8
\$\begingroup\$

On a related thread to this question, what steps can one take to avoid executing obfuscated malicious code (in the unlikely case someone sees fit to post some in a solution.

Is it best to just avoid testing code we don't understand?

\$\endgroup\$
9
\$\begingroup\$

On the one hand, it probably is. Though some languages can be sandboxed, and you can test arbitrary programs if the sandbox is set up right, those languages are few and far in between, and security is a question of the "weakest link".

On the other hand, it may not be necessary. Posting malicious code violates section 3(e) of the terms of service, and moderators have the right to take adverse action against such users. Users (especially high-rep ones) usually do not want to jeopardise their hard-earned rep by engaging in such dubious actions.

\$\endgroup\$
  • 11
    \$\begingroup\$ "All my data's gone but he violated the TOS, boy is he screwed now!" \$\endgroup\$ – Nick T Feb 3 '11 at 15:04
  • \$\begingroup\$ @Nick: I still maintain that some caution is wise. Indeed, my post did say so. I just think that it doesn't have to be a war zone. \$\endgroup\$ – Chris Jester-Young Feb 3 '11 at 15:32
  • \$\begingroup\$ @NickT jokes on you. He had his fingers crossed when checked the "I agree" button. \$\endgroup\$ – PyRulez Jun 28 '17 at 1:21
5
\$\begingroup\$

I think the community will handle this. Its a non-issue.

If I saw malicious, or potentially malicious code I would:

  • vote it down
  • add a comment in all caps
  • flag it.

(order might vary).

\$\endgroup\$
  • \$\begingroup\$ That would still harm your computer! :-( \$\endgroup\$ – Metoniem Feb 28 '17 at 23:40
  • \$\begingroup\$ @Metoniem, I think the point of this answer is that someone on this site will be able to recognize the code for what it is (malicious) without actually running it. So if you're not sure, don't run it yourself — especially if it's a new answer and/or one with no upvotes yet. \$\endgroup\$ – Wildcard Jan 16 '18 at 5:33
5
\$\begingroup\$

One option is to run everything from this site in a sandbox. Here are some already available on the internet.

\$\endgroup\$
  • \$\begingroup\$ I think this is the best solution. The are sandbox sites for many languages. In many cases it is easier to copy paste a solution into a text box and hit Run. \$\endgroup\$ – Casey Apr 29 '11 at 1:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .