@FireQuacker Accepted answers should be given a bonus, like 25% or 50% of their score, in the ordering. Because if we do not give an incentive or a reason to accept answers, the site should just stop accepting answers altogether. However, answers that are significantly better than the accepted one should be ordered before to reflect what the community thinks is the best (or more up to date) answer, despite what the OP though at the time (s)he accepted an answer.

@A.Hersean @FireQuacker I suspect its reasonably likely SU might opt out of that.

@JourneymanGeek Of making answers acceptable?

@MechMK1 of not pinning accepted answers

interesting idea. I'm curious to see how it'll plan out

Most sites will likely go with the default

What's the rationale bethind SU specifically abandoning pinning accepted answers?

@MechMK1 outdated answers... someone asks in 2007 about how to store passwords, someone says salt+MD5, it's accepted, and stays on the top forever.

True, true

I honestly wish we could mark StackOverflow answers as security risk

Then again...this keeps me in business

haha... Flag as risk

I've seem this time and time again

Inevitably, you will see a comment from someone with security knowledge saying that this is insecure, followed by OP saying "Thanks, works perfectly now!"

it's because I am still to see good tutorials on anything that says "for increased security, we will have to do this and that BEFORE doing what you want to do"

most are "security are left as an exercise to the reader" or "this is insecure, don't put into production" but never tells why is insecure or how to secure things

and they expect someone that don't even know how to connect to a database be able to protect it against SQLi, against hard-coded credentials, how to connect over TLS, how to validate the certificate...

Security becomes widespread when it's the default, or when it's made to be a "pit of success"

Meaning that the secure way to do it is also the easiest way to do it.

@MechMK1 that will never ever happen...

so your job is guaranteed for life

Well, it happens slowl

Most frameworks have anti-CSRF tokens built in

You specifically have to disable them

So any app written with that framework will automatically be protected against CSRF

@MechMK1 I worked on more than one soft house... I've lost count of how many "fix this latter" comments are on the code...

there are security embedded in, but when the release window is closing and one pesky upload form is not working properly, "Accept-Origin: *" is pushed and it's done...

Yes yes, true

But my point is: When a security measure is done without requiring the devs to do anything, it has a much better chance of succeeding

Which is why we see HSTS being deployed more and more widespread, and not CSP

the problem is that security blocks things from running... blocks too much, code does not work... blocks too little, bad things work

like the immune system... and it's faster to disable security than to fix the code

I have the same in a pentest I am doing

Since monday, I've been trying to get my tools to run

It's such a simple solution...

it works and it's fast... no need to strace the binary to see what it's trying to write, no 30+ google queries... one command and done

that's why "secure by default" isn't possible

Everything would be so much more secure if it weren't for people

That would make an interesting motivation for a robot-apocalypse story... Instead of "keep humans from starting a nuclear war and killing themselves", have robots that are passionate about security who start killing off all the programmers

Shouldn't we ban all robot apocalypse stories? I'm afraid that robots may one day watch the Matrix, decide that the Matrix is a really cool concept, and set out to implement it.

@nobody like we did with Idiocracy?