11

Proposal: Security Review

As far as I can tell, this proposal essentially amounts to asking StackExchange citizens to perform a penetration test on live sites.

I can see several serious issues with this:

  • It may be difficult to verify that the OP is:
    1. The actual owner or representative of the site.
    2. Authorised to request a penetration test on behalf of whatever company runs the site.
    3. Authorised by the hosting company to perform a penetration test on the system(s).
  • I can see scopes being poorly defined, or ignored by less scrupulous users. Where's the line drawn on a web app test that results in code execution? What if shared hosting is being used?
  • Malicious persons may well use a request on the proposed site as an excuse to perform attacks, which would lead to sticky legal situations for both StackExchange and users.
  • Differing legal jurisdictions would cause a quagmire of potential issues. How can you ensure that people are staying above the law?

All in all, I don't think it's suitable for StackExchange.

2 Answers 2

Reset to default
9

Even if it is just code review, I am a bit puzzled as to where this proposal could possibly fit. Is it proposing that:

Individuals will send potentially vulnerable code to a public site

Community members will carry out the legal assessment to confirm it is from the correct source and not from a malicious attacker

The community will provide guidance on that code without any assessment of the environment within which it will be used

Just doesn't work for me.

1
  • 4
    Agreed. If it's plain code review, we already have Code Review and IT Security. Legal assessments are highly subjective and it's difficult to ensure correctness.
    – Polynomial
    Apr 19, 2013 at 14:22
8

If this proposal is designed to be a "come test my site for vulnerabilities", that's not the type of assistance our Q&A provides. But as far as code reviews for security issues go, we have a site for that:

https://codereview.stackexchange.com/questions/tagged/security

I don't see a need to create another code review Q&A specifically set apart from other issues covered by Code Review. Plus for any specific questions about the security of a procedure or mechanism, we have IT Security.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .