Timeline for Clarify our stance on black hat questions
Current License: CC BY-SA 3.0
24 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 17, 2017 at 10:46 | history | edited | CommunityBot |
replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
|
|
| Mar 17, 2017 at 10:46 | history | edited | CommunityBot |
replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
|
|
| Mar 17, 2017 at 10:46 | history | edited | CommunityBot |
replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
|
|
| Mar 15, 2017 at 15:28 | history | edited | CommunityBot |
replaced http://meta.security.stackexchange.com/ with https://security.meta.stackexchange.com/
|
|
| Aug 25, 2012 at 12:51 | comment | added | Gilles 'SO- stop being evil' | Here's an example of a real question about ARP spoofing. | |
| Aug 23, 2012 at 14:42 | comment | added | dr jimbob | @Gilles - I have no problem with blackbox pentests being done. I do think assisting someone asking "I tried an attack a running web app doing X and the server returns message Y, how do I turn this into a successful attack; PS I don't have the source code, but trust me this is a blackbox pentest". As a community, we risk being trivially socially engineered into helping illegal activities. Like if I see a stranger struggling to access a linux box they don't have an account for. I could teach them how to get to root with physical access, but I won't unless I know they should be there. | |
| Aug 23, 2012 at 4:26 | comment | added | curiousguy | @drjimbob "I don't think its fair to search for SQLi attacks on an application that's not running"(...) Fine. | |
| Aug 22, 2012 at 23:23 | comment | added | Iszi | Y'know, I'm not sure why I haven't posted that as an answer yet. Think I'll work that up. | |
| Aug 22, 2012 at 21:09 | comment | added | Iszi | @Gilles and I had a long discussion in The DMZ about this the other day. I relate the situation to being a gun shop owner in a jurisdiction that protects the right to keep and bear arms. As responsible citizens who are in the business of "selling weapons", we will happily "sell" our "weapons" to anyone - regardless of their intent - up until the point that we have a reasonable suspicion (or, especially, confession) that their intent is malicious and/or illegal. After that point, and only after that point, it is our ethical responsibility to refuse the "sale". | |
| Aug 22, 2012 at 20:35 | comment | added | Gilles 'SO- stop being evil' | @drjimbob I disagree even more strongly with you now. “This site is not intended to be a resource for … doing blackbox penetration tests that simulate a black hat attack”??? No way. | |
| Aug 22, 2012 at 20:34 | history | edited | dr jimbob | CC BY-SA 3.0 |
added 28 characters in body
|
| Aug 22, 2012 at 20:31 | comment | added | dr jimbob | @Gilles - I have a long edit. I believe black hat questions that don't fall under NaRQ/too localized is a real issue (and have been removed by moderators in the past). I believe I am not the only user to have this opinion that intent of the asker/answerer is important, while agreeing with the consensus that it is fair to talk about black hat topics for educational purposes (e.g., to implement better defenses). | |
| Aug 22, 2012 at 20:29 | history | edited | dr jimbob | CC BY-SA 3.0 |
long edit
|
| Aug 21, 2012 at 22:16 | comment | added | dr jimbob | @curiousguy - Edited above to change application to 'web application' to make my intended point clear. Its fair to search for security flaws in an application you are running on your own computer. I don't think its fair to search for SQLi attacks on an application that's not running on your own computer that you haven't been giving explicit instructions to attack. People have gone to jail over SQL injection attacks. | |
| Aug 21, 2012 at 22:10 | history | edited | dr jimbob | CC BY-SA 3.0 |
added 8 characters in body
|
| Aug 21, 2012 at 22:04 | comment | added | dr jimbob | @AndreyBotalov - If I see someone needing help trying to break into a house, I'm not going to assist them. Sure, they could own the house or be a locksmith or be testing the security system. But I won't help, unless I know the person belongs in the house. I may recommend closing possible security holes, but that's it. I don't think we should assist with closed-source pentests as we can't easily tell the difference and even if you have been given permission to do a pentest, we have not. | |
| Aug 21, 2012 at 21:41 | comment | added | Andrei Botalov | Again, about illegal activities. How would you know whether it's illegal pentest or not? blackhat != blackbox | |
| Aug 21, 2012 at 21:38 | comment | added | curiousguy | "You should not ask questions asking for assistance (...) searching for exploits in an application that you did not write and do not have the source code for and we have no way of knowing if the application's owners have given you permission to legally evaluate its security." -1 I cannot agree with that, ever. I won't ask permission of "owner" (whatever ownership of some bits could mean) for evaluating a few data, ever. | |
| Aug 21, 2012 at 21:36 | comment | added | Gilles 'SO- stop being evil' | @AndreyBotalov I'm having trouble asking a question about ARP spoofing because I went and read the Wikipedia article and it answered all my questions about how it works and what tools I could use (a couple of which are included in my OS). Note that the first question could be closed as too broad (→NaRQ) since the answer makes up a whole Wikipedia article. Again, my point stands: let us not waste time arguing about hypothetical questions that are not asked, or about questions that would be closed for other reasons anyway. | |
| Aug 21, 2012 at 21:09 | comment | added | Andrei Botalov | @Gilles How would you ask that question about ARP spoofing so that it won't be closed? | |
| Aug 21, 2012 at 20:43 | comment | added | Gilles 'SO- stop being evil' | Generally speaking, the FAQ isn't there to rule on some strange question that some security expert cooked up to flout the rules. I'm fully confident in your ability to ask a question that is squarely within the letter of the FAQ and yet is obviously nefarious in intent. That is neither here nor there. The purpose of the FAQ (recall that the F is for frequently) is to address common cases. When arguing about the FAQ, please cite actual cases. A lack of actual cases is a good sign that the FAQ should keep silent on the subject. | |
| Aug 21, 2012 at 20:40 | comment | added | Gilles 'SO- stop being evil' | Your argument doesn't hold much water because both questions' wording is obviously forced. The first question goes out of its way to tell the asker's life story. The second question is barely more than a title, and you've thrown in a second part that makes it even broader. I'd edit out the life story from the first, which would turn it into a good question by your standard (no illegal activity left apparent), and close the second as NaRQ. | |
| Aug 21, 2012 at 20:35 | history | edited | dr jimbob | CC BY-SA 3.0 |
added 49 characters in body; added 104 characters in body
|
| Aug 21, 2012 at 20:29 | history | answered | dr jimbob | CC BY-SA 3.0 |