Grace Note asked: Black Hat security techniques and analysis is currently under discussion to be allowed on the site, but irrelevant to that - what are your thoughts on the approach, and do you actually practice it?
Terry Chia answered: I agree with many of the opinions exposed on meta already. There is no reason to close a question for being black hat as many of them can be closed as NaRQ or too localized. Good questions with blackhat content CAN be a good resource on this site. Part of my stand is also stated here: How far should we go to demonstrate a topic that could be used for harm?
M'vy answered: I do not practice it, cause I'm doing research on other topics. However, black hat techniques are part of the 'art of security' and helps builds it. Furthermore, black hat and white hat can only be separated by a thin line.
Scott Pack answered: Black Hat techniques is one of those weird cases of poor naming and exceptional baggage. The StackExchange network and legal jurisdictions already has rules regarding illegal material, being a partner to committing crimes, etc, etc. I don't think material should be banned because it is "Offensive Security", I think material should be off-topic if it meets the off-topic definitions as per the FAQ and/or already disallowed by Terms of Service or the laws governing SEI.
Polynomial answered: I feel that blackhat is a very complex and difficult topic to litigate on. I don't practice it, but I study it. We need to be clear that blackhat is about intent, not content. However, legality is independent of hatted-ness.
Polynomial continued: I think blackhat topics are interesting, and when well written can provide a great resource to the community. However, where a blackhat question shows clear malicious intent, we should close it. Where any question demonstrates intent to commit illegal activities, we should close it.
Polynomial concluded: One caveat is the grey zone introduced where a blackhat question doesn't explicitly show malintent, and is not illegal, but might still be morally unjust. I think, at that point, we have to leave it to the moral compasses of answerers. As moderators we need to keep a careful eye on such topics, to make sure arguments don't occur, and that the question doesn't go off the rails.
Iszi answered: While this has always been an issue here, it's really come to a head recently. I'll drop my response from Meta in here, as I think it sums it up nicely. Some members of our community have recently helped refine my opinion in this regard, so I cannot say how consistent I have been with this in the past. But, I definitely plan on holding to this (or, if different, whatever the community decides) in the future:
Iszi continued: As responsible citizens who are in the business of "selling weapons", we should happily "sell" our "weapons" to anyone - regardless of their intent - up until the point that we actually have a reasonable suspicion (or, and especially, confession) that their intent is malicious and/or illegal. After that point, and only after that point, it is our ethical responsibility to refuse the "sale".
bethlakshmi answered: I don't practice Black Hat hacking or practices. Ethics aside, I am more of a wall builder than a hacker in the security world - I simply don't have the right mindset for hacking, so I leave hacking to people who are better at it, and learn from them. As far as Black Hat the conference used for good ethical purposes - I'm interested, good information has come my way from that venue recently, but not highly involved.
Jeff Ferland answered: Aside from the fact that there's a difference between, "How do I verify this is secure," and, "How do I break into this guy's site?" I'd say you can't appreciate SQL injection until you can look at something and say, "Oh, I'd break that." Having spent some time in PenTesting (and now writing / reviewing code), yes: I practice.
AviD remarked: Sorry to interrupt your flow, but she asked about black hat, not black box. Black hat usually (okay its a bit ambiguous) refers to malicious, illegal, or unethical activities.... but you knew that :)
Grace Note added: I think that the "How do I break into this guy's site" is a reference to the kind of Black Hat that ain't allowed
Jeff Ferland responded: Black hat technique... I don't mess with others' systems, but the knowledge of openly breaking things is the dispute. We'll never* allow questions that are openly intending to break systems that others own, but entertaining questions with the same topic and "appropriate" wording may become part of our community.
AviD replied: Yeah, but you dont really practice "black hat"... wait, do you?