3
$\begingroup$

This suggested answer to our community ads uses the following code:

[![See all questions with active bounties][1]][2]

  [1]: http://stack-exchange-dynamic-ads.herokuapp.com/crypto.stackexchange.com/bounty.png
  [2]: http://crypto.stackexchange.com/?tab=featured

Note that it uses http://stack-exchange-dynamic-ads.herokuapp.com/ to create the dynamic image.

When I try to (re)create the add, the following system warning message pops up:

Community ads must have an image hosted at i.stack.imgur.com; use the image button from the editor to upload.

with the following error message:

Your answer couldn't be submitted. Please see the error above.

In case of doubt, here’s a screenshot showing the messages when I replicate this.

This raises two questions:

  1. How was the user able to create that answer anyway?

    This seems weird looking at the fact that I – having moderator status – was unable to create that answer. When I tried to create it yesterday (before that answer existed) and retrying things today, the system bluntly errors when trying to submit/store/save the answer… which indicates there might be a workaround to store the answer, which is probably unwanted by SE. This could hint at a bug/glitch in the system. If that’s the case, please regard this to be reporting it.

  2. Is it OK for the answer to remain, or should we delete it as it seems to violate SE rules (as indicated by the system message and related system error notice)?

    I’m mainly asking this from a moderator perspective, because this also concerns future suggestions to the SE community ads. Meaning: other, alike (and even malign and/or privacy-invading) things might be submitted in the future. If this one is OK to remain “as is”, it would definitely be helpfull to know where to draw the line between “acceptable” and “not acceptible”.

    Related to this, please note that – even if ads are screened by SE before publication to the sidebar, the suggested answers in the META still remain up and running unscreened by SE.

$\endgroup$
3
  • $\begingroup$ Also worth a note: AFAIK SE screens all normal (/paid) ads before letting them go online which would be impossible to do for a dynamic ad which may allow / be exploited to malvertise. $\endgroup$
    – SEJPM
    Feb 3, 2017 at 12:23
  • $\begingroup$ @SEJPM That’s the word on the street indeed. But even if ads are screened by SE before publication to the sidebar, suggested answers in META remain up and running unscreened by SE. (Added that to the Q.) $\endgroup$
    – e-sushi
    Feb 3, 2017 at 12:26
  • 1
    $\begingroup$ @1: As Gilles explains, I've created the answers with an image and removed that immediately. @2: We have these ads on other metas for years (I think it started on apple in 2012 or so). $\endgroup$
    – Martin Schröder
    Feb 8, 2017 at 22:54

1 Answer 1

Reset to default
2
$\begingroup$

The hosting check is only made during the initial submission, not on subsequent edits. The dynamic-ads answer is posted by first posting an answer containing an image link on imgur, then editing it to link to this external site. If the edit is made within the first 5 min then it doesn't appear in the post history (“ninja edit”). Source: I remember the author explaining that on some other site where someone raised the same question you did.

I presume that it's ok for this answer to remain, since it has been posted on many sites for several years, and it does get its turn in the sidebar.

The security concern you raise — that content on the external site could be changed at any time — is a genuine one. But I posit that it is not an important one. We already know that the link is an external one, so the image is, at most, as insecure as the link. The only risk with the image is if it is changed to not be an image at some point; I should hope that the Stack Exchange code protects against that and doesn't allow e.g. JavaScript to be injected that way.

$\endgroup$

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .