Policy on Areas of security where advice changes

Question

So there's a point mentioned in the DMZ in relation to SSL questions (prompted by this question), which I think warrants a general discussion.

Where we have an area of security where the "best practice" changes regularly, should we be closing/discouraging questions in those areas?

The problem with these questions seems similar to the shopping questions, in that the answers will not stand the test of time.

The problem with not allowing these questions is that we may rule out a legitimately useful area of security advice (with the obvious example in this case being advice on SSL suites, which is a common query from web server admins)

If we do decide to allow these, should there be some policy on maintenance/cleanup of old answers?

Answer 1

There are two ways we can do this:

• Question and answer per year or 6 months
• One generic question which needs to be maintained at given intervalls

The first one can result in a lot of similar questions and answers. The benefit of this will be that the answer can be made valid for a certain period.

The seconds one will result in a single question, but will mean that we need to perform maintenance of the question at regular intervalls (and people might forget about maintaining websites).

Regardless of which of two gets chosen they should be community wiki-ed.

Answer 2

I agree that it can be a useful resource but only if someone commits to maintaining the answers when it gets out of date and best practices change.

Perhaps a good middle ground is for such questions and answers to be community wiki-ed so that people will be more willing to help maintain them?

Answer 3

What about adding a general flag for all the responses, something like:

"Since the question issues a very changing environment, please consider this question valid only for the date this answer was writing, and if unsure, ask again"