has questionable security in the name of "safety" is highly risky, but not to the point that the accepted answer itself is downright dangerous. At least, there are far more posts elsewhere which have more objectively dangerous answers. – forest Sep 1 '18 at 19:18
  • @developer - and look at the 100+ upvotes for that answer. This means the general public is divided anyway. HNQ always does this, as people who do not understand a site pile on. – Rory Alsop Sep 1 '18 at 22:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .