14
\$\begingroup\$

Recently I have seen a whole lot of questions in the form of "How secure is this hashing", "How secure is my keygen?", "How secure is my form?".

We do have a quite popular tag, with 159 questions as of this moment.

Now I am starting to wonder:

At which point should questions be asked on Information Security rather than here? What is the difference between Code Review and Information Security when it comes to... well... security-questions?

\$\endgroup\$
1
  • 1
    \$\begingroup\$ You should make sure those questions are tagged correctly (with [security], [cryptography] etc.). I regularly look for crypto questions, but will miss them when they're not tagged with [cryptography]. \$\endgroup\$
    – CodesInChaos
    Feb 28, 2014 at 14:59

3 Answers 3

Reset to default
15
\$\begingroup\$

I think the distinction between Code Review and Information Security is:

  • At Code Review you should post your code and describe your specification, and then we will do our best to tell you if the former fails to implement the latter. We will point out security holes if we spot them, but they are just one kind of issue among many, so they are not our sole or even primary focus.
  • At Information Security you should post your specification (and not, usually, your code), and they will do their best to tell you if it has security holes.

Of course, at both sites it helps if you make your specification (and code) as good as you possibly can before asking, and ask clear, self-contained questions.

\$\endgroup\$
3
  • \$\begingroup\$ Case in point \$\endgroup\$
    – 200_success
    Feb 18, 2014 at 6:30
  • 4
    \$\begingroup\$ Yes, that's a good example. At Code Review we are likely to spot code injection vulnerabilities, buffer overflows, and other simple security holes. But don't ask us whether you should encrypt-then-sign or sign-then-encrypt! \$\endgroup\$
    – Gareth Rees
    Feb 18, 2014 at 9:50
  • \$\begingroup\$ Another fruitful security question that falls squarely in Code Review territory. \$\endgroup\$
    – 200_success
    Mar 4, 2014 at 1:12
9
\$\begingroup\$

Personally, I would never make recommendations on best-practices for security related questions. I may offer suggestions on the code style, and other items, but never pass opinion on whether the code is secure enough.

I have no problem reviewing the code, but have a problem reviewing the math/cryptography/algorithm. Those require an expert, and I am not one.

For the same reason, I would hesitate to ask questions on InfoSec either... If I want arm-chair commentary on my security then I may as well ask my kids. But my kids can still tell me if I have a fat ass.... ;-)

So, from what I can tell, the difference between CR and InfoSec is:

  • CR can tell you whether your security-related code has a fat ass.
  • InfoSec can tell you whether that code is, in fact, an ass, (and even then, only with armchair certainty).

If I want to know if I have an ass, I go to infosec. If I want to know whether that thing I call an ass is fat, I ask on CR.

\$\endgroup\$
2
  • 1
    \$\begingroup\$ While I enjoy your ass-analogy, I don't think that it really helps in clearing the differences of the sites... \$\endgroup\$
    – Simon Forsberg
    Feb 17, 2014 at 20:24
  • 2
    \$\begingroup\$ @SimonAndréForsberg It's a reference to this answer which allegedly explains the difference between Code Review and Stack Overflow: I think it's saying that Code Review is for cosmetic issues. \$\endgroup\$
    – ChrisW
    Feb 17, 2014 at 22:36
4
\$\begingroup\$

Proper tagging is important. If the question is about security, add and if involves crypto add . Else those who can review the question might miss it.

Personally I follow , but there is a bunch of crypto related questions on this site missing this tag.

\$\endgroup\$
1
  • \$\begingroup\$ Edit them in!!! \$\endgroup\$
    – Malachi Mod
    Mar 14, 2014 at 18:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .