9

and even more importantly what kind of questions are not pertinent here.

I am guessing that questions related to how to implement a very specific security task would still be SO? Or am i wrong?

Also, are subjective questions on security like : "Is a particular language more secure by default" pertinent here?

What about administrative questions like : How to harden a Web Server configuration? Would that still be serverfault or is that now going to be discussed here?

| |
  • 2
    What about "what web frameworks have security by default, and how do you find them?" questions? – Jörn Zaefferer Nov 11 '10 at 21:38
5

Contrary to my previous answer (which I still prefer - but it looks like its not gonna happen) - if this is an all-inclusive, all-things-information-security, then we should also put more emphasis on other parts of infosec too, such as risk management, cryptography, etc.

E.g. the following Area51 proposals should also be merged into here:

I also dislike the name "IT Security" (see this question), since IT is often understood as "the IT department of large corporations", which is still more focused on firewalls and user management. I'd even prefer "InfoSecurity", which is more true to the spirit.

| |
  • I want to emphasize, I still think end-user type questions should be completely out of scope. – AviD Nov 17 '10 at 12:54
  • +1(million, if I could) for information security. I think IT would unnecessarily narrow down the scope of this site. Would be really great if this could become a community of (white hat) hackers. If at some point the range of topics might grow too big one can always split it up into specialized sites. – Dave Feb 10 '11 at 23:50
  • @Dave, thanks, but I disagree about the hackers part. Or more specifically, about being limited to hackers, even white-hat. I would prefer aiming for the security professionals - security engineers, security architects, CISO, risk managers, etc. I definitely think there is room, and common ground, for all the above. – AviD Feb 11 '11 at 0:07
1

I agree with AviD on the professional vs end-user demarcation. I think the core assumption is that security professionals (or IT folks with a security responsibility) will be the ones coming here and posing questions or delivering answers.

So from your question, how to implement a specific security task may well be appropriate, but discussing whether application a or b is better at the task is very subjective. What would be most appropriate is to discuss how the security professional should manage the task, and what risks or gotchas to be aware of.

I feel it should also include the security around frameworks, infrastructure and the other pieces that enable applications, as at the end of the day it is all about making the business secure.

| |
  • While "whether application a or b is better" is subjective, I think there is definitely room to discuss specific advantages and liabilities of one over the other. And especially to discuss the tradeoffs therein... – AviD Jan 6 '11 at 8:02
0

As I said here, I think this site should be focused on Application Security only, thats a wide enough topic - but not just web security.

While I might understand why @Robert would want to merge them, it's crystal clear that SO could not have included SF - completely different worlds...

| |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .