There are a lot of people who code solutions and post it in forums like this one. I think, maybe I'm wrong because I'm a beginner, that these people are able to introduce "evil code". Is some organization taking care of this or is it a user's responsibility?
-
3Read the 'code' first, work out what it will do, and only use it if you agree it will help and understand what it will do. If you're not 100% sure, build a test environment (vm or real-hardware) and test it yourself there.– guivercCommented Jun 14, 2019 at 21:23
-
3If you don't understand how to read the code and the poster has no track record I wouldn't install it. An evil person would design the evil code to explode stuff five months after you tested it in a VM. If it was on this site though the evil person would be banned and evil answer deleted. Chances are someone else would spit the evil code before you see it.– WinEunuuchs2UnixCommented Jun 14, 2019 at 21:35
-
3I'd suggest reading this question and answers: If I follow instructions from a blog or Ask Ubuntu, etc, is it always safe?– Sergiy KolodyazhnyyCommented Jun 17, 2019 at 8:20
Add a comment
|
3 Answers
Stack Overflow is far ahead of Ask Ubuntu at reviewing code because it's a programming website. In addition to Stack Overflow's normal way of reviewing code by users who volunteer to be reviewers and by Stack Overflow's moderators, there are also chatrooms that were created specifically for reviewing code and several reviewing bots. Some of these same bots are also reviewing posts every day at Ask Ubuntu. It is possible for users to apply to the bot moderators for permission to participate in reviewing the results of the reviewing bots which flags false positive results and trains the bots to be more accurate. Some bots have the adaptive ability to retract their own results if enough false positives are reported by members of the bot's team.
In the end none of these methods can succeed without the participation of human beings, so there must be oversight by users who volunteer to be reviewers. Anyone can participate in improving the quality of posts at Ask Ubuntu. There is no reputation requirement for submitting a suggested edit to any post to be reviewed by Ask Ubuntu's volunteer reviewers.
-
1You mean there are bots that scan posts for code snippets and analyse them for malicious things? I haven't heard of that yet, and tbh I would be surprised if that existed, because it would be terribly complex. Or are you only referring to SmokeDetector and similar?– Byte Commander ModCommented Jun 14, 2019 at 22:54
-
There are bots that scan for plagiarized code. There are also bots that scan for short code snippets that are not accompanied by an explanation of what the code does. However afaik there are not any bots that do deep scanning of code snippets and analyze them for malicious things. As a member of several bot teams I have the privilege of manually reporting my own deep scanning results to the appropriate bot in order to submit it for further review by other reviewers. This is done transparently in a public chatroom and anyone in that chatroom can freely comment about it and frequently does.– karelCommented Jun 14, 2019 at 23:04
-
Ah, cool. So I guess this happens in SObotics? That's nice, I'm really not familiar with most of the things people built there.– Byte Commander ModCommented Jun 14, 2019 at 23:11
-
-
SO moderators do not review code! No more than any other user, anyway. And, as you say in the comments, there are no bots checking for malicious code, so I don't really understand what you're suggesting.– terdon ModCommented Jun 16, 2019 at 13:27
-
I review low quality posts at Stack Overflow and I always check back on my work to see if the other reviewers at Stack Overflow agree with me. I frequently see that posts that I recommended deletion of were deleted by a Stack Overflow moderator. This is one example of what I meant by Stack Overflow moderators review code. If it's no good they delete the answer. Not just one moderator, several SO moderators do this every day.– karelCommented Jun 16, 2019 at 13:42
-
Why don't I explain this more thoroughly in the answer? Because it's not about Ubuntu, therefore off topic. I'm trying to stay on topic in the answer section. If the game runs into extra innings, I can be as off topic as I want to in a topical chatroom without flooding the answer section.– karelCommented Jun 16, 2019 at 14:41
ANY code that is going to be doing something you do not want will and must have a big fat warning. Most famous one:
Why did the command ":(){ :|: & };:" make my system lag so badly I had to reboot?
More because guntbert doubts me :-)
Terminal command to remove unknown file
`rm -rf ` and `rm -r` have the same results
I have yet to see an answer where we did not have a warning
I personally will interpret any code I see in questions. I fix software problems for a living so I have this weird habit that I HAVE to understand code I see otherwise I keep having this itch. At work I am known for pointing out problems with code where it is not even clear to me I have pointed to a problem. Yes I know I am weird :-X
I know lots of others on AU that review code too. Besides that there are a 10, 20 people on AU I trust when they post code on AU and most elaborate answers tend to come from a select few.
-
1You are very confident here - with ANY code - I suggest to s/ANY/Most/ .– guntbertCommented Jun 15, 2019 at 16:10
-
-
1Those examples are about "obviously" dangerous code - but there may still be cases where someone sticks something malicious between several lines of code/commands. Not every post is thoroughly reviewed. Mind you I don't talk about highly voted answers but according to Murphy's Law we will have malicious code on the site.– guntbertCommented Jun 15, 2019 at 19:37
-
"Not every post is thoroughly reviewed." I believe that is not true. Code from new users will be reviewed. People that have shown they can code (like Jacob Vlijm) maybe not as thorough but that's why we trust them ;-)– RinzwindCommented Jun 15, 2019 at 19:47
Excellent things have been said already, but let me add a few words from someone who posts those code snippets once in a while.
How can we be safe about code from this site that we install? You can't. Any piece of code could contain harmful - intentionally or not - elements. While that is also true for snippets on AU, you probably won't find a place with less risk than on AU or other SE sites. The reason is that not only snippets are in general relatively short and clear, but more importantly: anyone can (and will) look into the code, and anyone can comment on or flag a post. Any potential critic is visible directly on the post itself.
That is unlike some private websites where we can often see bad advice or inadvisable commands. If I am a crook and want to inject malicious code, the one environment I need to avoid is SE sites.
As said, using code you didn't write yourself is a risk. In short however: in general, I believe the code posted here, especially from answers that already live a bit longer or posted by people who are around a bit longer, is probably the least of your concerns.
answered Jun 19, 2019 at 18:27
-
Also, code that's fine on MY system might break YOUR system, unintentionally. Commented Jul 4, 2019 at 13:11