I noticed a post was moved out of Info Sec SE because "it was not the place to ask for recommendation for tools" or something to that effect. I was a little puzzled by this as it was related to encryption and "What's a good tool for XYZ" is a question I as a security pro often ask colleagues or search on the internet for in relation to solving a security problem. Is it because the question is likely to change over time as tools come and go or some other principle that is being applied?
The problem with tool recommendations is that they tend to end up with a haphazard collection of answers:
- I like Pai.
- Pai sucks, use the Tao fork.
- Most customers are dissatisfied with their vulnerability report compiler. Yoyodyne ReportCompiler solves world hunger and has military-grade 11000-bit encryption!
- You should totally drop that and use jQuery!
- use this
In order to work, they need to be moderated more than the average question. This goes both for the questions and for the answers.
- Questions should explain what the asker wants to do — not just “what's the best vulnerability report compiler?” but “I want a tool to help me categorize and prioritize vulnerabilities and collect findings into an organized presentation. I do penetration tests on web servers. The tool should take this kind of inputs and produce this kind of outputs.”
- Answers should not just mention a tool without explanation, they should be tailored to the requirements in the question. If you can imagine your answer copied word-for-word on another question, you're doing it wrong.
This is an overview of the question guidelines and answer guidelines that we have and enforce on Software Recommendations Stack Exchange (evolved after a few weeks of beta from some ground rules). Enforcement is important — if an answer doesn't have any explanation, even if it's massively upvoted because it's a popular tool, we'll delete it.
Does Software Recommendations Stack Exchange work? In my opinion (I'm a moderator there), it works in terms of keeping the spam and the crud out. It doesn't work all that well in producing quality answers — we cull the bad ones (as well as the questions that don't call for answers with added value) but we do have a problem getting good ones. I think that in terms of moderation, SR.SE is successful, but in terms of producing answers — which is what it's all about — it's less than optimal. It would be best if the SR.SE questions were shown to the respective experts (on Stack Overflow, Super User, Server Fault, Security, etc.).
I'd like to avoid a blanket ban on anything that looks like a tool recommendation. If a question asks how to solve a problem and a valid answer happens to be “use this existing tool”, so be it.
This has been discussed a few times in the past. The reference answer for the general Stack Exchange position on product recommendations (shopping questions) is this blog post: Q&A is Hard, Let’s Go Shopping!
That said, is there room for product recommendations? Yes, probably, but the biggest problem we have with tool questions here is that they tend to be lousy questions. They're either too vague for good answers, or too open to opinion-bases answers, and sometimes as you alluded to, apply to subjects that are too volatile for an answer to be valid for long, though I think that's less of a problem here than for say, SuperUser and hardware recommendations.
Ultimately we've tended to err on the side of culling product recommendation questions, but I think the decisions to close are usually appropriate regardless, and we do often discuss, and always welcome tools questions in The DMZ.