Code-sharing leads to widespread bug sharing that black-hats can track

Re: Duh!

I know of a solution though: hold people accountable for the stuff they post.

Steady, old man! If your proposal were applied to this here place, most of us would go around with our knickerbockers severely singed.

Are you quite sure you are entirely blameless in this department yourself?

Re: Duh!

That solution would be far worse than the original problem: nobody would dare to publish any code (apart from a "hello world"), and progress in software would grind to a halt, since everything complex is really built on earlier work.

Re: Duh!

Alright, but only if you get sexual favours for writing really exceptional code.

#fakecode

Re: Duh!

Yep, have to agree.

Most professionally written tutorials, by Google, Microsoft, Oracle, et all state explicitly that the example is simplified to make the point clearer to read, and that it should not be used in production code.

Devs that aren't able to turn example code into production quality code should probably go back for some more education.

Re: Nearly 10 years?

The Perl community were drumming this into us more than 20 years ago: always "use taint" and untaint all inputs! (an instant fix to the appalling example in the article). Doesn't mean the majority of wannabes looking for magic DWIM take any notice - hence the rise of PHP.

And we had a name for zombie tutorials refusing to die for decades after they became invalidated: "Cargo Cult". For example, an ugly hack in the early days of Apache was to use "AddType" to configure it to run scripts such as CGI. That hack was deprecated with the introduction of "AddHandler" in Apache 1.1 more than 20 years ago, yet lived on as standard practice in the PHP world more than a decade later.

Re: open-source tutorials are a security risk says Trend Micro

In fact practically everyone here can attest to the fact that it is not just a horrific fallacy with no evidence to support the claim, it's simply wrong.

Closed source code is full of snippets copied out of Stack Overflow et al, as everyone who deals with closed source code knows.

"the possibility exists..copying from tutorials is particularly prevalent in the open-source world

No, that's academic politeness as he cannot prove that closed source devs do it more, less or the same as open source and politeness requires the benefit of the doubt.

You can argue that closed source devs, under pressure make more use of CnP or that they are being watched by their PHB's to see they are not passing CnP as their own work to make up the development productivity numbers they use less.

No I don't believe that but I cannot prove my PoV either, hence the benefit of the doubt.

Re: Or most of those tutuorials are poison pills to insert vulns

Honestly most of them are written by people who figured out a solution to a problem that was bugging them. If they knew more they probably wouldn't have had such a hard time figuring out the solution so they wouldn't have written the tutorial.

"Badly reviewed tutorials" is all well and good to complain about when one is dealing with a large corporate distributing a development platform, but most of these are volunteer efforts and one is often lucky to find any documentation at all around whatever edge case one is currently working on.