How well is "malicious" code accepted here?

Question

I recently asked a question that could possibly be used for malicious purposes. I tried to whittle the code down as much as I could to a "base" program so that a script kiddie wouldn't stumble across it and wreak havoc.

However, I have written other more "malicious" programs (for testing security mostly) where I will not be able to whittle out as much. An example of this would be a keylogger.

Do we have a policy on reviews for this? I would love to have my code reviewed, but at the same time I don't want to cause any trouble.

Answer 1

Code is not malicious (guns don't kill). It is the way that code is used that makes things a problem. I am certain that every piece of 'malicious' code has an 'angelic' corollary.

If code can be 'malicious' then computers are 'malicious', and operating systems are 'malicious', and networks are 'malicious', etc.

If I feel that the code in a particular question is going to be used for malicious purposes, I may decide to down-vote, flag, vote-to-close, whatever.... but, if there is no indication that the code is going to be used maliciously, then I have no reason to believe the code will be used for 'nefarious' purposes.

Personally, I have used crackers, root-kits, rainbow tables, keyloggers, etc. and all of them for 'good' (although I did feel a bit like 'Dr. Evil' when I did...)

Post your questions, if you want, you can state the purpose of the code.

Be warned though, that you will likely get some knee-jerk reactions, but that is what happens when things can be controversial.

Answer 2

When in doubt, I always refer to the on-topic helpcenter. In this case, there is no notion about malicious code (and/or code which could be used in a malicious manner, for those who care about the difference).

One could also check the "What questions should I avoid asking?" page, where malicious code isn't listed either.

Now we've established your question is not off-topic, let's take a look at how good questions are formulated and what you're proposing:

I tried to whittle the code down as much as I could to a "base" program so that a script kiddie wouldn't stumble across it and wreck havoc.

Although I can understand your sentiment and agree with your intent, it's a problem on Code Review. We like context. A lot. Good context allows us to write good reviews. Great context allows us to write great reviews.

Please, don't refrain from telling us exactly what it's supposed to do. Extra benefit from this is it allows us to safely test your code without causing harm to our own computers and/or data, which might happen if you downplay the risks too much.

As @rolfl said, you may get some negative reactions. That's the risk of posting controversial questions. However, this community won't burn you on it. I totally expect the most of us will treat your question with respect.

Answer 3

I enjoyed reading http://meta.stackexchange.com/questions/3528/dealing-with-questions-of-nefarious-intent - there's a lot of important nuance there that hasn't really been mirrored here in CR meta, so despite this question being already answered I need to add my two cents.

Saying "code is not malicious, guns don't kill" is a non-argument. As practitioners, we cannot absolve ourselves of the things we do and the things we teach. Code doesn't exist without humans, and increasingly humans don't live without code. Decisions in our field must be made with ethics in mind.

The other argument, that malware and security software are in an eternal arms race - and that laying open the information already available isn't harmful - is more credible. After weighing the arguments, this is the one I would support.