11
\$\begingroup\$

Not sure how to phrase the title as there are two large concerns with what I am thinking of doing for the review of this question:

Batch script to make folders hidden

It is largely a batch script with some PowerShell in the mix. The latter of which I am more familiar with.

Main issue that I have with the code is that it is implementing a security though obscurity approach. There is no sentiment to this effect so I am not sure whether or not this code is for fun or to be taken seriously.

Also, since the OP is using PowerShell there is, in theory, some familiarity with the language. PowerShell can do the same thing that this code is doing and it would be likely shorter and definitely cleaner and easier to understand.

My two questions based on that are:

  1. How well received would suggestions be to use another language, in this case PowerShell? I don't mean in this case specifically but have there been other occasions where this has happened where the answerer is a different language? Is it considered a bad practice on CodeReview.
  2. The whole concept of this code would do very little to provide security other than to fool the most basic of users. Could a review be based on "Don't bother doing this". I'm sure I could make the process a little better but it relies on a password being stored somewhere at a basic level without overly complicating the entire process.

I intend to leave a comment or two to this effect but I am looking for guidance as I am sure these things have happened before.

\$\endgroup\$
17
\$\begingroup\$

I personally believe questions can be answered in such a way. That's because one of the main rules in security is "Don't roll your own".

Examples:

To answer your questions:

How well received would suggestions be to use another language, in this case PowerShell?

Don't. However, in this case PowerShell is already used. So in how far is it actually recommending another language? If two languages are used and it's safer to do it in only one of those, that's a valid review.

Could a review be based on "Don't bother doing this".

Yes, given enough explanation and/or a better method to fix the problem indicated by OP. It sounds like there's a design problem at hand and there's nothing wrong with raising this issue.

\$\endgroup\$
  • 1
    \$\begingroup\$ On another note, Information Security usually has some good questions and answers about the do's and don'ts for obfuscation. \$\endgroup\$ – Mast Apr 3 '16 at 19:35
  • \$\begingroup\$ I chose this approach (Others were similar in sentiment). I also did not rewrite the code and just gave some good starting points if the OP considered looking at PowerShell in general. Writing the OPs code in PowerShell would not change the security issues in review so I didn't bother. Thanks. \$\endgroup\$ – Matt Apr 11 '16 at 12:40
8
\$\begingroup\$

Also, since the OP is using PowerShell there is, in theory, some familiarity with the language. PowerShell can do the same thing that this code is doing and it would be likely shorter and definitely cleaner and easier to understand.

There are a bunch of answer that boils down to: "use this builtin/existing function instead" (picking one at random) which are completely valid reviews.

Unless the question is tagged feel free to propose existing alternatives as long as you provide a bit of context about the why.

\$\endgroup\$
6
\$\begingroup\$

How well received would suggestions be to use another language, in this case PowerShell? I don't mean in this case specifically but have there been other occasions where this has happened where the answerer is a different language? Is it considered a bad practice on CodeReview.

@Mast's answer addresses the specific. I figured the general answer to recommending other languages as an answer would be useful.

In general, these answers are not well received. Even in the case of Objective-C/Swift, where you can quite easily interop the languages within a project (they compile into the same binary file even), these answers wouldn't be well received.

And honestly, at the end of the day, why should they be well received? We review more than just measurable things at Code Review. Improving the readability of code is the topic of several Code Review answers. And it's important that code be readable. Posting a complete reimplementation in an entirely different programming language is something I'd consider wholly unacceptable in a Code Review answer and would cast a downvote.

With that said, I would happily upvote a comment on the question which suggested that it would be better to implement in a different language with some links to why it's important it be implemented in the alternative language.

\$\endgroup\$
  • 2
    \$\begingroup\$ I think also it would be acceptable to review the code AND suggest a different way. For instance if there was a VBA question that could be done better with regex, one could review the code and then review the method. \$\endgroup\$ – Raystafarian Apr 6 '16 at 15:45
  • \$\begingroup\$ Hmm... You may be right in the general case, but I could see an argument for "Batch was superseded by vbscript ages ago, which was itself superseded by powershell about a decade ago. It would be better to move to a modern technology." That's a valid review IMO. Certainly one I can easily imagine happening around my office. \$\endgroup\$ – RubberDuck Apr 15 '16 at 9:54
5
\$\begingroup\$

I am a firm believer in the "you're doing it wrong" answer. In fact, I'd like to see more of these types of answers on Code Review because if a solution suffers from some pretty core problems, no amount of shuffling code around and applying naming conventions is going to really have an effect on overall code quality.

When writing a "you're doing it wrong" post I try to accompany it with an explanation or example of how it could be done differently. I try to provide code examples if possible, but sometimes rewriting the code can be too complex, or can involve making assumptions or "fixing" different aspects of the code that aren't central to the main problem(s). In those cases I try to provide a conceptual (but hopefully concrete enough) explanation without code. Whether that's appreciated or not I think depends on the asker of the question.

\$\endgroup\$

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .