The kind of question I am referring to is a little bit like this one :

Malwares source repositories. Where?

Question that are around the subject of "How can I make virus/malware/exploit/etc." are going to be asked. The question is if we want that kind of question or no ? In other word should the community be white hat, grey hat, black hat or whatever you have on your head is fine ?

5 Answers 5


The thing is that knowledge of how to build malware can be used by three groups of people:

  • those who want to build malware
  • those who want to defend against malware
  • those who want to find out who's trying to build malware

I say we should allow such questions; people can use their own judgement on whether to answer them and similarly can judge how to use the knowledge imparted in the answers.

By way of analogy, encryption can be used by criminals who want to hide evidence of their crimes. But I doubt you believe that we should not permit discussion of encryption.

  • +1 Thanks for a thoughtful answer, and not a 1 sentence answer with vague meaning. Commented Jul 1, 2011 at 15:40
  • 1
    Yes. This is the proverbial, guns don't kill people, people kill people. Commented Aug 23, 2012 at 21:15

Definitely OK to answer questions like this.

Knowledge is meant to be shared, one way or another.

If we did not educate people into building exploits we would have a lot of unknown holes in our software which only "cyber gangs" (is that even a term??) know about. Many exploits and 0days out there today is found by white hat hackers.

  • 1
    +1 for the mental image I get from "cyber gangs"...
    – KnightOfNi
    Commented Apr 15, 2014 at 20:31

I think it's OK to answer those questions as long as it's for educational purposes.

  • 6
    I agree, but think we need to define "educative" (or better, "educational" ;) ) better. I.e. should be around explaining principles, so as to better protect against, rather than providing food for script kiddies.
    – AviD Mod
    Commented Nov 14, 2010 at 0:55
  • So... we should accept the question only if the asker has written some "This is for educational purposes." -disclaimer? Seems bit silly to me... Commented Nov 25, 2010 at 8:46
  • 1
    @Ilari Kajaste: I think common sense is good enough to distinguish script kiddies from the good guys. In other words, no need to include a disclaimer. Commented Nov 25, 2010 at 16:02
  • I agree with @AviD and @Olivier-lalonde. It's hard to word this, but I'd welcome clearly written descriptions of "hacking" in the old-school sense (figuring out how to do stuff) since we have lots to learn from that kind of hacker. But providing recipies to 1337-speakers would just take us in a really uninteresting and unhelpful directions. See e.g. security.stackexchange.com/questions/1457/… Rather than that question, I'd love to see a discussion of best practices for backup, and common pitfalls.
    – nealmcb
    Commented Jan 5, 2011 at 2:42
  • 3
    There's no way for us to know the intention of the poster. We should assume that high water raises all ships -- in other words, dissemination of knowledge is nothing to fear. If good guys and bad guys both have equal access to it, then the good guys win (because they know the bad guys' tactics and how to stop it). Commented Jul 1, 2011 at 15:42

I think is appropriate to have such questions. You address malware itself often by reversing it. I would imagine some question would not be appropriate not because of what they ask, but because they would be better maybe on stack overflow or on crypto, if they get that technical. There are plenty of tutorials on how to work with IDA, overflow the stack, write brute forcing algorithms, etc.

By not allowing this topics, that is buying in to security through obscurity. By making this information more difficult to find or trapped in niche books not available online, we are not increasing anyone's safety. If anything, I would imagine that governments could always trace a script kiddie's efforts back here, and work with SE to get the IP information and bust someone who goes super evil black hat.

If it's a good question, with detail on a specific issue or technique asking to accomplish some specific goal, it is most likely a good fit and should be addressed.


I always answer these questions very carefully and try to leave the answer informative from an academic perspective, but intentionally just vague enough to still be difficult for someone who is trying to actually make a practical attack.

I see it as kind of similar to answering questions that appear to be school assignments. You want them to have enough information to figure it out on their own if they have business knowing about it, but don't want to give the answer out in a way it is easy to abuse.

  • Making questions vague is harmful to those on a real quest for knowledge. Making an attack practical is helpful because then they can attempt it on their own systems to see things such as the attack signature, and to get a real "feel" for the attack. The same applies to homework questions. Maybe OP is asking for homework, but the next thousands of people who may view the question likely are not.
    – forest
    Commented Aug 14, 2018 at 8:17
  • @forest - I don't think you understand what I mean. There is a difference between saying "the answer to 2+2 is 4" and answering with an explanation of how addition works and how to solve the problem. The chances of anyone else having the exact same homework question are effectively zero, but a good explanation of how to solve it provides a generally useful answer that also ensures the OP learns what they need to know. Commented Aug 14, 2018 at 16:34
  • This answer was taking a similar tact with exploit questions. If someone has legitimate business learning about signatures and such, it should not be hard for them to fabricate from a technical explanation, but someone who is just looking for a quick abuse is not going to have the ability to fabricate. There might be some who won't be able to fabricate that are interested in something like signatures, but if they can't fabricate, they aren't going to get very far on signatures either. Commented Aug 14, 2018 at 16:35
  • There have been times when I had a question and the only answer was to a homework question and the horribly unhelpful answer was of no use to me. Once I created a new question but it was (naturally) closed as an exact duplicate due to being, well, an exact duplicate. Not fully answering homework or related questions poisons the Q&A resources as a whole. If someone wants to learn how to perform an abusive exploit, they should be taught how, not given vague answers that help no one but OP himself.
    – forest
    Commented Aug 14, 2018 at 20:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .