33
\$\begingroup\$

I recently asked a question that could possibly be used for malicious purposes. I tried to whittle the code down as much as I could to a "base" program so that a script kiddie wouldn't stumble across it and wreak havoc.

However, I have written other more "malicious" programs (for testing security mostly) where I will not be able to whittle out as much. An example of this would be a keylogger.

Do we have a policy on reviews for this? I would love to have my code reviewed, but at the same time I don't want to cause any trouble.

\$\endgroup\$
  • 5
    \$\begingroup\$ For reference purposes: Dealing with questions of nefarious intent. The Linked section of that question also leads to more discussion around this topic. \$\endgroup\$ – Bobby Feb 12 '14 at 14:23
  • \$\begingroup\$ This is a good question. I thought about writing some mildly humorous/malicious code to be reviewed here. I planned to post it on April Fool's Day. Not sure how good of an idea this is. \$\endgroup\$ – red_eight Feb 13 '14 at 15:38
  • 1
    \$\begingroup\$ There's also the question on Meta.SU about how to treat BitTorrent which is a pretty similar situation, though not the same. \$\endgroup\$ – Bobby Feb 14 '14 at 12:43
46
\$\begingroup\$

Code is not malicious (guns don't kill). It is the way that code is used that makes things a problem. I am certain that every piece of 'malicious' code has an 'angelic' corollary.

If code can be 'malicious' then computers are 'malicious', and operating systems are 'malicious', and networks are 'malicious', etc.

If I feel that the code in a particular question is going to be used for malicious purposes, I may decide to down-vote, flag, vote-to-close, whatever.... but, if there is no indication that the code is going to be used maliciously, then I have no reason to believe the code will be used for 'nefarious' purposes.

Personally, I have used crackers, root-kits, rainbow tables, keyloggers, etc. and all of them for 'good' (although I did feel a bit like 'Dr. Evil' when I did...)

Post your questions, if you want, you can state the purpose of the code.

Be warned though, that you will likely get some knee-jerk reactions, but that is what happens when things can be controversial.

\$\endgroup\$
  • 12
    \$\begingroup\$ -666 Inspiring evil. \$\endgroup\$ – David Harkness Feb 14 '14 at 5:23
  • \$\begingroup\$ I got a bit of a negative reaction from some folks just for asking about a port scanner. Still got some good reviews on it, and it was definitely worth asking. \$\endgroup\$ – asteri Feb 21 '14 at 20:50
  • \$\begingroup\$ Bullets kill people. I sleep with a gun under my pillow. It is loaded and the safety is off, but I feel secure because the gun has no bullets in it. Likewise, I write malicious code all the time without any protection switch that prevents it from invading my own computer. But, I feel secure because I never run it. \$\endgroup\$ – Jack Giffin May 6 '18 at 19:19
  • \$\begingroup\$ Rainbow tables? RAINBOW tables!?!? \$\endgroup\$ – FreezePhoenix Sep 4 '18 at 14:24
12
\$\begingroup\$

When in doubt, I always refer to the on-topic helpcenter. In this case, there is no notion about malicious code (and/or code which could be used in a malicious manner, for those who care about the difference).

One could also check the "What questions should I avoid asking?" page, where malicious code isn't listed either.

Now we've established your question is not off-topic, let's take a look at how good questions are formulated and what you're proposing:

I tried to whittle the code down as much as I could to a "base" program so that a script kiddie wouldn't stumble across it and wreck havoc.

Although I can understand your sentiment and agree with your intent, it's a problem on Code Review. We like context. A lot. Good context allows us to write good reviews. Great context allows us to write great reviews.

Please, don't refrain from telling us exactly what it's supposed to do. Extra benefit from this is it allows us to safely test your code without causing harm to our own computers and/or data, which might happen if you downplay the risks too much.

As @rolfl said, you may get some negative reactions. That's the risk of posting controversial questions. However, this community won't burn you on it. I totally expect the most of us will treat your question with respect.

\$\endgroup\$
-3
\$\begingroup\$

I enjoyed reading http://meta.stackexchange.com/questions/3528/dealing-with-questions-of-nefarious-intent - there's a lot of important nuance there that hasn't really been mirrored here in CR meta, so despite this question being already answered I need to add my two cents.

Saying "code is not malicious, guns don't kill" is a non-argument. As practitioners, we cannot absolve ourselves of the things we do and the things we teach. Code doesn't exist without humans, and increasingly humans don't live without code. Decisions in our field must be made with ethics in mind.

The other argument, that malware and security software are in an eternal arms race - and that laying open the information already available isn't harmful - is more credible. After weighing the arguments, this is the one I would support.

\$\endgroup\$
  • \$\begingroup\$ Just out of curiosity: Was this post in any way influenced by the captcha question? (Question has since been removed) \$\endgroup\$ – Linny Sep 20 at 4:48
  • \$\begingroup\$ Nevermind, I just saw your meta post \$\endgroup\$ – Linny Sep 20 at 4:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .