12

On 24/03/30, a question was posted, whether the backdoor in xz is affecting Ubuntu:

I answered few hours later and received 5 upvotes.

My answer was deleted by the moderator Thomas Ward without telling his concerns. He used just the template with a link to a generic information which lists possible reasons like spam, commentary, another question and so on, nothing applies to my answer.

Since he didn't make a comment, what in particular his concern is, I didn't receive any notice from the system, that there is something wrong with my answer and that I should improve it, despite not telling, what needs to be improved.

I revisited the page today and was astonished, that this happened to my post. I consider this to be a very poor form of moderation, deleting competing answers without noting the author. He didn't even downvote my post, maybe to make me not aware of his intervention.

I thought it was considered best practice, to suggest improvements on posts, which you vote to close, if they aren't obviously sent with bad intend, like spam.

Update: Now, that my answer was undeleted, I'm more relaxed to the question. For the general handling of closing a question, I still believe, that answers, given in good faith with reasonable effort - I'm not talking about rude or offensive ones, spam or answers which aren't answers at all - should be closed, preferably with a reason why, so that the author can improve his post and maybe defend his position in comments. More so, a closed question or answer should trigger a notification.

If a moderator can't justify his reason to close, he shouldn't close it.

5
  • 2
    I am wondering if you would be happy to update your answer, removing the contested command: xv --version and replacing with either or both of the commands that terdon and BeastOfCaerbannog have suggested? If you can do this there would be no need for the answer to remain deleted; I would be happy to expedite this...
    – andrew.46 Mod
    Apr 11 at 2:49
  • 2
    Thank you for the kind offer. However, as stated in other comments here, the command xz --version has been issued on compromised systems and it seems to report correctly the vulnerable version number. Therefore it is a useful way to find out, that you are affected, if you are and it is - as far as anyone can tell - a harmless command on non affected systems. If my post post was undeleted, you could post your arguments for using a different approach as a comment and you're invited to do so. I don't admit, that my advice is dangerous. Apr 11 at 4:05
  • 2
    I defer to Thomas Ward's and muru's opinions on the inadvisability of posting that specific command in this unusual and rapidly developing situation, as well as the opinion of the member of the community who originally flagged the post. Nevertheless the offer stands on reopening with modified content.
    – andrew.46 Mod
    Apr 11 at 8:19
  • 3
    "it seems to report correctly the vulnerable version number" s/vulnerable/compromised/ It is a compromised executable that you advocate executing. That's what garners the disapproval.
    – Levente
    Apr 12 at 18:29
  • 4
    The impacted version of the executable is contaminated with malware. The expectation of others that it should be executed as seldomly as possible, seems to have merit.
    – Levente
    Apr 12 at 18:35

4 Answers 4

15

I strongly disagree both with the mod's decision to delete the post and with the way the post was handled.

In my opinion your suggestion of running the xz --version command is not problematic, since the OP is primarily concerned if an LTS is affected, which isn't. Running the command in an LTS is perfectly safe and reassuring for the OP to see that their version of xz is not the dangerous one.

The OP is also concerned if some other version is affected and, as you said, only 24.04 could be affected. Running the command in that version could pose a risk, however, 24.04 is still a development release, so if someone was running this release could already be at risk. Furthermore, if the OP was concerned specifically about 24.04, then their question would be off-topic and would get closed.

So for both the LTS and non-development releases, your answer is fine. It could be improved, however, by providing a way to check the installed version of xz without having to run it, so that the version checking would be safe for all releases. A safe version-checking command could be, for example:

apt-cache policy xz-utils

So this would be a nice improvement to your post. So the user that flagged your post could have also commented below your answer and expressed their concerns instead of just flagging it, and that would have most likely led you to find another way of checking the package's version.

However, the flagger's action is not my main concern here. It's the mod's action that matters more. The mod could have also expressed their concerns and comment below your post to let you know what the issue is with your post and then proceed to deletion, which wasn't really required in my opinion, but would be acceptable. Instead, the mod chose to delete the post without any justification of his action. While deleting a post with an explanation for the reason deletion is not obligatory, it is a good practice that can also lead to post improvement and subsequent undeletion. Our goal after all in this site is to have as many good questions and answers as possible.

Just deleting the post without any explanation about the reason of deletion feels as an extreme authoritative action in this case. And mods shouldn't perform such actions lightly. Okay, I don't expect an explanation for the deletion of every flagged post that was handled by a mod, but in this case the post wasn't clearly bad (I still don't think it is and that it should be undeleted) and at least an explanation for the deletion reason should have been provided.

Additonally, there is another answer to the same question that suggests to run the same command. Is this answer less dangerous?

Finally, I would like to remind that mods are also users, just with more tools and bigger responsibilities than non-mods, that are supposed to set the example for the community. As the rest of the users, they should justify their actions and not abuse their authority.

15
  • 1
    The link mentioned in the OP has a nice way of safely checking: $ hexdump -ve '1/1 "%.2x"' /usr/bin/xz | grep f30f1efa554889f54c89ce5389fb81e7000000804883ec28488954241848894c2410. If that returns a hit, you're compromised.
    – terdon
    Apr 10 at 11:39
  • 3
    Yes, there are various ways of checking. Still, just an edit to the @userunknown's answer saying "don't run xz --version if you are using 24.04, but run this instead" would suffice. And it would be much less wasted time for the mod and for the community if this was done instead of the deletion. Apr 10 at 11:43
  • 4
    " since the OP is primarily concerned if an LTS is affected, which isn't" ... And the rest of the world full of random users who might not be on an LTS? Or even on Ubuntu? This question hit the HNQ, completely random people will definitely have seen it. That an LTS Ubuntu was later known to be unaffected argument is a stunningly poor argument for otherwise recommending a potentially dangerous action. Remember, we still don't know the full capabilities of the compromised library.
    – muru
    Apr 10 at 22:53
  • 2
    @userunknown The correct command is apt-cache policy xz-utils. I have taken the liberty of editing this in above. Consider using something like apt-cache policy xz-utils | head -n3 for neatness and brevity.
    – andrew.46 Mod
    Apr 11 at 3:25
  • 1
    @muru: Maybe you like to explain, in which way xz --version qualifies for a potentially dangerous action. IMHO, the vulnerability we're dealing with, is a carefully hidden backdoor, and it depends on the combination of Linux, SSH, xz, libxzma and systemd. An additional attack vector via xz --version is pure and poor speculation, since it would have increased the risk of detecting it. Here: xeiaso.net/notes/2024/xz-vuln is a page where the author issued the command on a vulnerable system and the output has been xz (XZ Utils) 5.6.1 \n liblzma 5.6.1 (Backslash n inserted by me). Apr 11 at 3:33
  • 5
    @muru if you're concerned with this, which is understandable, downvoting the post would be ok, editing it would be ok, even deleting it but letting the OP know why their post was deleted would be acceptable, since they could then improve it if they would want to get it undeleted it. I don't agree with the way the post was handled. Apr 11 at 4:24
  • 2
    @muru, in principle I agree with your argument, but the chance of the system having executed xz after the evil version was installed is pretty high, so xz --version would be just one more drop in the bucket. And one couldn't consider even updating to an unaffected version, because the package is provided as a .tar.xz that needs will be unpacked with the affected xz, and Debian itself urged the users to update the package instead of wiping the system, so...
    – Quasímodo
    Apr 11 at 20:19
  • Out of principle I'd too suggest to avoid executing a compromised program, strings /bin/xz | grep 'XZ Utils.* [0-9]' for example is not so dense.
    – Quasímodo
    Apr 11 at 20:24
  • 2
    @Quasímodo so if it was already executed before, let's just go ahead and execute it unnecessarily again? I don't know if Debian ever recommends wiping and reinstalling, and considering the date of that advisory, it is entirely possible that like the other people here, they considered the SSH problem the be-all-and-end-all of the compromise. In fact, plenty of safer alternatives have been suggested, but userunknown, despite having edited their post since, hasn't bothered to use any of them. No, at this point, that has to be malicious, plain and simple.
    – muru
    Apr 12 at 1:45
  • 2
    Let's remember that these attackers spent at least two years on this. They're good for the long game. IIRC there was speculation that the reason they apparently tried to hurry with this was because systemd was moving to dlopen() to load dependencies instead of linking to them directly (which systemd did hurry up on after this came to light), eliminating what was probably their main prize. But if they did play a two-year-long game, then it is a safe bet that they will have other backup plans as well.
    – muru
    Apr 12 at 1:51
  • 2
    I have removed a few comments here, which I normally prefer not to do on Meta. Please be mindful that the use of terms such as: 'stupid', 'dumb' and 'idiotic' should rarely feature in courteous, reasoned debate.
    – andrew.46 Mod
    Apr 13 at 0:51
  • 1
    @andrew.46 note that actions can be stupid, dumb or idiotic even if the people doing those actions aren't. I strongly object to your deleting my comments, while allowing an answer that advocates executing malware up. Which of the two has the potential for actual harm?
    – muru
    Apr 13 at 9:31
  • 2
    I would caution you with saying "they should justify their actions and not abuse their authority." - that's accusatory and akin to stating that a moderator is abusing their authority, which is something that if you believe should be taken up with CMs, not stated here as a public comment which can be read as being slanderous.
    – Thomas Ward Mod
    Apr 13 at 19:39
  • 1
    Hey I came here because I saw this post on the Hot Meta Posts and I checked the question before reading this conversation on Meta and saw userunknown's post, and ran the xz command, on CYGWIN on WINDOWS! I didn't even believe I had it installed, so I ran it without thinking, turns out it's a default package that's installed with Cgywin. I don't care that this person (userunknown) says running the command will not affect people but it just really makes one nervous, I shouldn't have run it, now I'm worried. Why is that answer still up when it is not modified? @andrew.46
    – Shayan
    Apr 14 at 17:14
  • 1
    I have to say that I downloaded latest Cygwin, and on the packages I can see that they have downgraded xz from 5.6.0 to 5.4.6 and libzma was downgrade too. Wish I just hadn't checked the meta post at all. Meta is not doing good these days. This person is crying over their post being deleted in the comments here and they refuse to just simply edit their answer. While it just simply gives people a piece of mind to not have run the command accidentally. Answer should have stayed deleted imho.
    – Shayan
    Apr 14 at 17:18
12

It is true that mods are not required to leave comments explaining deletions. It is still a good idea to do so though, to avoid precisely the confusion you describe in your question. So as a general rule, mods do try to leave comments.

However, sometimes they forget or don't have time to. Mods are human too, and if you need to go through a few dozen flags, as is often the case on Ask Ubuntu (or at least was, when I was a mod here), it isn't always possible to leave a comment on every one. It is just too time consuming. So, sometimes, mods will forget or choose not to leave a comment.

I completely understand how unpleasant this can be, but do bear in mind that mods are volunteers and they perform their moderation duties on their own time. There will be occasions where although leaving a comment would have been better, a frazzled mod who is currently doing 5 things in parallel just won't leave a comment. It happens. And it isn't against any rule.

Now, it is good practice never to act on a flag when you might be perceived as having a conflict of interest. I know Thomas and I don't for a second believe he deleted that post for anything other than the reasons explained in his answer. However, it's true that since he had an answer himself, it would have been better to leave the flag to another mod to handle to avoid even the possibility of anyone misinterpreting the action. But, again, mods are human. And Thomas's field is security, which means he—quite correctly—tends to feel he is knowledgeable enough to make calls on security related issues. And, well, he is, so he should, and he does.

All this to say that while Thomas could indeed have handled this better, first by not acting on a flag where he may be perceived as having a conflict of interest and second by taking the time to leave a comment explaining, both for you and for anyone else who isn't a mod but can see deleted posts, I do think it's clear he acted with good intentions and didn't do anything really wrong.

5
  • 5
    A mod who is doing 5 things in parallel might delete obvious spam or not-an-answer answers in a hurry without notice. If he lacks the time to do his job in an appropriate manner, he shouldn't do it. My post was written with good intend. I linked to my sources for further reading for those, who are interested to dive deeper. The idea, that calling xz --version might be compromised too, is pure speculation and, imho, a poor one too. This backdoor was very carefully hidden and specifically targeted SSH, run by systemd. It doesn't make sense to do evil work, when invoked from commandline. … Apr 11 at 3:13
  • … It would have been an suspicious code change, if the new version of the handling of the --version flag would involve changes other than the number of the reported version. Apr 11 at 3:15
  • 1
    @userunknown well no, the code wouldn't need to touch the bit that prints the version. As long as the malicious library is loaded, the malware can be activated even if the code just prints the version. And since libraries are normally loaded before anything else, it is likely that printing the version is enough to trigger the vulnerability. Now, since libsma is a very basic tool, even used during boot, any system that boots with an infected liblzma is likely already compromised and running xz probably won't make things much worse. Still a bad idea though.
    – terdon
    Apr 13 at 12:54
  • Since liblzma is linked to every 3rd-to-5th program (on my system, 614 programs in /bin and /sbin alone), as you mention, why is it still a bad idea, though? If it's already too late AND the bad xz releases reveal their version number correctly, as already has been testet, and the other mentioned methods like using apt or pgrep are linked themselves against liblzma or discouraged for usage for other reasons like strings (but this might be an outdated advice, at least the man page does not contain a warning in that regard any more) - it seems to me like a cargo cult advice. Apr 13 at 16:12
  • 1
    @userunknown Flags point specifically at posts. I was unaware there was a conflict of interest at play. Note that i've already undeleted your post.
    – Thomas Ward Mod
    Apr 20 at 18:01
9

While certainly Thomas lacked leaving a (due in my opinion) comment, I second deleting the answer in the state it was when it was deleted (and in which apparently still is, which is: lacking a GIANT warning).

First off suggesting that the command is safe to run on supported Ubuntu releases makes suggesting to run it inherently useless advice. If it's safe to run on supported Ubuntu releases because those releases only provide safe versions of the command, then what is it that we're checking exactly? What are we doing here? And OTOH, why are we suggesting running potentially unsafe commands in unknown environments without warning about the potential consequences?

Overall I find anything beyond the initial "No" in the answer completely useless (it doesn't help users in learning something they're not aware of already after having read "No") and only potentially dangerous.

Addressing the users who're not running a supported release / a Ubuntu release at all and that may be tempted to run the command: while it's "technically correct" that one should do its homework and interpreting the answer as "This has been answered on Ask Ubuntu, answers there only apply to Ubuntu releases that were supported at the time the answers were posted + I shouldn't be blindly running commands found on the internet", do you think the average / potentially clueless user running 24.04 / MyOwnLinuxDistro would 100% debate the safety of that command?

It doesn't matter if they're running an unsupported relase / another distribution altoghether, there are obvious security implications to running that command which go beyond being on-topic / off-topic or correctly guessing what OP is using and deeming it safe for OP to run (the latter, as also suggested above, due to this site being primarely aimed to help everyone stumbling upon the post, not just OP).

At the very least there should be a GIANT warning.

So, being overall not useful (at the time it was posted there was at least Rinzwind's answer clearly stating that LTS versions are not affected already) + potentially dangerous in its current state = I'd rather not have it on the site.

While I'm all about free information, and while I agree this could've been handled better (I'm not judging Thomas at all, everyone makes mistakes, myself being the prime example; I'm just stating that objectively a comment was due there), I second censoring something that's not useful for those in a safe spot and that's only potentially dangerous to those who aren't. I'd rather have the user figure out another (safer) way to check if they're affected.

18
  • Maybe you missed my other other comments, where I already stated, that the command HAS BEEN USED on an affected system and revealed the correct version number, which has been withdrawn by at least all popular distributions so far, in case they had delivered it via their systems. So the fat warning, you recommend, is superfluous for systems which are not affected, as you concluded yourself. On systems which have installed the backdoor, it reveals its vulnerability, which is the whole point of the action. Maybe one uses a niche Distribution, doesn't trust the upgrade process or did install … Apr 11 at 22:01
  • … the combination of programs in an atypical way. Then there might be the small chance, that this person has sshd avaiable in combination with systemd and xz, but hadn't started them since updating. Only in this very rare circumstances, the case could be made, that running xz might trigger something, which hadn't already happened. But this case is not probable, as already pointed out, because a non trivial code change in the --version option would be suspicious. If you like to assume such a scenario, you may as well assume that strrings or or apt-cache have been compromised meanwhile. Apr 11 at 22:08
  • 1
    I red your other comments. Nobody ever questioned that your command works and that it reveals the correct version, you're derailing the conversation. The point I'm making and that you seem to be missing is: why taking the chance when you either 1. don't need it as you're on a LTS or 2. you're not on an LTS and there are alternate ways to check.
    – kos
    Apr 11 at 23:32
  • 2
    I don't understand why you're being so stubborn in defending doing something not mandatory and only (albeit with low chances) potentially dangerous while, having the malicious binay not been completely reverse engineered by top security experts yet, there's still a chance it may do things.
    – kos
    Apr 11 at 23:33
  • 2
    No matter how many distributions updated, no matter how slim you think the chance is (to which slim chance I kinda agree), the point is that, unless you know better than those currently clearing the binary and unless you can provide compelling evidence that the binary is safe to be run that way, your security clearance is, I'm sorry, irrelevant, much as mine would be. You're speculating the binary is safe because "whoever would want to hook the binary on a call to the version dump function" but haven't we just been proven totally wrong exactly this way?
    – kos
    Apr 11 at 23:33
  • "Let's not check binaries used for tests because whoever would exploit them to backdoor the release executable"? Have we not learned anything from this? I find assuming hooking into lzma at all be 100% safe, in this scenario, naive at best. That been said, yeah, perhaps 1%. But it still doesn't matter. The point is: why taking the chance instead of copy-pasting a different command? That I don't understand.
    – kos
    Apr 11 at 23:33
  • I never suggested to prefer xz --version over other suggestions for testing the version. I never claimed that it is a 100% secure thing to do. But there is no indication that there is second attack vector and the command has been tested by other people and correctly revealed its version version number, which would make those, who are affected, aware of the problem. I guess we agree on the advice, not to run testing versions of Ubuntu in production but we know, that not everyone follows such advice. How good are my chances in a posting on AU to convince a person to change their behaviour? … Apr 12 at 5:54
  • 1
    … The one which would visit AU and blindly repeat the command would, as far as we know, only do harm to his system, which would have been happened already if he was running it for a few day in combination with systemd/sshd. I'm not claiming that my advice is the best and most careful one, you could do. I'm just defending it against silently deleting it without giving me the chance to improve it or to defend it. I didn't know that I don't get notified if a post of mine is deleted and find it super unfriendly to do so. You may threat spammers like that or obviously harmful advices or vandalism, Apr 12 at 6:07
  • And we know a lot about this carefully crafted backdoor and it seems to be a universal backdoor, useful for a whole lot of things to harm others. We should use this incomplete knowledge in estimating, how big the chances are, that there is in fact a second attack vector, and my estimation is, that it is very, very low, since this would increase the risk of getting detected, rendering this beautiful time bomb useless. Your estimation seems to vary, which is a legitimate position to hold, but I don't think it was legitimating the deletion of my answer. Apr 12 at 6:13
  • 1
    @userunknown You've done the right thing coming on meta and bringing up the poor handling of the deletion; as a matter of fact I upvoted your question, because you have a fair point there, and I, too, think that letting you know why the deletion was happening was due. But since the top answer "strongly disagrees" with the deletion, I felt like bringing up that the deletion itself wasn't unreasonable (and that, as a matter of fact, I too think that answer is not needed considering that, at least to me, the risks outweigh the benefits). I guess we'll have to agree to disagree
    – kos
    Apr 12 at 9:08
  • @userunknown That been said, mods don't have to comment. But again, I agree leaving a comment with a reason there (IMO) made a lot of sense, cause ultimately it's not spam and the reason why the deletion was happening wasn't obvious.
    – kos
    Apr 12 at 9:13
  • @kos I said that "I strongly disagree both with the mod's decision to delete the post and with the way the post was handled" because I believe that the deletion wouldn't be required if the OP was told about the issue with their answer in the first place, and because even if the post was deleted but the mod had explained the deletion reason, there would be no hard objection from my part and likely from the OP too. See also my comment to @muru. Apr 12 at 10:48
  • 1
    @BeastOfCaerbannog Well that I agree with, the problem is that you're saying this in your answer: "In my opinion your suggestion of running the xz --version command is not problematic", which is a stance I don't want to associate with; furthermore, as I explained in my answer, I also think that " if the OP was concerned specifically about 24.04, then their question would be off-topic and would get closed." is kind of irrelevant in the bigger scheme, because ultimately also 24.04 users / users running other distros altoghether will still stumble upon the answer. You see what I mean?
    – kos
    Apr 12 at 10:59
  • 1
    @BeastOfCaerbannog And still to this date their answer doesn't even remotely mentions the smallest, tiniest chance of worsening things by running that command, and I wonder why; multiple users have pointed out that it could be unsafe to run, yet it seems to me that OP doesn't want to acknowledge not even this (again) small, tiny chance, argumenting their lack of an acknowledge in (to me) unreasonable ways such as "then you might as well think that strings or apt-cache have been compromised".
    – kos
    Apr 12 at 11:10
  • 1
    @BeastOfCaerbannog I mean, it's their answer, they can write whatever they want in it and if the community stance is to keep the answer as it is, so be it; but as it stands, without any added usefulness past the initial "No" and beyond what other answers were providing, to me, the (tiny) risk in keeping the answer still outweights the (non-existent) benefit, overall leading to a net-negative. Making it better as deleted. Again, just my 2 cents.
    – kos
    Apr 12 at 11:10
0

The post in question received a flag for moderator attention, alluding to the insecure approach you wrote of "executing potential malware" on the system in question as your 'solution' to determine if someone is vulnerable or not, which is substantially dangerous from a Security perspective.

This is the flag history on the post (with specific information redacted):

enter image description here

As your answer was written, it encourages user to execute the potentially-compromised executable files to gather information about the potentially-compromised executable. Doing so outside of a secure sandbox is dangerous, and as such I agreed with the custom mod flag. I've underlined in the deleted post here where you tell someone to execute the binary that could be compromised.

enter image description here

To that end, due to the danger of executing potentially compromised binary files and malware I deleted the answer as "Overwhelmingly unsafe to be posted". When a moderator deletes a flagged post, the moderator is not obligated to state why the answer was deleted, as moderation history etc. is available to moderators including post flag history, which I've attached here.

7
  • 8
    Would that be dangerous though? From what little I understand, the backdoor is in liblzma not in the xz executable per se, so loads of programs, most notably sshd which apparently calls liblzma functions for its integration with systemd, can trigger it. If you do have the compromised liblzma on your system, then you're already pretty much screwed, right? Surely some compressed files are handled even during boot. So executing xz doesn't seem like it would increase the risk. Am I wrong?
    – terdon
    Apr 10 at 11:10
  • 2
    @terdon in the case of this specific vulnerability you're right, however the problem is if we start allowing these kinds of answers, then it sets a bad security precedent. Either way, I wouldn't suggest running anything that has any RCE vulnerability or backdoor vulnerability, even if there's even remotely a chance of a compromise. The point is that it's an insecure practice regardless, not specific to this vulnerability but to many in general.
    – Thomas Ward Mod
    Apr 10 at 14:57
  • 13
    @ThomasWard if an answer does answer the question but you (everyone) disagree with it, it should be downvoted. If there is a concern of setting a bad precedent about a specific type of answers, a meta post explaining this concern should be made so that the community can know about it and decide how to act on such answers. This answer getting single-handedly deleted by a mod without at least leaving a comment explaining the deletion reason to the OP is an extreme and authoritative measure. Apr 10 at 18:31
  • 2
    When referring to the program in question as malware, you're ignoring that we have more specific information. It is part of a backdoor which has been carefully developed and hidden and is known to work in combination with SSH on Linux when the later is managed by systemd. You may speculate on secondary flaws, but that doesn't look reasonable to me, especially not in a simple function like version, where non trivial changes would have been obvious. The second issue I have with your answer is, that you widen the scope to these kinds of answers, then it sets a bad security precedent. Apr 11 at 3:50
  • 2
    … My answer was a specific answer to the question on hand, not a general advice how to handle other, vague similar issues - malware, which isn't a carefully hidden open source backdoor. Here: xeiaso.net/notes/2024/xz-vuln is a page where the author issued the command on a vulnerable system and the output has been xz (XZ Utils) 5.6.1 \n liblzma 5.6.1 (Backslash n inserted by me), so with this command, it seems, you would get a correct feedback that your system is infected, if it was. Therefore I beg you to revoke the deletion of my post. Apr 11 at 3:57
  • 8
    Especially given that another answer suggests to run the same commands. I can not see any reason why this answer was deleted. In this case running the commands is the simplest way to check...
    – vidarlo
    Apr 11 at 6:17
  • 3
    @vidarlo You make a good point. I donwvoted that answer as well. However that answer is more problematic than the answer we're questioning here, as it brings also useful (or rather "not contested") advice, unlike OP's answer. So it's not black nor white, and it's harder to take a stance on it. It doesn't fully deserve deletion IMO. Although I don't like it at all because of the "run the binary" option. For sure, being a mod has to feel like walking on a razor's edge all the time.
    – kos
    Apr 13 at 2:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .