Return to Question

In the site FAQ, it is written:

Black Hat vs White Hat - This site is not intended to be a resource for Black Hats, or malicious hackers. While we understand discussion of exploits may require examples, if the question looks too much like a request for attack tools or mechanisms to spread a virus, it may be moderated.

I don't think this reflects our stance on black hat topics very well. The assertion that “This site is not intended to be a resource for Black Hats” seems to be saying that any discussion of black hat topics (attacks, exploits, etc.) is forbidden. Furthermore, while the text actually doesn't say so, it looks like all questions of attack tools or mechanisms to spread viruses are forbidden.

The outcome of meta discussions 1 2 3 4 is rather that broadly speaking, we don't discriminate against black hat content. Quoting from some of the answers with high upvotes on these threads:

• Should we accept question about making exploit or building malware ? “I say we should allow such questions”
• why even risk losing legitimate users and content?
• exploit code should not only be allowed, it should be expected!
• It's perfectly valid, even in a whitehat PoV, to be asking only about the attack, exploit, vector, payload, whatever.
• “There is no such thing as black and white, only shades of gray.”

We should clarify the FAQ to make it clear that discussions of attacks and exploits is on-topic on this site. We should replace the paragraph quoted above by one that reflects the policies that are effectively applied and the kind of bad content that we want to feel justified in removing.

The script kiddie content can pretty much be moderated by the usual Stack Exchange rules. Things like “How do I hack www.example.com?” or “Join me in a DDoS!” can be closed as not a real question. I would appreciate input from moderators regarding past questions that have been deleted for some black hat-related reason and that were not close-worthy under the general Stack Exchange rules.

I propose to start with this:

Black Hat vs White Hat: Discussions of attacks and exploits are allowed within reason. We adhere to responsible disclosure rules,

What else do we need to say?

In the site FAQ, it is written:

Black Hat vs White Hat - This site is not intended to be a resource for Black Hats, or malicious hackers. While we understand discussion of exploits may require examples, if the question looks too much like a request for attack tools or mechanisms to spread a virus, it may be moderated.

I don't think this reflects our stance on black hat topics very well. The assertion that “This site is not intended to be a resource for Black Hats” seems to be saying that any discussion of black hat topics (attacks, exploits, etc.) is forbidden. Furthermore, while the text actually doesn't say so, it looks like all questions of attack tools or mechanisms to spread viruses are forbidden.

The outcome of meta discussions 1 2 3 4 is rather that broadly speaking, we don't discriminate against black hat content. Quoting from some of the answers with high upvotes on these threads:

• Should we accept question about making exploit or building malware ? “I say we should allow such questions”
• why even risk losing legitimate users and content?
• exploit code should not only be allowed, it should be expected!
• It's perfectly valid, even in a whitehat PoV, to be asking only about the attack, exploit, vector, payload, whatever.
• “There is no such thing as black and white, only shades of gray.”

We should clarify the FAQ to make it clear that discussions of attacks and exploits is on-topic on this site. We should replace the paragraph quoted above by one that reflects the policies that are effectively applied and the kind of bad content that we want to feel justified in removing.

The script kiddie content can pretty much be moderated by the usual Stack Exchange rules. Things like “How do I hack www.example.com?” or “Join me in a DDoS!” can be closed as not a real question. I would appreciate input from moderators regarding past questions that have been deleted for some black hat-related reason and that were not close-worthy under the general Stack Exchange rules.

I propose to start with this:

Black Hat vs White Hat: Discussions of attacks and exploits are allowed within reason. We adhere to responsible disclosure rules,

What else do we need to say?