32
\$\begingroup\$

I recently asked a question that could possibly be used for malicious purposes. I tried to whittle the code down as much as I could to a "base" program so that a script kiddie wouldn't stumble across it and wreak havoc.

However, I have written other more "malicious" programs (for testing security mostly) where I will not be able to whittle out as much. An example of this would be a keylogger.

Do we have a policy on reviews for this? I would love to have my code reviewed, but at the same time I don't want to cause any trouble.

\$\endgroup\$
  • 3
    \$\begingroup\$ For reference purposes: Dealing with questions of nefarious intent. The Linked section of that question also leads to more discussion around this topic. \$\endgroup\$ – Bobby Feb 12 '14 at 14:23
  • \$\begingroup\$ This is a good question. I thought about writing some mildly humorous/malicious code to be reviewed here. I planned to post it on April Fool's Day. Not sure how good of an idea this is. \$\endgroup\$ – red_eight Feb 13 '14 at 15:38
  • 1
    \$\begingroup\$ There's also the question on Meta.SU about how to treat BitTorrent which is a pretty similar situation, though not the same. \$\endgroup\$ – Bobby Feb 14 '14 at 12:43
44
\$\begingroup\$

Code is not malicious (guns don't kill). It is the way that code is used that makes things a problem. I am certain that every piece of 'malicious' code has an 'angelic' corollary.

If code can be 'malicious' then computers are 'malicious', and operating systems are 'malicious', and networks are 'malicious', etc.

If I feel that the code in a particular question is going to be used for malicious purposes, I may decide to down-vote, flag, vote-to-close, whatever.... but, if there is no indication that the code is going to be used maliciously, then I have no reason to believe the code will be used for 'nefarious' purposes.

Personally, I have used crackers, root-kits, rainbow tables, keyloggers, etc. and all of them for 'good' (although I did feel a bit like 'Dr. Evil' when I did...)

Post your questions, if you want, you can state the purpose of the code.

Be warned though, that you will likely get some knee-jerk reactions, but that is what happens when things can be controversial.

\$\endgroup\$
  • 10
    \$\begingroup\$ -666 Inspiring evil. \$\endgroup\$ – David Harkness Feb 14 '14 at 5:23
  • \$\begingroup\$ I got a bit of a negative reaction from some folks just for asking about a port scanner. Still got some good reviews on it, and it was definitely worth asking. \$\endgroup\$ – asteri Feb 21 '14 at 20:50
  • \$\begingroup\$ Bullets kill people. I sleep with a gun under my pillow. It is loaded and the safety is off, but I feel secure because the gun has no bullets in it. Likewise, I write malicious code all the time without any protection switch that prevents it from invading my own computer. But, I feel secure because I never run it. \$\endgroup\$ – Jack Giffin May 6 '18 at 19:19
  • \$\begingroup\$ Rainbow tables? RAINBOW tables!?!? \$\endgroup\$ – FreezePhoenix Sep 4 '18 at 14:24
11
\$\begingroup\$

When in doubt, I always refer to the on-topic helpcenter. In this case, there is no notion about malicious code (and/or code which could be used in a malicious manner, for those who care about the difference).

One could also check the "What questions should I avoid asking?" page, where malicious code isn't listed either.

Now we've established your question is not off-topic, let's take a look at how good questions are formulated and what you're proposing:

I tried to whittle the code down as much as I could to a "base" program so that a script kiddie wouldn't stumble across it and wreck havoc.

Although I can understand your sentiment and agree with your intent, it's a problem on Code Review. We like context. A lot. Good context allows us to write good reviews. Great context allows us to write great reviews.

Please, don't refrain from telling us exactly what it's supposed to do. Extra benefit from this is it allows us to safely test your code without causing harm to our own computers and/or data, which might happen if you downplay the risks too much.

As @rolfl said, you may get some negative reactions. That's the risk of posting controversial questions. However, this community won't burn you on it. I totally expect the most of us will treat your question with respect.

\$\endgroup\$

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .