45
$\begingroup$

I'm a little concerned about this question, which involves analysing a Linux application that people can download from mediafire.com. In case it disappears, the essential parts are reproduced below:

Here's what we have: a decryption program which takes a string as an argument, but when we run it we just get junk back; some encrypted text, and; a weird image file of a calendar. A bizarre combination, take a look and see if you can figure it out.

here's the encrypted string: NXIS24CuEq@uEq@uEq@u

The files :-

The decryption program

Calendar image

My problem with this puzzle is that mediafire.com is currently classed as Partially dangerous by Google. It really isn't the sort of place you want to be downloading software from.

There are a lot of other sites that run CTF-style hacking contests (e.g., backdoor.sdslabs.co), but I'm sure none of them would ever ask people to install unknown software from domains that are beyond their control.

I suggest that questions inviting people to install and/or analyse software should be ruled off-topic for safety reasons.

$\endgroup$
  • 14
    $\begingroup$ This is concerning to me as well. I'm locking the question until it is resolved here. $\endgroup$ – Aza Feb 14 '16 at 0:51
  • $\begingroup$ What about questions that require well-known programs such as Python to decrypt parts of the puzzle? $\endgroup$ – k-l Feb 15 '16 at 2:49
  • 5
    $\begingroup$ @KiranLinsuain It think it would be OK if the source code itself is provided in the question or hosted somewhere trusted like Github. This question falls into a different category because it provides an executable file, which is difficult to examine safely. $\endgroup$ – 2012rcampion Feb 15 '16 at 3:29
  • 4
    $\begingroup$ I feel like the Python use case is more acceptable because there are online IDEs to run code like that, whereas asking someone to download something (especially something non-OS-agnostic) is a different story on more than one level. $\endgroup$ – question_asker Feb 15 '16 at 14:16
  • 3
    $\begingroup$ Code written in Python also represents a general algorithm rather than a compiled and untrusted program. If you uploaded compiled Python, then yes, I think it would be a problem, but code? Code there shouldn't be an issue with. $\endgroup$ – Aza Feb 15 '16 at 20:18
  • $\begingroup$ Well, I went ahead and downloaded and decompiled the program in question; and I can say that the reason it wasn't provided as code is that the algorithm is pretty trivial; in fact I think it would be solvable without the software at all. $\endgroup$ – 2012rcampion Feb 15 '16 at 20:28
  • 4
    $\begingroup$ Since it looks like this is fairly unanimous, I've unlocked and closed the question. $\endgroup$ – Aza Feb 15 '16 at 22:05
  • $\begingroup$ Perhaps if only source was provided, and it was a simple one class file. But a compiled program is a huge risk. Seems I share the same opinion with 2012. $\endgroup$ – Daedric Feb 17 '16 at 15:04
42
$\begingroup$

Heck yeah.

We the users probably have no idea what we have just decided to download until the download is finish. The file(s) could be filled with viruses or malware that we do not need on our precious computers. Files that are needed to be download cannot be trusted unless approved by someone we know and trust and/or the source code is revealed, which can ruin the puzzle altogether. Unless every single file has to be inspected at https://security.stackexchange.com , we don't want to download the files.

Even worse, the files can only be downloaded by users with a certain type of computer, which ruins the fun for a lot of users without the needed machine/computer. So I say no.

Also, like what Giles said, if the files are necessary and the puzzle cannot survive without them in any way, the question is deemed unfit for this site as the question can be closed as "unclear what you're asking" since the files may not be viewed or are unviewable.

$\endgroup$
28
$\begingroup$

Independently of any security concern, questions on Stack Exchange are supposed to be self-contained. You can print out a question and it should still make sense.

If the question doesn't make sense without downloading extra material, whether that material is a program or extra images, text, etc. then the question is not fit for Stack Exchange can should be closed as *unclear what you're asking due to the missing necessary information.

$\endgroup$
  • 6
    $\begingroup$ I agree with the sentiment of your post (and +1'd it), but I think it's important to clarify what it means to be "self-contained". For example it's not a problem for a question to require "tools" to solve (eg. steganography or cryptography tools), but that's different from needing to download random software from untrustworthy sources. In other words, the question should contain all necessary content, but may require a set of "standard" tools as part of the method. $\endgroup$ – Alconja Feb 15 '16 at 1:20
  • 2
    $\begingroup$ I second Alconja here. Some of the puzzle on site require to look at the digital content (of an image, in most cases), so "solved from printing" is sometimes too strict. Also: What about puzzles which require some search-engine or geo-mapping? tricky borderline.... However, I totally agree with the judgement of "downloading-application/tool = off-topic" for not being self-contained. $\endgroup$ – BmyGuest Feb 17 '16 at 19:21
17
$\begingroup$

A further consideration is that even if this download is perfectly safe and innocuous, but this puzzle leads to a common acceptance of similar puzzles that involve downloads, there is a chance that a malicious individual may see an opportunity to post a link to something harmful dressed up as a puzzle in the future.

$\endgroup$
  • 7
    $\begingroup$ That's what I thought too. I'm sure the OP wasn't trying to spread a virus around, but it was still a dangerous precedent. $\endgroup$ – squeamish ossifrage Feb 16 '16 at 16:41
5
$\begingroup$

Absolutely yes.
The main reason, as you've correctly said :

I'm sure none of them would ever ask people to install unknown software from domains that are beyond their control.

Also, it is highly probable that the question is from a live/running contest like that of Microsoft's Build the Shield or other online hackathons. Thus, it would be highly unethical to solve it for them.

$\endgroup$
  • 2
    $\begingroup$ and you'd be giving some multibillion-dollar corporation your unpaid labor, so there's that. $\endgroup$ – question_asker Feb 24 '16 at 15:20
  • 2
    $\begingroup$ Yes, exactly. We do puzzling for fun, not for someone to make unfair use of it. $\endgroup$ – ABcDexter Feb 24 '16 at 16:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .