The kind of question I am referring to is a little bit like this one :
Malwares source repositories. Where?
Question that are around the subject of "How can I make virus/malware/exploit/etc." are going to be asked. The question is if we want that kind of question or no ? In other word should the community be white hat, grey hat, black hat or whatever you have on your head is fine ?
The thing is that knowledge of how to build malware can be used by three groups of people:
I say we should allow such questions; people can use their own judgement on whether to answer them and similarly can judge how to use the knowledge imparted in the answers.
By way of analogy, encryption can be used by criminals who want to hide evidence of their crimes. But I doubt you believe that we should not permit discussion of encryption.
Definitely OK to answer questions like this.
Knowledge is meant to be shared, one way or another.
If we did not educate people into building exploits we would have a lot of unknown holes in our software which only "cyber gangs" (is that even a term??) know about. Many exploits and 0days out there today is found by white hat hackers.
I think it's OK to answer those questions as long as it's for educational purposes.
I think is appropriate to have such questions. You address malware itself often by reversing it. I would imagine some question would not be appropriate not because of what they ask, but because they would be better maybe on stack overflow or on crypto, if they get that technical. There are plenty of tutorials on how to work with IDA, overflow the stack, write brute forcing algorithms, etc.
By not allowing this topics, that is buying in to security through obscurity. By making this information more difficult to find or trapped in niche books not available online, we are not increasing anyone's safety. If anything, I would imagine that governments could always trace a script kiddie's efforts back here, and work with SE to get the IP information and bust someone who goes super evil black hat.
If it's a good question, with detail on a specific issue or technique asking to accomplish some specific goal, it is most likely a good fit and should be addressed.
I always answer these questions very carefully and try to leave the answer informative from an academic perspective, but intentionally just vague enough to still be difficult for someone who is trying to actually make a practical attack.
I see it as kind of similar to answering questions that appear to be school assignments. You want them to have enough information to figure it out on their own if they have business knowing about it, but don't want to give the answer out in a way it is easy to abuse.
