This has been discussed before about 2 years ago: “How secure…” questions - Code Review vs. Information Security SE but it doesn't appear to have led to anything very conclusive.
1. Is it truly on-topic?
I'm going to quote a recent example:
I just wanted to know if you guys thought if this code was cryptographically secure and also if I could speed it up a little.
Worded like this, it is probably fine. But imagine if you took out "and also if I could speed it up a little", would that then become an issue of "Do I want feedback about any or all facets of the code?"?
For example see this question
[…] since I'm no expert in cryptography (I know the maths behind RSA but thats about it) I have no idea whether this is secure or not. […]
The code works as expected. My questions:
Is this a correct way to use this module?
Is this secure?
It is not indicated that the author had the intention to get reviews on anything except the security. Should that (and others like such) have been closed?
2. Is the Help Center too vague on what is a "security issue" in the scope of a code review?
Quoting the Help Center -> On-topic page (emphasis mine):
If you are looking for feedback on a specific working piece of code from your project in the following areas…
- Best practices and design pattern usage
- Security issues
- Correctness in unanticipated cases
I think that "Security issues" is too broad of a brush, as it is encapsulating an entire domain of computer science with many researchers and professionals, along with what are some common and relatively simple security holes that can usually be spotted during the course of a code review (SQL injection, XSS attacks, etc.). I'm going to quote an answer by Gareth Rees to the above question:
I'm afraid that your second question ("Is this secure?") is one that you're not likely to get a good answer on here at Code Review. What you seem to be trying to do here is to design a cryptographic protocol, and cryptanalysis requires very specific expertise that I don't think any of the regulars here possess. I certainly don't. Also, to comment on the security of a protocol we have to see the whole protocol.
Sub-questions on point 2:
- Are we setting unrealistic expectations for newcomers that this is the correct site to address any and all security & cryptography issues, as long as it is expressed as reviewable code?
- Should we clarify the Help Center page to limit the scope of what constitues a "Security issue" that can reasonably be addressed in the course of routine reviews? Perhaps provide a link to IT Security's on-topic page?
3. Should we, in certain cases, recommend IT Security Q&A?
Keeping in mind the spirit of "on-topic on other site Y does not make it off-topic on original site X", would in be adviseable in certain cases (in particular where questions fall into what I mentioned in point 1), would it be beneficial both to OPs and to Code Review in general to encourage asking questions there instead of (or in addition to) Code Review, if the question can be reformulated to be on-topic there, i.e., less about the code itself and more about protocols, infrastructutres, tools, etc. relating to information security?
For reference quoting IT Security's on-topic page:
What topics can I ask about here?
IT Security Stack Exchange is for Information Security professionals to discuss protecting assets from threats and vulnerabilities. Topics include, but are not limited to:
- web app hardening
- network security
- social engineering, including phishing
- risk management
- penetration testing
- security tools
- using cryptography
- incident response
- physically securing the office, datacentre, information assets etc.