16

My specific case is on my answer here.

Is there any policy (on SuperUser or StackExchange) in either direction concerning providing an executable I uploaded myself for others to download? Of course, it is/must be relevant to the answer.

I would assume the main worry is malware, and therefore trust of the answerer (and how seriously the answerer takes security of their own computers). Obviously, it is entirely the user's choice whether to trust and download or not.

Does it make any difference if there is an alternative in the answer that does not require downloading the file (in this particular case, running/compiling the script yourself)?

This question also applies to other, non-executable downloads. We all know there are vulnerabilities in programs such as Microsoft Office that can be exploited through malicious documents.

  • @TomWijsman but aren't we already being "safe than sorry" from the legal policy made by Stack Exchange? – cp2141 Apr 16 '12 at 14:45
  • @cp2141: Correct, but I see nothing there that restricts us from doing more than that. – Tamara Wijsman Apr 16 '12 at 14:52
11

While its for linux, this is a good example of a question where the answer involves original code. Its a small program but the source code is available on a reliable host. The use of the software is clearly explained, as are the prerequisites for building it.

I'd think there's several criteria here.

  1. Is the chosen host one that avoids linkrot - putting files on github or sourceforge is better than shoving it on $randomfilelocker, as many megaupload users have found out

  2. Can the file be verified as being reliable? For example if you're linking DLLs from $random dll site, it may not be a good thing. If you can link a repair tool from MS, on the other hand, it would be better.

  3. Do you have permission to share the file, and does it comply with the current rules at SU and SE, explicit or otherwise? For example, we don't allow hackintosh questions - linking something like boot132, which is pretty much only for setting up hackintoshes would be bad, as would say, putting up an upload of some non trial, proprietary software.

  4. Do you provide a good, understandable writeup of what the file is for, and how it needs to be used?

  • Well, there's some cases where there may be dependencies or such, and i wanted to post as generic a answer as possible. – Journeyman Geek Apr 16 '12 at 12:49
  • @JourneymanGeek in that case, you need to ensure you follow all copyright requirements of redistribution. This has implications even for open-source software, and is disallowed with many commercial programs. – cp2141 Apr 16 '12 at 14:47
  • 1
    I am not sure why GitHub or Sourceforge is necessarily better than something like Megaupload. Neither of them are immune to US Government seizure. I do understand why you should not host it on your personal website. Even on StackOverflow, I have run into bad download links that are less than months old, caused by a person who rearranged or stopped maintaining their website. – user130039 Apr 24 '12 at 18:38
  • 2
    File lockers suck. In my case i'm behind ISP transparent proxy and it breaks most of them. You'll also have to wait an indeterminate amount of time, often to not actually get the download. On the other hand, i've never had issues with files off legitimate sourcecode and software hosts. – Journeyman Geek Apr 24 '12 at 23:46
6

Is there any policy (on SuperUser or StackExchange) in either direction concerning providing an executable I uploaded myself for others to download? Of course, it is/must be relevant to the answer.

Often, downloads are part of the solution to the problem. So long as you don't claim copyright to anything that's not yours, and provide links where appropriate, there are no issues.

I would assume the main worry is malware, and therefore trust of the answerer (and how seriously the answerer takes security of their own computers). Obviously, it is entirely the user's choice whether to trust and download or not.

The last sentence takes care of the prior. It's not our job to check what the end user does (unless you like the idea of "internet censorship"). This is the internet - use at your own risk. So long as nothing malicious is done on purpose (in which case, further action would be warranted), there are no issues.

Does it make any difference if there is an alternative in the answer that does not require downloading the file (in this particular case, running/compiling the script yourself)?

NO. This is Super User, not Stack Overflow. How many end users do you expect to actually read through source code and understand what it does before executing it? This poses the same risk as downloading a binary executable. Obviously, it's a lot safer to have the source code, so this is always recommended when posting - but remember who this website's main audience is.

This question also applies to other, non-executable downloads. We all know there are vulnerabilities in programs such as Microsoft Office that can be exploited through malicious documents.

Then this falls into every category listed above, including malware and source code. Any attempts at posting malicious files will most likely result in a timed suspension.


As per the terms of service, and my personal opinion, we should not "idiot proof" the website by placing black-box warnings near every seemingly suspicious download link - because indeed, who is to decide what is "suspicious"? Why is it our job, and not the end user, who will actually end up using (or not using) that particular file?

This is also supported by the Stack Exchange terms of service:

The Services, Content, Network and any Software are provided on an "as is" basis, without warranties of any kind, either express or implied, including, without limitation, implied warranties of merchantability, fitness for a particular purpose or non-infringement. Stack Exchange makes no representations or warranties of any kind with respect to the Network, the Services, including any representation or warranty that the use of the Network or Services will (a) be timely, uninterrupted or error-free or operate in combination with any other hardware, software, system or data, (b) meet your requirements or expectations, (c) be free from errors or that defects will be corrected, (d) be free of viruses or other harmful components.

TL,DR: This is the internet. Post what you want, man (or woman!). Any blatant attempts at spreading malicious software (or other files thereof) will certainly be met with administrative action. Report any malicious files if you come across them, by clicking on the flag link under the post.

  • Please note that source code could actually be scripts, which are on-topic on Super User. Warnings are merely during the period the download is checked or if it really has a malicious side to it, in most of the cases they are not necessarily needed. If there are users who want to deal with malicious files, it doesn't hurt to have them take a look opposed to having X computers infected and starting a new botnet... – Tamara Wijsman Apr 16 '12 at 13:32
  • @TomWijsman I never implied that source code was different than scripts, nor did I imply that source code was off topic. Furthermore, giving more warnings to users would actually go against the legal policy. Placing a warning would increase user reliance on having an explicit warning near each link, whereas simply leaving things "as-is" and placing the burden on the user is consistent with the legal policies as in-place. Placing any warning will increase the "burden of care" on the Super User community rather than those viewing the website. – Breakthrough Apr 16 '12 at 14:15
  • You did state that it was SO material, which is not always true. Since when are warnings going a part of the legal policy? Stuff in gray areas has to be elaborated upon what makes it legal and/or acceptable, if not a temporary warning is surely in place as well as eventual deletion of the content if necessary. You are turning the "as-is" words of the legal policy around to your own personal opinion, so I'm just going to ignore what you said about that. Or, if you really want an answer to that: Better to be safe, than to be sorry... – Tamara Wijsman Apr 16 '12 at 14:25
  • @TomWijsman I implied that SU members were less likely to actually read through the source code, as opposed to SO. As per the warnings, this website is based in the United States, where the whole "burden of proof" thing has been increasingly used in litigation. Applying alternative warnings gives end-users an "expectation" that warnings will appear near other "sensitive" links. This is one of the few cases where better safe than sorry is superseded by the in-place legal policies. – Breakthrough Apr 16 '12 at 14:28
  • 2
    As a follow-up, it is completely valid to flag malicious download links. My point is, there is no sense prepending download links with a warning, that is directly contradictory to the SU terms of service. Unless you can prove that said download link is malicious, why shift the burden of proof from the end user to SU? – Breakthrough Apr 16 '12 at 14:38
  • Scripts however, are of a different nature than source code thus the "less likely" part does not apply. The "burden of proof" does not apply either, given that it's a warning and not a statement and that actual inspection is done during the time the warning is there. The warning functions as an temporary indication that we are uncertain at that moment, and are inspecting the software. Soon after than warning gets replaced by either a comment or deletion that satisfies the commenters that were uncertain about whether it was malicious or not. – Tamara Wijsman Apr 16 '12 at 14:38
  • 4
    "Scripts however, are of a different nature than source code" False. Scripts are source code, and are still applied under the relevant copyright/intellectual property laws. And again: "The warning functions as an temporary indication that we are uncertain at that moment, and are inspecting the software." We are not the right people to be determining if software is "safe" or not, the end user is. This is what the legal framework says. By doing so, you are undermining the Stack Exchange legal policies. QED. – Breakthrough Apr 16 '12 at 14:42
  • For what it's worth, Tom, I'm enforcing my viewpoint because it's on my own answer. It's clear that you don't agree with anyone else's but your own, which is why your viewpoints have managed to make an appearance on every single answer here. I'm not trying to suppress your freedom of speech, do what you want. I'm trying to defend Stack Exchange from a legal standpoint, and not based on what you "think is right"... Unless, like you tried to place upon me, you can show me legal terms that tell me I am wrong :) – Breakthrough Apr 16 '12 at 14:55
  • @TomWijsman maybe that's because I never said "you are not allowed to place warnings". Stop reading between the lines, and stop acting like I'm repressing your freedom of speech or something. I said, from a legal standpoint, it's a terrible idea to undermine the website's terms of service, as there is a more than adequate legal framework in place, presumably drafted by lawyers who know much more about the United States legal system than you or I ever will. You can do whatever you want - even if it's a bad idea. I'm providing guidance - nothing more, nothing less. – Breakthrough Apr 16 '12 at 15:00
  • You did say giving more warnings to users would actually go against the legal policy and I see nothing in place that tells me that this is true or that this is a bad idea, hence this is why I asked you to elaborate. I see that comment as a false reply to my first comment (and thus this whole comment thread as you talking around it in a circle) if you do not proof that single statement... – Tamara Wijsman Apr 16 '12 at 15:01
  • Discussion moved to chat: chat.stackexchange.com/rooms/3126/… – Breakthrough Apr 16 '12 at 15:17
  • Breakthrough was uwilling to elaborate on that sentence, and hence it does not hold because I am not associated with Stack Exchange. Other than that he was just enumerating what he thinks I should(n't) do. And honestly, I don't care as I'd rather choose to follow the guidelines and policies of SE... – Tamara Wijsman Apr 16 '12 at 15:55
  • Sorry to all for keeping this going, but Tom likes to blatantly undermine my opinion while pushing his, so I'll finish this with what my point of this is. Breakthrough: "Do you feel that we should, as members of the community, promote guidelines and policies consistent with the Stack Exchange legal framework?" Tom: "Yes, I feel so [...]" – Breakthrough Apr 16 '12 at 16:06
  • 1
    And you are doing the exact same and I don't care, note that duty calls and let the people vote... – Tamara Wijsman Apr 16 '12 at 16:13
3

I think the most important thing is:

  • Explain what the file does. Most importantly, explain how it solves the problem stated in the question.
  • Provide documentation of where the file came from and how to use it.
  • Provide the source code, if possible. This enables peer review.

If none of these are the case, it's possible your answer is flagged for deletion. We generally review late answers or answers by new users, and anything suspicious gets removed quite efficiently.

If you're a regular user, your answer won't land in a review queue. Your duty should be to provide an useful answer that doesn't only consist of "Here file, you download".

  • Care to explain the down vote anyone? – slhck Apr 16 '12 at 10:44
  • @Tom I really don't necessarily agree with the whole "learning" thing here. We're not talking about the questions here, but the usefulness of answers. In some cases, there's no learning involved. – slhck Apr 16 '12 at 10:50
  • That's where the difference between completing a task and solving a problem comes from, in the former case you're just doing their effort and in the latter case learning is usually involved. There's a difference between solely giving dir /ah and also mentioning that dir /? gives more information about that, in the first case they would ask a new question if they need another filter and in the second they learned how the command was obtained... – Tamara Wijsman Apr 16 '12 at 11:12
  • Yeah, but there are situations where there's no learning involved, and it doesn't even have to be, but this is not the major part of the discussion. We're focusing on answers. We all know what "good" answers are and that they explain context apart from just adding a link. This whole "task vs. problem" thing … please just raise your own Meta discussion about it if you want to. I don't see what's constructive about talking about the question's merits here. (In your dir case, of course that should be mentioned. No one objects.) – slhck Apr 16 '12 at 11:19
  • I have no examples here at the moment, but let's say you create a small GUI program that does whatever the heck the OP wanted to do — so it's definitely useful. Regardless of the question being about "solving a task" or being stuck not even knowing where to start. But if that program consists of hundreds of lines of code, then there's no need to explain what they all do. The usefulness in that answer stems from the fact that it solves whatever problem the OP had. Of course, explaining the basic concepts behind the solution is always important, so the OP can see for themselves. – slhck Apr 16 '12 at 11:42
1

Note that this post explains my personal viewpoint, as per the tag.

TL;DR: If we come across obvious malicious executable's some of us temporarily leave a warning and inspect it. Make sure that the OP learns from your answer, such that he can repeat the process that was done to obtain the answer or at least know what's it based upon. The SE network is about learning through solving problems and not about doing their job. That's as much as I can do, the rest depends on the user which should be rather safe than sorry...

Also note that my answer reflects answers, not questions like in my previous meta discussion.

It's encouraged to provide a script if you can, letting the OP do some effort and learn from executing your answer. If he downloads the executable he is just lazy, as a result he won't learn anything from it and will ask a new scripting question next time; rinse and repeat. If he instead learns how the script was made and gets compiled, he might be on his road learning how to script while getting his solution. It's a win-win situation to let him do it himself, instead of doing it for him and wasting your time...


What I (and others do when we pass along executables:

Warning: This post contains an executable file. As some people are uncertain whether it contains malicious code you download this file at your own risk as per the legal terms, Super User is not responsible for any harm this file could do to your computer. Some users will however inspect it and comment with the results to conclude whether it performs expected behavior or malicious behavior.

Many users are reviewing answers, including those posted by new users, but also regulars.

When there's doubt about the origin of the file, we usually edit in a warning somewhat like the above one, then we run the file through some stuff in a virtual machine to get an idea what the file really does.

For example, we once had a packed executable that's not only packed once, but multiple times, at the deepest level (4 or 5 times). It became clear that this was hiding malicious code and hence we removed the link. In fact, the user posting the answer even claimed that one needed to disable any anti virus software to get the executable to run.

Even more so, the programmer was dumb enough to use University's computers to develop his software. So, if we went further on that one we could have eventually traced it back to the author...


To summarize, it's best to warn users until it is clear whether it is clean or not, at least for executable files. These posts are often obvious given that they are not trying to solve the OP's problem, but rather trying to get you to download the file and execute it.

And well, sometimes it does happen that someone goes around and do that, then the whole lesson is:

Virus scanners, back-up software, updates and other security measures exist; better safe than sorry.

  • I basically agree, but the first paragraph is obviously not applicable to anything that goes beyond scripting. It's not really constructive to post 1.5k LOC here on Super User just to have people compile code themselves (they might not even have Visual Studio, Xcode or gcc installed). In that case, it might be worth uploading the source code somewhere for others to review, if possible. – slhck Apr 15 '12 at 20:27
  • @slhck: That's covered under doing some effort, nobody is or should be going to answer that amount of code here. We're here to solve problems, not complete people's tasks... – Tamara Wijsman Apr 15 '12 at 20:42
  • 3
    This topic is not about questions, but answers. If someone provides something like this in an answer, it's not your job to tell him he's doing it wrong and the asker doesn't deserve the effort. As such, your rant at the beginning is not relevant to this discussion, as another's motivation might be different from yours. He might be able to use it himself, or use the question as an exercise. – Daniel Beck Apr 16 '12 at 7:56
  • I said none of that, you're drawing wrong conclusions. Discussions are about sharing different viewpoints, disliking mine doesn't mean it is rant. Similarly, seeing questions as exercises is your viewpoint; I'd rather solve problems instead. Our network is about learning, not about doing their job... – Tamara Wijsman Apr 16 '12 at 14:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .