8

The Drupal project encourages security researchers to follow responsible disclosure and this usually works. Sometimes, though, people will post a security issue to the support forum or the public issue queue or whatever. Now that Drupal.SE exists people post questions or vulnerabilities here, sometimes, which is not ideal.

  1. It seems like we can get drupal.SE site admins to 'delete' a post which puts it into a hidden place for a while. That seems OK. Tim Plunkett has offered to do this if there are posts which disclose a security vulnerability. Is deleting the right thing? Is there some way to ask all drupal.SE admins to temporarily delete a post so I don't have to find Tim specifically?
  2. It would be awesome if the stackexchange site could say "It looks like this question might be a security issue, consider if you should report it following the process as http://drupal.org/node/101494"
12
  • 1
    Just FYI: meta.stackexchange.com/questions/131039/…
    – Clive Mod
    May 2, 2012 at 9:20
  • Sorry again if that post on meta.SO caused offence, that really wasn't the intention; I know how seriously you guys take security bug reports :) For what it's worth I'd love to live in a world where we could have a tight integration between drupal.org and drupal.SE (it would make this kind of thing a non-issue) but it probably wasn't meant to be...
    – Clive Mod
    May 2, 2012 at 17:33
  • @Clive It would have been better to keep the discussion on this very site. I don't know what the position of Stack Overflow about bugs reports is, but on Drupal Answers questions that are about a module bug, or work-around for module bugs are considered off-topic as per faq.
    – apaderno Mod
    May 2, 2012 at 20:44
  • 1
    @kiamlaluno I asked on meta.SO because it's (currently) the place to ask about questions relating to all SE sites in general, not just SO. My concern was with questions being deleted without going through the normal close procedures, and I wanted to see what the general SE community thoughts were. I can think of edge cases where a security hole might be uncovered in a question that wasn't intended to be a bug report...I might not have explained it well enough in the question but that's what I was mostly interested in
    – Clive Mod
    May 2, 2012 at 21:07
  • @Clive The question you accepted was given from a Stack Overflow moderator, who probably don't know what questions are considered off-topic, on DA. The most up-voted answer is the one given from a moderator in two different sites. There isn't an answer given from a Community Coordinator, but it seems the answer accepted from the community is the one that saying that it's the DA community that should decide.
    – apaderno Mod
    May 3, 2012 at 2:38
  • @kiamlaluno Fair point, as it happens I've actually accepted that other answer now anyway.
    – Clive Mod
    May 3, 2012 at 9:37
  • 3
    As a mod on security stack exchange, I have added an answer there, as I think casper maybe doesn't have the right background/experience in this field: meta.stackexchange.com/a/131171/154443
    – Rory Alsop
    May 3, 2012 at 9:56
  • @RoryAlsop Actually, I do have the right background in this field. No, that field isn't security, it's about Stack Exchange. I have more than enough experience in that field, thank you.
    – casperOne
    May 3, 2012 at 14:14
  • I opened a feature request for adding the text to the "How to Ask" block, as I described in my answer.
    – apaderno Mod
    May 3, 2012 at 14:46
  • 3
    @casperOne - I think you may have been wilfully misunderstanding my point. We do have an ethical responsibility to do this properly, and I feel there are solutions (which can delay the post becoming public) that do not adversely hinder SE while still respecting the security of users.
    – Rory Alsop
    May 3, 2012 at 15:26
  • @RoryAlsop Yes, I have, but that's part of the point I'm trying to make. As a community, you can decide to do this, but I feel there's a severe lack of thought going into the fact that it can have massive ramifications on the rest of the Stack Exchange sites. Also, has anyone given thought to the fact that these things aren't truly deleted? That 10K users can still see the information? High rep != trust. Finally, I disagree with your assertion that we have an ethical responsibility.
    – casperOne
    May 3, 2012 at 15:48
  • @casperOne Still much better than nothing, given it is supposed to be temporary.
    – Yuhong Bao
    Jun 16, 2012 at 5:28

3 Answers 3

Reset to default
4

Is there some way to ask all drupal.SE admins to temporarily delete a post so I don't have to find Tim specifically?

Yes, there is. Just flag the post for moderation attention, and report exactly the reason for flagging the post.

screenshot

There would be just a problem when the question is undeleted, but in that case you should

  • Flag one of the posts written from the same user, and using the custom reason, explain that the previously deleted question can be undeleted.
  • Contact one of the moderators using their Drupal.org contact form.
  • Open an issue report here, although this is not preferable, as it would create too localized questions.

It would be awesome if the stackexchange site could say "It looks like this question might be a security issue, consider if you should report it following the process as http://drupal.org/node/101494"

I can add a sentence about security issues on the FAQ, and ask that similar information is added to the block visible to who asks new questions.

screenshot

I can also add a specific question between the ones tagged on this very site about the same topic, and the procedure followed in these cases. This doesn't assure the users would stop to report security issues here, but it can help. The questions still need somebody who verifies the topic is not about possible security issue, but we have the full community of Drupal Answers that can help with this.

Is deleting the right thing?

We have a procedure to follow, in the case a user posts sensitive data, and that procedure includes deleting the post. That is a procedure that is required from the user who posted such data, not from a third person.
On Meta Stack Overflow, I found I need to remove a question with sensitive data? which is the closer question I could find on Meta Stack Overflow.

I have been notified that I cannot post this information anywhere online and I need this question to be taken down. I have edited the specific information out of it, but the revisions would hold the information.

While the question has been asked from the user who posted the question on a Stack Exchange site, the accepted answer given to that question is the following:

Use the "Request Moderation Attention" flag option and explain your situation. (I have done this for you already.)

Another answer says:

After reading Remove a page or site from Google's search results I saw that it was possible to ask google to delete a page from its index faster than usual:

The URL removal tool is designed for URLs that urgently need to be removed, such as URLs that accidentally expose confidential data. If you recently made changes to your site, Google's crawlers will see this when re-crawling URLs, and any outdated pages will naturally drop out of our search results over time. There's no need to request an urgent removal.

I then went to the URL removal tool and filled a request on your behalf. Since the page has already been taken down (returns a 404 code) anyone can request an urgent removal. Its status is currently "Pending".

EDIT: I checked it and it shows up as "Removed".

As on Drupal Answers questions about bugs are off-topic, a question about a security issue discovered on Drupal (or any project hosted on Drupal.org) should be considered off-topic, and closed; once it gets closed, it can be deleted (which happens to any question that is blatantly off-topic, not constructive, or not a real question).

10
  • 1
    Seems like a great solution, kiam! Thanks for your help :) For the sidebar, that seems like the best we can do so I suggest going ahead with it. After all, that's the same kind of thing we do on drupal.org...
    – greggles
    May 2, 2012 at 14:31
  • @kiamlaluno Have you been following the discussion on meta? casperOne has suggested this is something that moderators shouldn't be doing. I'd be interested to know what you think
    – Clive Mod
    May 2, 2012 at 15:00
  • 1
    @Clive I still have to answer to, "Is deleting the right thing?" So far, I have answered to the part about how to report a problem with a post without having to catch a moderator on a chat room. I will soon complete my answer. The part about adding a note in the "How to Ask" block is still valid, thought. That doesn't block a user from asking a question about a security issue, but it redirects the user to the right place.
    – apaderno Mod
    May 2, 2012 at 15:11
  • @kiamlaluno That makes sense, cheers. I've seen a fair few opinions on the subject of "is deleting the right thing?" today; I know you're a veteran of the SE/Meta sites, so I'm very interested to hear your take on it...especially as you're involved with the Drupal.org side of things as well :)
    – Clive Mod
    May 2, 2012 at 15:17
  • 1
    Something that I haven't seen discussed: what if the question shows a security bug, but the answers provide a way to fortify your codebase before the Drupal community can fix it and put it in their distributions? To not keep that content up would be doing a tremendous disservice.
    – casperOne
    May 4, 2012 at 14:12
  • @casperOne On Drupal Answers, bug reports are considered off-topic; the channel to report bugs is the issue queue for the module, or for Drupal. if you have an improvement for Drupal, you should propose it on its issue queue, as the official distribution is one used to update Drupal (any Drupal installation warns you when there are updates, or security fixes). Also, editing Drupal core is not encouraged, and it's generally the wrong way to resolve an issue. What is then the usefulness of an answer showing me the OP altered Drupal code?
    – apaderno Mod
    May 4, 2012 at 14:27
  • 1
    @kiamlaluno Bug reports are off topic, but if someone is looking for a way to get around a bug that hasn't been addressed yet, then it most definitely should be on topic. In other words, if the question states "this is a bug", yes, OT. If it's asking "I'm working on this bug, and I've tried A, but I have a problem with B" then I would hope that most definitely is on topic.
    – casperOne
    May 4, 2012 at 14:31
  • @casperOne The scenario is the following: You edit your local copy of Drupal; Drupal is updated to fix a security issue, and the same file is updated. What do you do? How can your change be useful to users who depends from the official distribution? You can surely create a modified version of Drupal, but from that moment you are alone; it is you who needs to be able to merge the changes done in the official distribution with yours. There is a company that created Pressflow, which is a modified version of Drupal; they have many developers working on it, though.
    – apaderno Mod
    May 4, 2012 at 14:34
  • @casperOne Workarounds for bugs are also considered off-topic. Bugs are not resolved because somebody writes a blog post about a bug, but because the bug is reported in the correct channels. In the moment you say, "I'm working on this bug" you already know it is a bug, and you should report it in the correct place. Even if you don't know it is a bug, but you say "This module throws me an error," the question is still about a bug, which should be reported in the issue queue for the module, which is the official place to report bugs.
    – apaderno Mod
    May 4, 2012 at 14:36
  • 1
    @kiamlaluno Thinking, even if it is off topic for Drupal, it's on topic for Stack Overflow, and should be migrated there, if the question meets the quality standards (assuming they have shown original research effort, etc).
    – casperOne
    May 4, 2012 at 14:57
4

Just a quick sanity check here, since this has been subject to a fair bit of discussion in comments (here and on MSO):

First, most information posted to a Stack Exchange site is never truly deleted:

Deleted posts are usually not physically deleted (i.e. removed from the system); they're just hidden (AKA soft-deleted). This means they won't appear in search results or data dumps, and normal users following links to them will see a 404 (not found) page.

If you actually want your post to be permanently deleted, submit a moderator flag or e-mail the team using the "contact us" in the footer of every page.

Moderators, and normal users with >=10k reputation, see all deleted posts. Moderators are able to undelete any deleted post. "10kers" may vote to undelete deleted questions (it takes three votes to undelete), but cannot undelete deleted answers.

This could actually work to your advantage: the information contained in a post is hidden but not lost, and can potentially be restored after a reasonable amount of time if necessary. However, it is worth keeping in mind that no action a moderator can take here will fully remove it - even if the question is quickly deleted and delisted from Google, there's no guarantee someone hasn't saved it, copied it or mirrored it elsewhere.

More importantly, the Stack Exchange administrators are not going to step in and soft-delete (much less hard-delete) anything just because someone claims it's a security issue. This would set a dangerous precedent, allowing anyone with an axe to grind to censor others' work at will.

The moderators on this site are expected to act on behalf of the community to remove information deemed harmful. If the good folks on this site wish to see these posts removed, the moderators are expected to act on their behalf to make this happen. Ultimately, they do answer to the community, out of whom trusted members are able to review moderator decisions (hence the need for preventing hard deletion). If hard deletion is deemed necessary, the burden of proof on those arguing for it is by necessity much higher.

I urge all of you to consider these facts carefully and compose a clear policy to follow in the future.

3
  • If you look at the reputation league for this site, the top two users are already moderators. The next two are at the magic 10k mark. Nobody else will be hitting that any time soon. That does make things harder to do, and puts more burden (power?) on a few people.
    – mpdonadio Mod
    May 3, 2012 at 23:12
  • 1
    Good reason to be very, very careful about what y'all decide here...
    – Shog9
    May 3, 2012 at 23:14
  • 10k users can undelete questions, as reported in the page about their privileges: "cast delete and undelete votes on questions." The problem is eventually that they need a link to the question, as they cannot probably finding deleted posts.
    – apaderno Mod
    May 4, 2012 at 13:26
0

Just ask the devs for the ability to email a question to drupal.org's security@drupal.org email (via a link on the question). That covers se's due diligence on the issue.

1
  • 2
    I don't see why we need a specific tool at all, all that really does is imply there's some onus on us to report any and all security issues...there isn't. IF you find a security issue in Drupal, report it to Drupal. If you have a question about Drupal, ask it here.
    – Ben Brocka
    May 3, 2012 at 14:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .