15

In connection with the moderator elections, we are holding a Q&A thread for the candidates. Questions collected from an earlier thread have been compiled into this one, which shall now serve as the space for the candidates to provide their answers. Not every question was compiled - as noted, we only selected the top 8 questions as submitted by the community, plus 2 pre-set questions from us.

As a candidate, your job is simple - post an answer to this question, citing each of the questions and then post your answer to each question given in that same answer. For your convenience, I will include all of the questions in quote format with a break in between each, suitable for you to insert your answers. Just copy the whole thing after the first set of three dashes. Oh, and please consider putting your name at the top of your post so that readers will know who you are before they finish reading everything you have written.

Once all the answers have been compiled, this will serve as a transcript for voters to view the thoughts of their candidates, and will be appropriately linked in the Election page.

Good luck to all of the candidates!


Do you have any pre-existing conflicts or points of tension with community managers or other moderators? This question draws rationale from this Meta Server Fault thread: Abrupt change in moderation staff

What do you think Sec.SE's biggest challenge is? (E.g. question/answer quality/quantity, too many/few closures, too many/few questions of a certain type, bad tools/guidance, …) What do you think should be done about this (whether as a moderator, or by other users, or by Stack Exchange staff or anyone relevant)?

There are several proposals for new Stack Exchange sites that would overlap to a debatable extent with this one, in particular: HackOverflow, HackExchange (clearly a duplicate of HackOverflow), and in a different vein Privacy. What do you think of these proposals? Do they reflect different topics that merely overlap? Does their existence betray a lack from Sec.SE's part?

How would you deal with a user who produced a steady stream of valuable answers, but tends to generate a large number of arguments/flags from comments?

How would you handle a situation where another mod closed/deleted/etc a question that you feel shouldn't have been?

Do you have prior experience as a moderator, either on Stack Exchange or on an IT Security site?

Some have complained that people make close votes too easily. Do you intend to do anything about that?

As a moderator on Information Security you will also become a moderator on all of chat.stackexchange.com - which has rooms for most sites (all except Stack Overflow and Meta.StackExchange). A heated discussion is flagged in "The Suspension" chat room which is associated with BridgeBuilding.stackexchange.com - there is swearing and name calling. What do you do?

One challenge that Sec.SE experiences is that of repetitive questions for which there could be a canonical answer, but for which there often is no single canonical answer posted. Can you suggest a way for us to improve canonical reference handling of FAQs? The primary example might be new users posting obfuscated PHP code that they found in their Wordpress - there are a handful of good answers in the past, all narrowly focused on the code presented within the question that they answered, but rarely describing the principles and tools of de-obfuscation that would make for a useful canonical answer. New questions rarely receive solid canonical efforts because posters know that there are already many answers out there; old excellent answers get lost in the shuffle among so many of the same type of questions. People are going to keep coming with this question, and others like it - we can't pre-educate newcomers all that well. How can we handle it to both meet their needs and lower the repetitive investment of "good enough here and now" answers?

A question is flagged: Please delete this question – my boss has seen it and says it contains confidential code – he's freaking out and wants me to remove it, but I can't delete it. The question was asked 3 days before, it has 2 answers, one is accepted. How do you respond? I could imagine this might be particularly pertinent on this Stack, where somebody might post security-sensitive information (e.g. passwords hints/policies, crypto details) and land themselves in hot water.

4
  • Aww, mine didn't make it in? I thought it was a good one. Is there an option for people who want answers to questions other than these? Or is that option "take it to chat"?
    – Iszi
    Jul 20, 2015 at 20:50
  • 1
    Speaking of chat... LINK for those who need it.
    – Iszi
    Jul 20, 2015 at 20:58
  • The main option is to just poke people on chat, yes.
    – Grace Note StaffMod
    Jul 20, 2015 at 21:49
  • Candidate schroeder has reached the threshold and is elected. Winner is schroeder. !!!
    – atdre
    Jul 28, 2015 at 21:15

5 Answers 5

7

Answer by Xander:

Do you have any pre-existing conflicts or points of tension with community managers or other moderators? This question draws rationale from this Meta Server Fault thread: Abrupt change in moderation staff

No, I do not.

What do you think Sec.SE's biggest challenge is? (E.g. question/answer quality/quantity, too many/few closures, too many/few questions of a certain type, bad tools/guidance, …) What do you think should be done about this (whether as a moderator, or by other users, or by Stack Exchange staff or anyone relevant)?

I believe we still have some uncertainty around what questions are appropriate for the site, and this results in some questions being closely incorrectly or at least too quickly. Specifically when questions move out of the realm of the theoretical and into the practical, we have an unfortunate tendency to close with prejudice. As to remediation, I think this is exactly what meta is for, and we as a community and as a moderation team should be leaning on this tool more than we currently do in order to provide additional guidance.

There are several proposals for new Stack Exchange sites that would overlap to a debatable extent with this one, in particular: HackOverflow, HackExchange (clearly a duplicate of HackOverflow), and in a different vein Privacy. What do you think of these proposals? Do they reflect different topics that merely overlap? Does their existence betray a lack from Sec.SE's part?

To some extent HackOverflow overlaps with this site, and to some extent it overlaps with ReverseEngineering.SE. I think there's a legitimate place for ReverseEngineering.SE, but for the HackOverflow questions that don't fit there, I think that speaks more to our neglect of some of the practical questions I mentioned earlier than to a need for a new site.

How would you deal with a user who produced a steady stream of valuable answers, but tends to generate a large number of arguments/flags from comments?

First, I would confer with the rest of the moderation team. My initial desire would be to ping the user to offer corrective guidance, but I would want to make sure that the mod team was on the same page before speaking on behalf of the site.

How would you handle a situation where another mod closed/deleted/etc a question that you feel shouldn't have been?

I would discuss it with them, and let them know how I feel, much as I do in the DMZ now.

Do you have prior experience as a moderator, either on Stack Exchange or on an IT Security site?

No, not on StackExchange or an IT Security site. I do have 15 years professional experience building communities (both the software and the communities that use the software) and working with community managers and management teams.

Some have complained that people make close votes too easily. Do you intend to do anything about that?

I try to be careful about closing questions, personally, and vote to leave a fair number open. As I've mentioned in several previous answers, I think more extensive use of our meta site could allow us to offer better guidance to the community on when questions we're currently closing might actually be valuable to the site.

As a moderator on Information Security you will also become a moderator on all of chat.stackexchange.com - which has rooms for most sites (all except Stack Overflow and Meta.StackExchange). A heated discussion is flagged in "The Suspension" chat room which is associated with BridgeBuilding.stackexchange.com - there is swearing and name calling. What do you do?

I'm not particularly familiar with chat moderation, and I'm not active in that room, so I would probably just put the room in timeout for a minute (I think mods can do that) to allow the mods who know the room and the users to show up and provide more specifically appropriate guidance.

One challenge that Sec.SE experiences is that of repetitive questions for which there could be a canonical answer, but for which there often is no single canonical answer posted. Can you suggest a way for us to improve canonical reference handling of FAQs? The primary example might be new users posting obfuscated PHP code that they found in their Wordpress - there are a handful of good answers in the past, all narrowly focused on the code presented within the question that they answered, but rarely describing the principles and tools of de-obfuscation that would make for a useful canonical answer. New questions rarely receive solid canonical efforts because posters know that there are already many answers out there; old excellent answers get lost in the shuffle among so many of the same type of questions. People are going to keep coming with this question, and others like it - we can't pre-educate newcomers all that well. How can we handle it to both meet their needs and lower the repetitive investment of "good enough here and now" answers?

Well, we know which users have particularly good answers on a particular topic. In some cases it may be as simple as doing a little legwork to reach out to the them, to get them to add canonical answers. In other cases, it may be a good idea to spend the time to aggregate the answers from several different duplicate questions into a community wiki answer on the best question in the vein. In most cases including those about, the answer is that somebody, either a moderator or community member needs to commit to spend the time and energy required to drive the issue to resolution, and time and energy are often the shortest assets in supply in a part-time volunteer community. It might be helpful to be able to flag questions as needing a canonical answer and surface that in a visible and easy to access location, so it can be regularly reviewed and someone could knock one out when the mood strikes.

A question is flagged: Please delete this question – my boss has seen it and says it contains confidential code – he's freaking out and wants me to remove it, but I can't delete it. The question was asked 3 days before, it has 2 answers, one is accepted. How do you respond? I could imagine this might be particularly pertinent on this Stack, where somebody might post security-sensitive information (e.g. passwords hints/policies, crypto details) and land themselves in hot water.

If the information was sensitive enough, I may temporarily delete the question as requested, but in any case it would be escalated to SE staff to permanently redact the sensitive information from the question as the final solution, while leaving the question materially intact.

7

Answer by schroeder:

I love these questions!

Do you have any pre-existing conflicts or points of tension with community managers or other moderators? This question draws rationale from this Meta Server Fault thread: Abrupt change in moderation staff

I maintain good relationships with all other community managers and other moderators in the communities that I am involved in.

What do you think Sec.SE's biggest challenge is? (E.g. question/answer quality/quantity, too many/few closures, too many/few questions of a certain type, bad tools/guidance, …) What do you think should be done about this (whether as a moderator, or by other users, or by Stack Exchange staff or anyone relevant)?

The biggest challenge that Sec.SE is facing right now, from my perspective, is an interpretation of focus and intent especially as the community evolves. Is Sec.SE intended primarily for InfoSec professionals to seek answers or for InfoSec professionals to answer questions? This is not an easy problem. I'm seeing a definite trend where many of the core InfoSec questions have already been answered sufficiently, and if we are too strict in the "professional nature" of the questions, we will severely hamper the community. On the other hand, if we allow all natures of questions, then we dilute the existing valuable professional nature of the site.

This is a problem that needs to be addressed by the community as a whole, led by the moderators. It would be interesting to run polls of the community to ask about new on-topic material.

There are several proposals for new Stack Exchange sites that would overlap to a debatable extent with this one, in particular: HackOverflow, HackExchange (clearly a duplicate of HackOverflow), and in a different vein Privacy. What do you think of these proposals? Do they reflect different topics that merely overlap? Does their existence betray a lack from Sec.SE's part?

This is a fantastic question and relevant to my previous answer. My stance all along has been that Sec.SE should remain on the conceptual and architectural levels. As a rule of thumb (certainly not strictly), a question that would have an answer that would be a command or a configuration option is more of a tech support or a tool-specific question. If we allowed all these types of questions, we would be (we have been at times) inundated with questions of so specific nature that the overall intent of the site could be/would be lost. To that end, a Stack Exchange site that could tackle these important questions should exist: a site where it would make sense to debate and discuss the relevant merits of various nmap options or technical troubles with metasploit.

In my opinion, Sec.SE should seriously consider the merits of taking on the higher level topics, such as Privacy. But, even such a move should be done with a clear understanding of the scope of the topic.

I do not see the spawning of these sites as a lack on Sec.SE's part, but an indication of the ever-evolving needs of the broader community, an evolution that Sec.SE can guide and respond to.

How would you deal with a user who produced a steady stream of valuable answers, but tends to generate a large number of arguments/flags from comments?

The fact that the user produces valuable answers means that it is a user that the site should encourage to stay involved. An unfortunate trend in unhelpful comments needs to be addressed on a personal level. I would reach out personally in order to understand the motivation for the unhelpful comments and to inform the user how those comments are affecting the community. I would also alert the other mods in order for us to come up with consistent and communal approach in dealing with the comments that are causing problems.

How would you handle a situation where another mod closed/deleted/etc a question that you feel shouldn't have been?

I would simply seek to understand. It is important that all mods act in concert, and if there is a disconnect, or a desired shift in the previous understanding, then starting a discussion is the best way for everyone, including me, to work together. The Meta site and the DMZ are great ways to do this.

Do you have prior experience as a moderator, either on Stack Exchange or on an IT Security site?

I do not have experience as a moderator on other sites, but I do have experience as Speaker of the House in Parliamentary debate clubs, as a Game Master in a variety of tabletop RPG games, and as a school department head and a business owner and manager.

Some have complained that people make close votes too easily. Do you intend to do anything about that?

The site must be clear about what is on topic and what constitutes a question that is too poor to answer. Quick close votes should reflect that a question clearly does not meet the established standards. If quick close votes are not reflecting that, then I would make a broad call to the community for mindfulness from everybody when casting close votes, and perhaps re-open closed questions that might require a reevaluation from the community. In addition, it might be helpful to add to the FAQ to communicate guidelines that would address the specific concerns.

As a moderator on Information Security you will also become a moderator on all of chat.stackexchange.com - which has rooms for most sites (all except Stack Overflow and Meta.StackExchange). A heated discussion is flagged in "The Suspension" chat room which is associated with BridgeBuilding.stackexchange.com - there is swearing and name calling. What do you do?

Dropping into the middle of an established community and in the middle of a conversation to try to exert control can only make problems worse. I would try to alert the usual mods of the chat room, and simply announce myself in the chat room and ask if everything was "ok". That way, if there was a problem, people would have access to a moderator, but I hopefully wouldn't cause a new problem by my presence.

One challenge that Sec.SE experiences is that of repetitive questions for which there could be a canonical answer, but for which there often is no single canonical answer posted. Can you suggest a way for us to improve canonical reference handling of FAQs? The primary example might be new users posting obfuscated PHP code that they found in their Wordpress - there are a handful of good answers in the past, all narrowly focused on the code presented within the question that they answered, but rarely describing the principles and tools of de-obfuscation that would make for a useful canonical answer. New questions rarely receive solid canonical efforts because posters know that there are already many answers out there; old excellent answers get lost in the shuffle among so many of the same type of questions. People are going to keep coming with this question, and others like it - we can't pre-educate newcomers all that well. How can we handle it to both meet their needs and lower the repetitive investment of "good enough here and now" answers?

This is an important question to me. The problem that I'm seeing is a lack of a clear subject matter expert within the community for these questions. The community should work together to pull in the resources it needs to come up with a canonical reference. This way, these obviously important questions for people can be handled in a way that is helpful for everyone.

A question is flagged: Please delete this question – my boss has seen it and says it contains confidential code – he's freaking out and wants me to remove it, but I can't delete it. The question was asked 3 days before, it has 2 answers, one is accepted. How do you respond? I could imagine this might be particularly pertinent on this Stack, where somebody might post security-sensitive information (e.g. passwords hints/policies, crypto details) and land themselves in hot water.

Despite the public nature of the site (and the reputation points for the accepted answer), the people posting retain responsibility for their content. If a user posts sensitive content, then the mods should support the user's request for removal. If this question is asking about a 3rd party asking for someone else's question to be removed, then I would reach out the user that posted the material to either work with the user to substitute the sensitive material or to seek approval to remove the question. If a conflict remains, then the 3rd party might need to prove that the material is under their control and the mods would have to work together to come up with a solution.

4

Answers by Scott (scottpack)

Do you have any pre-existing conflicts or points of tension with community managers or other moderators? This question draws rationale from this Meta Server Fault thread: Abrupt change in moderation staff

Community managers have a tough job ahead of them. The vast variety of personalities, motivations, and preconceptions they have to somehow mold into a cohesive happy unit sounds pretty dang daunting to me. To my mind they're here to support us so anything I can do to not make it harder is the only right choice. I definitely respect the work they do and have even developed a friendship with some of them in the past. Beyond the community team, through my long term involvement both here and at ServerFault, I have come to know a large group of moderators and StackExchange employees. All of whom I respect as people or colleagues and would enjoy working with.

The specific thread mentioned is an interesting one. A simple text search will show my name in there a few times. My concern from the beginning was entirely based in the communication and a desire to see that the investigation was handled well. While I still believe the public communication was somewhat less than ideal I feel pretty comfortable in how the investigation went down. Both Shog's final analysis and comments from technical staff lead me to believe the cleanup, at least, was handled with the kind of care a former forensics kid would appreciate.

What do you think Sec.SE's biggest challenge is? (E.g. question/answer quality/quantity, too many/few closures, too many/few questions of a certain type, bad tools/guidance, …) What do you think should be done about this (whether as a moderator, or by other users, or by Stack Exchange staff or anyone relevant)?

Personally I've found the biggest challenge is lack of question interest. It's been quite some time since I've seen a question that I want to spend the time answering. As far as the site itself I believe the content as a whole is certainly up to snuff. What I think we could use is some organization and general editing. We currently have on the order of 23k questions and 47k answers. That's...a lot. It's time we did another tag audit and cleaned them up. Then just generally going through and editing posts for clarity and readability. Neither of those tasks necessarily require moderator privileges but the work can be made easier with them, tagging particularly.

There are several proposals for new Stack Exchange sites that would overlap to a debatable extent with this one, in particular: HackOverflow, HackExchange (clearly a duplicate of HackOverflow), and in a different vein Privacy. What do you think of these proposals? Do they reflect different topics that merely overlap? Does their existence betray a lack from Sec.SE's part?

Based on the sample questions and description I see nothing in HackOverflow that is not already explicitly on-topic here. Gilles did an excellent job of diving into the root of the matter and pointing out the Great Hat Color War. The HackOverflow and HackExchange proposals are as far as I'm concerned an unfortunate consequence of the overloaded use of the word "hack" and a misunderstanding of the difference between on-topic and bad or not suitable for the SE format.

Privacy is much more interesting. It's definitely true that many Information Security folk get deeply into privacy issues as a hobby but is one a super-set of the other? The proposed questions are a mishmash of topicality. Some of them are definitely on-topic on Sec.SE, others...I'm not so sure. Let's look at our mission statement.


IT Security Stack Exchange is for Information Security professionals to discuss protecting assets from threats and vulnerabilities. Topics include, but are not limited to:

  • web app hardening
  • network security
  • social engineering, including phishing
  • risk management
  • policies
  • penetration testing
  • security tools
  • using cryptography
  • incident response
  • physically securing the office, datacentre, information assets etc.

While many companies do have privacy policies as part of their Information Security or Compliance programs there's not much else in the list that looks immediately applicable to me. I would love to hear someone argue for Privacy being a subset, it would be a great discussion. This means the real question is should Privacy be covered under Security.SE. I'll have to think on that some more and let the idea stew. I would say likely no but it's something we should have more discussions about as a community and give the collective a chance to weigh in.

How would you deal with a user who produced a steady stream of valuable answers, but tends to generate a large number of arguments/flags from comments?

This is a particular challenge. We definitely want to reward and encourage useful content but if it results in generating a toxic atmosphere? That's not good. The first step should always be an adult conversation with the person in question. Let them know that a segment of the population, significant enough to make the conversation happen, has some concerns and to keep them in mind. It's been my experience that most people, even on the Internet, are reasonable and are willing to be at least put forth some effort to not be a raving jerk. If the conversation, and accompanying corrective nudges, aren't effective then we have to start looking at cooling off periods. I hate the idea of forcibly ejecting users who are actually valuable but we also can't allow someone freedom to disenfranchise or drive off others simply because they're useful.

How would you handle a situation where another mod closed/deleted/etc a question that you feel shouldn't have been?

Much like above this is where the adult conversation happens. Preferably behind closed doors. I have had long experience with the moderation team here and trust them all. If, after hearing their reasons, I still wasn't convinced then I would ask another member of the mod team for their opinion. I like to think that I'm generally open to other people's ideas and would go with the consensus at that point. While I would prefer to agree with a decision I'm not against going along with the majority so long as I feel that it's been reached reasonably and dissent was allowed to be heard.

Do you have prior experience as a moderator, either on Stack Exchange or on an IT Security site?

I have been involved in this community since the very beginning. I've been a part of building the culture that we love so much and helping shape it through the user-level moderation tasks. I have not, however, formally operated in an official moderator position.

Some have complained that people make close votes too easily. Do you intend to do anything about that?

When it comes to close votes a moderator is in a funny spot. We can't exactly do anything about zealous closing. In fact we can only make the situation worse! Our best option would be to keep an eye on questions that go through the close vote queue and re-open any that maybe should have stayed open. Other than that it's pure horse trading by trying to encourage the community to slow down before voting.

As a moderator on Information Security you will also become a moderator on all of chat.stackexchange.com - which has rooms for most sites (all except Stack Overflow and Meta.StackExchange). A heated discussion is flagged in "The Suspension" chat room which is associated with BridgeBuilding.stackexchange.com - there is swearing and name calling. What do you do?

I've been pretty vocal about this issue since the beginning. As a long time participant and contributor to ServerFault I would frequently see swarms of mods swoop into the chat room and start throwing around calmbalms like a rapper at a rave. The culture of each site's chat rooms are just as unique as the site itself. What seems offensive to one group may not be to another. As such I would try to do the same thing I do now when processing chat flags; err on the side of neutral. If I felt compelled to oversee I would at least start with saying that I came in because of a boatload of flags and ask if there's a problem. Let the community let me know what they find acceptable instead of me trying to force my own notions on them.

One challenge that Sec.SE experiences is that of repetitive questions for which there could be a canonical answer, but for which there often is no single canonical answer posted. Can you suggest a way for us to improve canonical reference handling of FAQs? The primary example might be new users posting obfuscated PHP code that they found in their Wordpress - there are a handful of good answers in the past, all narrowly focused on the code presented within the question that they answered, but rarely describing the principles and tools of de-obfuscation that would make for a useful canonical answer. New questions rarely receive solid canonical efforts because posters know that there are already many answers out there; old excellent answers get lost in the shuffle among so many of the same type of questions. People are going to keep coming with this question, and others like it - we can't pre-educate newcomers all that well. How can we handle it to both meet their needs and lower the repetitive investment of "good enough here and now" answers?

This is a hard one. We presuppose that the problem can't be solved at the source so instead we must handle it on the back-end. I believe we're going to have to take a multipronged approach. Firstly, it means closing questions quickly, before they have a chance to collect answers. Secondly, making sure that close questions all get closed to a single canonical question so that it will trickle up in the FAQ section. Thirdly, and perhaps most importantly, make sure that canonical question is awesome so that it has all the right SEO magic. Google is our best friend here. If the asker finds their answer first then everybody wins.

A question is flagged: Please delete this question – my boss has seen it and says it contains confidential code – he's freaking out and wants me to remove it, but I can't delete it. The question was asked 3 days before, it has 2 answers, one is accepted. How do you respond? I could imagine this might be particularly pertinent on this Stack, where somebody might post security-sensitive information (e.g. passwords hints/policies, crypto details) and land themselves in hot water.

If the original poster asks to have their own content deleted then I would feel pretty justified in doing so. This is a request that I know has happened before so I would also confer with my fellow mods to see how it's been handled in the past. Whenever reasonable I prefer to follow precedent.

3

Answers by Yves (M’vy)

Do you have any pre-existing conflicts or points of tension with community managers or other moderators? This question draws rationale from this Meta Server Fault thread: Abrupt change in moderation staff

I personally don’t have any grudge against any current moderator (on security or other stacks). Our moderators are doing a very good job. To my knowledge, no moderator raised any concerns about me either.

What do you think Sec.SE's biggest challenge is? (E.g. question/answer quality/quantity, too many/few closures, too many/few questions of a certain type, bad tools/guidance, …) What do you think should be done about this (whether as a moderator, or by other users, or by Stack Exchange staff or anyone relevant)?

To my opinion, the biggest challenge would be consolidation of our knowledge. There are now a lot of questions, lot of good ones with as good answers. I think effort should be made to improve the searchability of these questions. Most notably, bring back some kind of FAQ like we used to have, where we gather the most common questions (maybe a different format). Then a lot of tags need cleaning, because they yield improper results, or some questions are missing tags.

The second main thing would be providing better guidance to newcomers. Lot of questions got closed, usually with good reasons, but users are left without any comments. Most of the closed questions (even duplicates sometimes) are opportunities to make better questions, new users are not usually motivated to do it when they see their question downvoted and closed fast.

As a matter of fact, I would be happy to work and help on other projects/propositions the community (or even current moderators) would want to.

There are several proposals for new Stack Exchange sites that would overlap to a debatable extent with this one, in particular: HackOverflow, HackExchange (clearly a duplicate of HackOverflow), and in a different vein Privacy. What do you think of these proposals? Do they reflect different topics that merely overlap? Does their existence betray a lack from Sec.SE's part?

I don’t think of area51 as any threat nor a lack of our community. If our scope was to evolve, it’s up to the community here. We have done it in the past. And if the proposals finds their way into private or even public beta, well good for them. The procedure of growing and graduating are working really well. If these proposals comes as new fully fledged site, it would be because they have their own community and a good scope as well. And topic overlap has been a fact for many already existing stacks, which are still very healthy. Users define their communities.

How would you deal with a user who produced a steady stream of valuable answers, but tends to generate a large number of arguments/flags from comments?

Well, the usual trick question of the user that provide good and bad thing to the community. We do want to keep them of course, so if they are also producing bad results this is when moderation is needed. Most of the time, theses cases shall be solved with a discussion with the user. If they already contribute to the community by generating quality content, they would surely be open to improve themselves. If the problem still persists despite all attempts and they have an overall negative contribution, we need to be firm about the bad things and act accordingly.

How would you handle a situation where another mod closed/deleted/etc a question that you feel shouldn't have been?

Well, first I find that our moderators rarely act out of haste here. So the question would probably be closed first. And that case is still eligible for a reopen vote by the community. Bringing a bit of highlight on the question, for example in the chat room, would be the first thing to do. Rory also regularly asks for community review on these questions he thinks has not been given enough credit to and can be improved/reopened. As I said above, closed questions can be opportunities to improve.

Should it happen that the question/answer gets deleted while I don’t agree, well we do have chat rooms (and there are rumours of hidden moderators chat rooms, where they all share these dark secrets). Maybe I will agree to their point, or they will agree to mine. If it's still a point a conflict between mods, a meta post might be appropriate to let the community decide what they think is best.

Do you have prior experience as a moderator, either on Stack Exchange or on an IT Security site?

I had the opportunity to use some of the moderators tools while I was on the private beta of French Language and Usage back in the days. I also had the opportunity to moderate some community like university forum, private forums. I also do moderate a non-profit organisation forum along with our team.

Some have complained that people make close votes too easily. Do you intend to do anything about that?

I did not take a close look to it. But if it’s a point people really complain about, it’s worth exploring. Nothing is set in stone. I can’t tell for sure I would do more, until I know what’s really the problem and the consequences. If I had to guess, what could be done, I am pretty sure that bringing awareness or guiding people (like with a meta post) would be the way to go. After, all closing questions is the right of the community. They can be closed, but they also can be reopened. The self moderation is a keystone of any stacks and it’s not good to impose rules on it. However, warning the community to be cautious and relevant in their votes, reminding them of its role is perfectly fine to me. And again, closed questions are opportunities to improve.

As a moderator on Information Security you will also become a moderator on all of chat.stackexchange.com - which has rooms for most sites (all except Stack Overflow and Meta.StackExchange). A heated discussion is flagged in "The Suspension" chat room which is associated with BridgeBuilding.stackexchange.com - there is swearing and name calling. What do you do?

First thing first: these rooms have dedicated moderators who probably know better than me what is going on. So the thing to do would be to get in touch with them asap. If it becomes obvious they are not here to deal with the situation, I see no problem in stepping in to deal with it myself. Most of the conflict should disappear by asking nicely to behave. If this is not enough, moderators tools are here for these other cases.

One challenge that Sec.SE experiences is that of repetitive questions for which there could be a canonical answer, but for which there often is no single canonical answer posted. Can you suggest a way for us to improve canonical reference handling of FAQs? The primary example might be new users posting obfuscated PHP code that they found in their Wordpress - there are a handful of good answers in the past, all narrowly focused on the code presented within the question that they answered, but rarely describing the principles and tools of de-obfuscation that would make for a useful canonical answer. New questions rarely receive solid canonical efforts because posters know that there are already many answers out there; old excellent answers get lost in the shuffle among so many of the same type of questions. People are going to keep coming with this question, and others like it - we can't pre-educate newcomers all that well. How can we handle it to both meet their needs and lower the repetitive investment of "good enough here and now" answers?

As I said on a previous answer, there is indeed a work to do for these “most common” questions. I don’t have the exact format in mind yet, but the first thing that comes to my mind would be a meta post to reference them. There has been some example of FAQs on some stacks meta that have work correctly. Another idea would be to start project. We had our blog, for which many provided real good articles, but it’s not been updated since 2014. Maybe having community project could gather our authors to work on this goal and help in having question compiled together to form the canonical posts we are lacking.

A question is flagged: Please delete this question – my boss has seen it and says it contains confidential code – he's freaking out and wants me to remove it, but I can't delete it. The question was asked 3 days before, it has 2 answers, one is accepted. How do you respond? I could imagine this might be particularly pertinent on this Stack, where somebody might post security-sensitive information (e.g. passwords hints/policies, crypto details) and land themselves in hot water.

To start, any author can delete his own question or answer. Even anonymous ones in the right conditions. This leave the question only visible to 10k+ users, meaning 29 persons and 2 bears. So I would say this would rather limit the damage in the first place. Should the user really be incapable of deleting said question, it’s a bit trickier. First, we have no way to be sure the content belongs to the entity. Second, we might not even be able to confirm the identity of the user asking us. So unless it’s seems pretty evident that some law has been broken (like if someone publishes personal information, or credit card number), I would leave that way. In all the case, I think it is wise to refer to higher authority. I am pretty confident that StackExchange has a legal advisers on board that could be contacted by the moderator team for these kind of cases and I think they would prefer to be notified of potential problems that might not be, rather to find a complain at their door. A good tool to have would be to be able to edit without history, this could be used to “anonymise” the data properly, but I don’t think such tool exists at this time. And maybe our current moderators know of a good way to proceed already.

Thanks for reading me.

Good luck to all candidates.

1
3

Do you have any pre-existing conflicts or points of tension with community managers or other moderators? This question draws rationale from this Meta Server Fault thread: Abrupt change in moderation staff

I do not.

What do you think Sec.SE's biggest challenge is? (E.g. question/answer quality/quantity, too many/few closures, too many/few questions of a certain type, bad tools/guidance, …) What do you think should be done about this (whether as a moderator, or by other users, or by Stack Exchange staff or anyone relevant)?

I think the main problem with the site is the relative lack of quality questions and answers. As evidenced by the sites top scoring questions & answers and even my top answers, the really popular questions that attract the most votes and views tend to be "beginner" type questions asked by people without a solid foundation in information security.

This is a problem I believe moderators or even the Stack Exchange staff cannot easily solve but I will want to try and encourage better quality questions by closing the lower quality ones.

There are several proposals for new Stack Exchange sites that would overlap to a debatable extent with this one, in particular: HackOverflow, HackExchange (clearly a duplicate of HackOverflow), and in a different vein Privacy. What do you think of these proposals? Do they reflect different topics that merely overlap? Does their existence betray a lack from Sec.SE's part?

I believe that all of these proposals are strict subsets of Information Security Stack Exchange (and in some cases Stack Overflow). I do not believe that such sites will be beneficial and they should be directed at Information Security Stack Exchange instead. If people interested in these topics feel like their questions aren't welcomed here, we should try and fix that.

How would you deal with a user who produced a steady stream of valuable answers, but tends to generate a large number of arguments/flags from comments?

I would handle the user on a case-by-case basis. I do not believe that past contributions or potential contributions in the future should dictate how a particular case in the present is handled.

How would you handle a situation where another mod closed/deleted/etc a question that you feel shouldn't have been?

Not on one of my questions personally but I weighed in on some such questions in chat before.

Do you have prior experience as a moderator, either on Stack Exchange or on an IT Security site?

No, except for the stuff I can moderate as a 20k user on this site.

Some have complained that people make close votes too easily. Do you intend to do anything about that?

I believe that people should feel free to cast their votes however they like but I will exercise more caution myself since moderator votes are binding.

As a moderator on Information Security you will also become a moderator on all of chat.stackexchange.com - which has rooms for most sites (all except Stack Overflow and Meta.StackExchange). A heated discussion is flagged in "The Suspension" chat room which is associated with BridgeBuilding.stackexchange.com - there is swearing and name calling. What do you do?

I believe that the site moderators or moderators that hang out in the room should deal with the situation if possible since different rooms have different cultures and different things they consider acceptable. Having been caught in an unpleasant situation where other mods try and handle some drama in The DMZ without understanding the situation before, I do not wish to contribute to such problems in other rooms. If there are no site moderators or room regulars that are moderators around, I'd place the room in a timeout until such a moderator arrives.

One challenge that Sec.SE experiences is that of repetitive questions for which there could be a canonical answer, but for which there often is no single canonical answer posted. Can you suggest a way for us to improve canonical reference handling of FAQs? The primary example might be new users posting obfuscated PHP code that they found in their Wordpress - there are a handful of good answers in the past, all narrowly focused on the code presented within the question that they answered, but rarely describing the principles and tools of de-obfuscation that would make for a useful canonical answer. New questions rarely receive solid canonical efforts because posters know that there are already many answers out there; old excellent answers get lost in the shuffle among so many of the same type of questions. People are going to keep coming with this question, and others like it - we can't pre-educate newcomers all that well. How can we handle it to both meet their needs and lower the repetitive investment of "good enough here and now" answers?

I feel like the community should identify questions that are considered canonical and make an effort to document them in a single location on meta. Other sites have done so successfully and I believe that it'll work here as well.

A question is flagged: Please delete this question – my boss has seen it and says it contains confidential code – he's freaking out and wants me to remove it, but I can't delete it. The question was asked 3 days before, it has 2 answers, one is accepted. How do you respond? I could imagine this might be particularly pertinent on this Stack, where somebody might post security-sensitive information (e.g. passwords hints/policies, crypto details) and land themselves in hot water.

Tough call. If the answer is valuable, I'd attempt anonymize the sensitive information. Otherwise I'd discuss this with the other moderators and evaluate on a case-by-case basis.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .