How far should we go to demonstrate a topic that could be used for harm?

Question

Whilst writing an answer recently, I had to ponder how much of the subject I should demonstrate, in terms of a real exploit scenario. In the case of the answer I wrote, I think that we're relatively safe since the demonstrated exploit was on a fictional piece of code.

However, we're bound to get situations in future where people ask about specific vulnerabilities. Should we give them full answers, with near-tutorial levels of detail, or should we provide more vague information that fits most scenarios?

Here's my thoughts so far:

• Single-vulnerability questions should be closed as Too Localized, unless they're high profile and warrant a decent writeup on the subject.
• Knowledge is inherently amoral. What's done with it is outside our jurisdiction. However, in cases where malintent is shown, we should close the question.
• Generic advice is useful to lots of people, but less useful to the asker. We'd have to judge this on a case-by-case basis. Should we have a line in the sand, or should we leave it up to the answerer to judge?

I'd like to hear your thoughts on this.

Answer 1

I would like to give my opinions on the three points you have stated.

Single-vulnerability questions should be closed as Too Localized, unless they're high profile and warrant a decent writeup on the subject.

I do not agree with this, coming from personal experiences.

Understanding a vulnerability

This is my first question on Sec.SE. I was searching high and low for information on this particular vulnerability in the CVD and other similar databases. However, what I could find was either too vague, or too in-depth for someone of my experience.

I asked the question here and learnt plenty from the answer provided. The answerer was you no less. ;) This was what prompted me to stick around.

Going by your guidelines, I would have closed that question. Although it is a chrome vulnerability, it isn't particularly high profile. I don't think that is a good idea.

What we can do is enforce naming guidelines on the questions, which will provide the CVE number and other minor details. This would make searching for a information on a particular vulnerability easier.

Knowledge is inherently amoral. What's done with it is outside our jurisdiction. However, in cases where malintent is shown, we should close the question.

I agree with this. Questions asking for explanations or clarifications about a particular vulnerability should be allowed. However, questions like "give me the exploit code for this vulnerability pl0x" should be closed immediately.

Generic advice is useful to lots of people, but less useful to the asker. We'd have to judge this on a case-by-case basis. Should we have a line in the sand, or should we leave it up to the answerer to judge?

I don't think it is possible to provide a guideline for this. It will vary from question to question. The answerer should decide on what to cover. Upvotes and downvotes by the community will do the rest.