14
\$\begingroup\$

Recently I have seen a whole lot of questions in the form of "How secure is this hashing", "How secure is my keygen?", "How secure is my form?".

We do have a quite popular tag, with 159 questions as of this moment.

Now I am starting to wonder:

At which point should questions be asked on Information Security rather than here? What is the difference between Code Review and Information Security when it comes to... well... security-questions?

\$\endgroup\$
  • 1
    \$\begingroup\$ You should make sure those questions are tagged correctly (with [security], [cryptography] etc.). I regularly look for crypto questions, but will miss them when they're not tagged with [cryptography]. \$\endgroup\$ – CodesInChaos Feb 28 '14 at 14:59
15
\$\begingroup\$

I think the distinction between Code Review and Information Security is:

  • At Code Review you should post your code and describe your specification, and then we will do our best to tell you if the former fails to implement the latter. We will point out security holes if we spot them, but they are just one kind of issue among many, so they are not our sole or even primary focus.
  • At Information Security you should post your specification (and not, usually, your code), and they will do their best to tell you if it has security holes.

Of course, at both sites it helps if you make your specification (and code) as good as you possibly can before asking, and ask clear, self-contained questions.

\$\endgroup\$
  • \$\begingroup\$ Case in point \$\endgroup\$ – 200_success Feb 18 '14 at 6:30
  • 4
    \$\begingroup\$ Yes, that's a good example. At Code Review we are likely to spot code injection vulnerabilities, buffer overflows, and other simple security holes. But don't ask us whether you should encrypt-then-sign or sign-then-encrypt! \$\endgroup\$ – Gareth Rees Feb 18 '14 at 9:50
  • \$\begingroup\$ Another fruitful security question that falls squarely in Code Review territory. \$\endgroup\$ – 200_success Mar 4 '14 at 1:12
9
\$\begingroup\$

Personally, I would never make recommendations on best-practices for security related questions. I may offer suggestions on the code style, and other items, but never pass opinion on whether the code is secure enough.

I have no problem reviewing the code, but have a problem reviewing the math/cryptography/algorithm. Those require an expert, and I am not one.

For the same reason, I would hesitate to ask questions on InfoSec either... If I want arm-chair commentary on my security then I may as well ask my kids. But my kids can still tell me if I have a fat ass.... ;-)

So, from what I can tell, the difference between CR and InfoSec is:

  • CR can tell you whether your security-related code has a fat ass.
  • InfoSec can tell you whether that code is, in fact, an ass, (and even then, only with armchair certainty).

If I want to know if I have an ass, I go to infosec. If I want to know whether that thing I call an ass is fat, I ask on CR.

\$\endgroup\$
  • \$\begingroup\$ While I enjoy your ass-analogy, I don't think that it really helps in clearing the differences of the sites... \$\endgroup\$ – Simon Forsberg Feb 17 '14 at 20:24
  • 2
    \$\begingroup\$ @SimonAndréForsberg It's a reference to this answer which allegedly explains the difference between Code Review and Stack Overflow: I think it's saying that Code Review is for cosmetic issues. \$\endgroup\$ – ChrisW Feb 17 '14 at 22:36
4
\$\begingroup\$

Proper tagging is important. If the question is about security, add and if involves crypto add . Else those who can review the question might miss it.

Personally I follow , but there is a bunch of crypto related questions on this site missing this tag.

\$\endgroup\$
  • \$\begingroup\$ Edit them in!!! \$\endgroup\$ – Malachi Mar 14 '14 at 18:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .