10

This accepted answer it not just factually and technically incorrect on many levels, it is actually passively malicious in that it claims it is secure with arguments that are logically incorrect but may seem correct to the unknowing, when it is everything but secure. It does not answer the question and provides an naively insecure implementation of what the question is about. The problem is a Dunning/Kruger effect one, to understand why this is insecure would require the same knowledge to not come up with this as a solution. If you read through the comments you see many people arguing that this is some how secure in circular arguments that might seem valid to others that lack the comprehension to understand why they are wrong as well. The 43 up votes kind of prove this out. There is no way the community can deal with this with only the public tools available to them at this point.

I think it should be deleted or at least edited with a huge warning at the top that this is not secure and to stop reading and not to use this, locking it would help as well.

What is the right way to try and mitigate the harm that this answer does?

1
  • 5
    The answer in question seems to be deleted? Could we get a screenshot for context?
    – Anders
    Commented Sep 19, 2018 at 9:07

3 Answers 3

Reset to default
9

In general, answers that are factually and technically incorrect should be handled by the community without moderator intervention. Moderators have a custom flag decline reason that reads "flags should not be used to indicate technical inaccuracies, or an altogether wrong answer". There are a few options on what to do. Minimally, a comment should be left explaining why the answer is inaccurate or wrong and the answer should be down voted. If someone has the time, a correct answer should be posted (and it would be OK to link to that answer in the comment).

However, as software engineers, we also have ethical obligations. You can look at any of the leading ethical codes for computing professionals - the ACM Code of Ethics and Professional Conduct, the Software Engineering Code of Ethics and Professional Practice (jointly created by the ACM and IEEE Computer Society), and the IEEE Code of Ethics. On a community of software engineers, we should remove posts that advocate for conduct that is unethical.

In this particular case, it appears that you and others believe that this answer is unsafe and unsecure. All of the codes of ethics that I linked to above call out considering security and privacy in some way or another:

  • Principle 2.9 of the ACM Code of Ethics states that software engineers have a responsibility to "design and implement systems that are robustly and usably secure". Principle 1.1 is more broad and the descriptive text states that "an essential aim of computing professionals is to minimize negative consequences of computing, including threats to ... personal security, and privacy".
  • The IEEE Code of Ethics states that members of the IEEE shall "hold paramount the safety, health, and welfare of the public, to strive to comply with ethical design and sustainable development practices, and to disclose promptly factors that might endanger the public..." and "avoid injuring others, their property, reputation, or employment by false or malicious action". Although it is only enforceable toward IEEE members, it is a useful consideration as to what ethical behavior of engineers should look like.
  • The ACM/IEEE-CS Software Engineering Code of Ethics and Professional Practice states that software engineers should "approve software only if they have a well-founded belief that it is safe, meets specifications, passes appropriate tests, and does not diminish quality of life, diminish privacy or harm the environment."

I'm going to reiterate: Any question or answer that promotes conduct that can be considered to be unethical by multiple prominent professional codes of ethics for computing professionals or software engineers has no place here and should be removed. If anyone sees a post that they believe promotes unethical or unprofessional conduct, please raise a post here on Meta. Moderators see notifications of all new Meta discussions. Also link to the Meta discussion on the post itself in a comment with a brief description of what the problem is so people can be aware of it.

I reviewed this particular question and answer.

I observed that the answer does not actually answer the question asked. Instead, it gives an implementation to do the type of thing being asked about. As pointed out in some of the comments, the code also doesn't work out of the box.

It does appear to be unsafe code and the answer does not highlight potential problems with using this approach. It does not refer to accepted or known good practices. Given the number of up votes and the accepted state, a user with insufficient knowledge about security may be given the false impression that this is a good solution to a problem unless they read the comments.

I don't believe that this answer meets the standards that we should be upholding, so I have deleted the answer.

18
  • 3
    So, moderators have the right to outright delete posts on the basis of technical merit. That's... kinda new, as far as I understood. Normally, they're supposed to act on the basis of our site-wide rules, not judge whether answers are sufficiently technically correct. I don't like the precedent for a moderator imposing site-wide ethical standards on the community. At least, not without having some kind of discussion and consensus building first.
    – Nicol Bolas
    Commented Sep 9, 2018 at 6:49
  • 2
    @NicolBolas mod deletion on technical merits seem to be recommended approach for many years already and there is nothing really new, see eg How aggressively should we maintain and improve very popular questions? This is particularly sensible at smaller sites where there is often not enough voters to do proper community cleanup
    – gnat
    Commented Sep 9, 2018 at 10:00
  • 2
    @NicolBolas How technically correct this answer was did not factor into deletion. It was deleted because it did not answer the asked question, comments were not being addressed, and the lack of professionalism and concern for security in the answer. When it comes to posts that are inherently unsafe or dangerous, I am not going to wait for the community to reach consensus - the post was brought to my attention and I handled it in the manner that I felt most appropriate. If anyone disagrees, please open a new discussion on Meta or contact Stack Exchange.
    – Thomas Owens Mod
    Commented Sep 9, 2018 at 11:23
  • 4
    @ThomasOwens: "comments were not being addressed" I wasn't aware that people are required to address comments or face the deletion of their posts. I don't recall any rules to that effect. "the lack of professionalism and concern for security in the answer" How is security not a technical consideration? To know that an answer is insecure, you have to look at the technical merits of the answer.
    – Nicol Bolas
    Commented Sep 9, 2018 at 13:30
  • 1
    @NicolBolas It depends on the nature of the comments, but when you provide code that cannot be executed without fixing or acknowledging the limitations of the code or when people are pointing out risks that are not highlighted or addressed, it's safe to consider the answer abandoned. These abandoned answers do not add value and only give a poor impression of the quality of this site as a resource.
    – Thomas Owens Mod
    Commented Sep 9, 2018 at 14:13
  • 3
    @NicolBolas Also, security is both a technical and an ethical concern - this post was not deleted because it was technically wrong. Even if the code worked, it would still have been deleted because it shows a lack of professionalism and concern for potential users of a system. Multiple commenters pointed out a security flaw that went unacknowledged by the author and that, from an answer quality perspective, is unacceptable here.
    – Thomas Owens Mod
    Commented Sep 9, 2018 at 14:14
  • 2
    @NicolBolas In your example, I would expect that someone would be able to fix the answer, assuming it otherwise fully answered the question asked. This answer was entirely unsalvagable. It did not answer the question, it contained security risks without identifying them, and the poster was not engaging with the community. If there was an opportunity to resolve the concerns by editing, then editing would be the preferred solution. However, any edits would have changed the post that was accepted and voted on and we have regularly opposed such drastic edits to posts
    – Thomas Owens Mod
    Commented Sep 9, 2018 at 14:31
  • 3
    @NicolBolas As a moderator, it's not my job to determine what answers are sufficiently secure. It's my job to determine which answers meet our quality guidelines and to review concerns of users. Answers that show a distinct lack of professionalism do not meet those quality guidelines. If you do not believe that we should hold people to a professional standard here, please open a Meta discussion or feel free to reach out to the SE community team directly. But I will continue to use my discretion to ensure that questions and answers here maintain a professional standard.
    – Thomas Owens Mod
    Commented Sep 9, 2018 at 14:35
  • 6
    @ThomasOwens: I believe two things: 1) nothing in the help pages about this site says anything about "professional standards", nor are there any links to the standards you cite. So you're talking about holding people to a standard nobody was informed their posts were being held to. 2) Moderators are elected to enforce policy, not dictate it. That is, if you think policy should be changed to enforce a "professional standard" that includes security (since it presently does not include that), it is up to you to get that discussed and approved before you enforce it.
    – Nicol Bolas
    Commented Sep 9, 2018 at 15:06
  • 3
    @NicolBolas I like to put this in Help. However, few help pages are editable. Most of them are standard across the entire network. I asked for this to be changed back in 2016.. In order to understand policy, users must keep up to date on Meta. It's not friendly, but there are no better tools. If you read various discussions on quality, you'll find that I'm not dictating policy, but interpreting discussions and enforcing the intent of the community. If you feel that my interpretations are wrong, please make a new Meta question or contact the team.
    – Thomas Owens Mod
    Commented Sep 9, 2018 at 16:06
  • 1
    @NicolBolas I don't have the time to comb through meta posts now to satisfy your desires. If you make a new Meta post about it, I'll be more likely to remember when I have the time, or someone else can find the relevant posts.
    – Thomas Owens Mod
    Commented Sep 9, 2018 at 16:36
  • 2
    @NicolBolas Actually - I found it. You need to go back to a central theme of the site name change from Programmers to Software Engineering. When we rebranded, the emphasis was on people who are involved with "creating, delivering, and maintaining software responsibly". This was misconstrued on several occasions (one example) and was dropped from the official text. Although the words are no longer there, the sentiment has not changed.
    – Thomas Owens Mod
    Commented Sep 9, 2018 at 16:59
  • 1
    @NicolBolas You can find a whole lot more details if you read about the rebranding of the site and all of the issues around that. That rebranding has been a big reason for a low-tolerance moderation policy around closure and deletion of posts.
    – Thomas Owens Mod
    Commented Sep 9, 2018 at 17:03
  • 6
    Mod-deletion of this answer was heavy handed but I think it was a correct and legitimate action to take. Importantly, mod intervention was necessary here because deletion of this dangerously wrong answer through community means (down voting until I can cast delete votes) would have been effectively impossible. But in the future, please first add a comment to explain such actions to onlookers. E.g. “this answer is being discussed on Meta (link). I am deleting it because <reason>.”
    – amon
    Commented Sep 10, 2018 at 7:10
  • 8
    I will just add that it is not unusual for dangerous or ethically deviant answers from being deleted by mods in the greater Stack Exchange network. There are many examples of this on DIY.
    – maple_shaft Mod
    Commented Sep 10, 2018 at 14:09
-1

There isn't one.

Even if you change the sorting of posts to always put the highest voted post first, that would simply create a different problem: where a bunch of people upvote a post that they think is good but it has some critical flaw. Sure, if you get enough people to downvote it and upvote something else, you can eventually get it removed.

But then again, if you can get enough people to downvote an accepted answer into negative numbers, people will probably no longer believe it is correct.

Now, you might say that the aggregate judgment of voters is probably more accurate than the judgment of the person asking the question. But I've seen too many posts that attract upvotes which very much should not to believe that this will solve the problem.

So long as there is some sort order based on someone's judgment, you will ultimately be relying on the judgment of some person/people to order posts. The most likely way of solving the problem is to use comments to convince the user to change their post.

In this particular case, I would suggest posting a comment on the question, since the OP seems to still be a user of the site. If you let them know that the accepted answer has grave security flaws, they may change the accepted answer.

1
  • 2
    you didn't see the dozens of comments saying just what you suggest and the stanch defense that this is a good idea ... that has already been proven a waste of time. Dunning/Kruger Effect is a real thing and this is the perfect example. People that are incapable of comprehending why something it wrong insisting that it is correct would have never thought it was correct if they could comprehend the reason it isn't.
    – user7519
    Commented Sep 8, 2018 at 5:21
-1

I propose that high rep individuals on the site (at least 5000+, maybe 10,000+) be given a "special" right to flag such accepted answers saying that they disagree with them, and why. Then both the individual user and the community can vote/debate on the merits for the "flag."

This privilege would not be available to everyone; only those users with sufficient reputation for their flags to be credible.

1
  • I didn't downvote but this very discussion makes an example demonstrating that bringing such answers to meta works well enough already. Consider editing your answer to explain how proposed procedure would be better than usual meta discussion
    – gnat
    Commented Sep 18, 2018 at 9:39

You must log in to answer this question.