I thought this question (How to open a file from the Internet in a secure way?) would be off-topic, but apparently some people seem to think otherwise.

Where do we draw the line between professional questions and non-professional questions?

IMO, would be nice to keep the quality of questions relatively high before we attract all kinds of questions and users.


8 Answers 8


I agree, I think that's off-topic.
Moreover, the scope of this site still needs to be clarified: As it was originally envisioned, it was Application Security - although still pretty wide, it's pretty clear what is in and what is not.
Now that the powers that be want to have this site a merged one with XXX, we need to define what is in there.
I'm not thrilled about "IT" security, since that can be perceived as outing dev shops that dont HAVE an IT department.

Whatever is decided, the blurb and title need to be consistent....

  • 2
    Im not sure I agree. Given the quality of questions and the content provided I think people generally already "get" the scope of the site. I don't see a problem in posting questions so long as they have an IT security flavour to them. Commented Nov 24, 2010 at 3:09
  • 2
    @Anonymous: That's exactly the problem, we keep seeing non-IT-Security questions, end-user type questions are NOT in scope here. On the other hand, there was someone who was hesitating in posting technical secure coding questions, which IS very much on topic.
    – AviD Mod
    Commented Nov 24, 2010 at 12:05

I think we should welcome most any question where a good answer requires what I'll call a security mindset. I think that our expertise in that area is what distinguishes this site from most of the others.

Many folks, whether sysadmins or programmers or managers or the proverbial grandmother are just trying to get a task done and will often take a shortcut without thinking about the consequences. This is the site where all those sorts of folks should get to interact with people who are adept at seeing the problem from all angles, thinking like an attacker, and explaining the consequences, and how to avoid such problems and design for security.

It is an advantage to be able to help all those folks see this mindset in action for their home systems. The major downside I'm concerned about is that some great IT folks will get tired of seeing questions about "mere" home systems. To them I suggest that the growing wave of spearfishing attacks means that we actually do have to get end users educated about these things, and we often want their home systems secure also. So I think it is shortsighted to restrict this to what the "pros" want to talk about. Keeping an ear to the ways that end-users think about things will help us design improved user experiences and better explain things to our users.

  • I do agree in principle with your security mindset, however we do need to balance this with aiming at "professionals". I don't think we need to be overly strict on the "no home users" line anymore, but then I really dont want this to degenerate to those proverbial grandmothers, either. I think we can find a good balance, though, as long as we require that security mindset from the "home users" too.
    – AviD Mod
    Commented Jun 14, 2011 at 0:32
  • well said! I totally don't understand the argument that the question is off-topic. I think you've articulated a good, clean set of criteria.
    – D.W.
    Commented Jun 20, 2011 at 4:27

I think the line is fuzzy - I work from a home office, but that needs securing too, so I would selfishly prefer that questions about securing home offices be on-topic. It seems the distinction should be not the subject matter, but the vagueness of the question. The site is supposed to be for "IT security professionals", so I would expect questions that are specific and require answering by an IT security professional:

  • define a problem that has been encountered
  • describe the "known unknowns"
  • explain what you have tried
  • ask for expertise on where to go next

Given a well-asked question, I don't mind whether the target environment is a one-person office or NURV. Conversely, a question like "how do I secure $FOO" with no other information is not something I would answer, even if you were Symantec's CSO.

  • +1 : this works for me
    – Rory Alsop Mod
    Commented Dec 13, 2010 at 12:10
  • Heh, not sure I want to be answering questions for NURV... But my issue isnt with the one-person office, its my mother. Not a freudianism, but that type of non-professional person who finds a virus on her computer, or is told she should use a personal firewall, or forgot the password to an encrypted zip file - and is asking (even with copious amounts of irrelevant detail) what to do / which to choose / how to crack / what this all means and why are we even here. Even if we decide the distinction is not professional/non, we have to find a way to make those clearly far out of scope.
    – AviD Mod
    Commented Dec 13, 2010 at 20:01
  • See, so now I'm torn... this question is exactly the type I was talking about, but what if this a computer he uses for work...? Me, Id wanna mclose it straight off, but I can tell there's not yet a consensus...
    – AviD Mod
    Commented Dec 14, 2010 at 5:54
  • @avid: for me, that meets my "too vague" definition.
    – user185
    Commented Dec 14, 2010 at 8:50
  • @AviD - definitely agree that that one is a close. For a start, if someone has a virus 'x' infection, the av vendors are best placed in most cases to talk about specific removal. Here I think we concentrate more on how to ensure the controls in place (including av) in a large or small office are appropriate.
    – Rory Alsop Mod
    Commented Dec 15, 2010 at 8:19
  • @Rory - done...
    – AviD Mod
    Commented Dec 15, 2010 at 9:31
  • @Graham, what about security.stackexchange.com/questions/1177/…? On the one hand, this is clearly an enduser question - he's looking for personal firewall, and from the tone it doesnt sound like he's thinking of deploying this en masse to his whole network. On the other hand, this is clearly a real, specific, intelligent question, clearly about security, and has a specific issue he's looking to solve... My feeling is ontopic, but its hard to explain the delineation there...
    – AviD Mod
    Commented Dec 16, 2010 at 9:12

Recently I became active on Stackoverflow though I already googled it dozens of times. But there are questions from Programming Gurus and beginners, even questions about macros in Office suites. I thought security.stackexchange.com might have the same scope.

Maybe I am alone with my opinion but I have the feeling that the IT security community is kind of isolated. Everytime I see IT security forums it makes me think IT security is something like rocket science.

And take these questions for instance:

Resources to learn about security

Best website to learn computer security basics?

I think they prove that there is a deficit in exchange of IT security knowledge. (And I guess you rarely see these kind of questions on ther IT security forums...) Lots of people (including me) wonder why there are still people out there that do not update their system regularly or think appriopriately about IT security. The knowledge just doesn't flow...

Besides: If there are 95% pro questions about some weird DNS stuff, I guess 5% stupid questions shouldn't bother too much... And maybe a significant share of these might become very engaged in IT security after seeing that the learning slope isn't that steep...

Just my 2 cents...

  • 1
    It wasnt so much a question about the level of questions, as to the content. That is to say, its about "professional security", not "security professionals", the difference being the security for a corporate/development/etc setting, as opposed to security for your home. Beginners are not a problem, au contraire (as long as the majority are indeed "professionals").
    – AviD Mod
    Commented Nov 23, 2010 at 0:01
  • 2
    Ok I agree. Still I have problems in drawing a sharp line between non-pro and pro security. Is a malicious spyware-attack on a laptop that is used for private and (non-IT-)business matters and analysed by an IT professional considered "non-professional security"? Of course I am refering to my question security.stackexchange.com/questions/667/…
    – Philip
    Commented Nov 23, 2010 at 17:58
  • 1
    I would say that's still not IT-type, and I think its pretty clear. As @Olivier stated the original q, this is "end-user" type question, not IT-related. It is possible there might be some gray area - like the q on PGP - but I think usually it would be very clear. As I said in another comment here, compare to the difference between SF/SU - it's usually pretty clear (though admittedly here we cross the lines more...)
    – AviD Mod
    Commented Nov 24, 2010 at 12:14

There are four themes which I think summarise the discussion here so far:

  1. The FAQ is currently not representative of the questions expected
  2. The questions we want to encourage are related to people who are IT security professionals, professionals who have to implement IT security, and people in corporate settings having to deal with IT security issues (from CIOs to home offices).
  3. We don't want to leave non-professionals out in the cold, especially if their questions meet all other criteria and are asked well
  4. IT security affects everyone that uses a computer (and probably many who don't)

Now the content of the FAQ is the subject of other questions but I think when it's resolved things will become a lot clearer. The dilemma stems from points 2 and 3 but I think simplicity is the key - answer questions relating to point 2, close questions relating to point 3. I think a good line in the sand is a home business (point 2) and working from home (point 3). The responsibilities and context are different, even if the advice is the same (which means those working from home can use the answers to the home business questions!).

When closing questions because of point 3 I think it should become etiquette to leave a comment pointing to another resource that answers the question (security blogs, OWASP, etc): "we want to answer your question, just not here." If the question's really good or could be of use to professionals then there's nothing wrong with the community making exceptions and answering the question as long as the exception's explained in a comment. This helps clarify the expectations of the site while being helpful and spreading knowledge if the question deserves an answer.

  • I dont know, @Ventral... Some very good points here, but "home business" might have less to do with ITSecurity than "working from home". E.g. a home-based graphic designer business would be offtopic, whereas working from home via VPN would be ontopic. But a homebased security consultant, would be ON topic (but maybe I'm biased ;) ).
    – AviD Mod
    Commented Dec 27, 2010 at 21:09
  • @AviD I was thinking along the lines of the home based graphic designer business would have some sort of corporate responsibility towards security (credit card payments, personal data etc) whereas someone VPNing to work from home would already have someone else concerned with security (e.g. whoever set up the VPN - obviously a grey area if they are one and the same ;-)).
    – Ventral
    Commented Dec 27, 2010 at 21:44
  • credit cards and such, thats the same as any personal security that your grandmother would have too. Whereas VPN, the someone concerned with security would probably be the one asking :)
    – AviD Mod
    Commented Dec 27, 2010 at 21:46
  • haha, I just had the mental image of my grandmother trying to get her head around PCI DSS :D. As I said, both people need to know the answer to the question and they may well have the same answer.
    – Ventral
    Commented Dec 27, 2010 at 21:51

I think the stack is at loggerheads.

We have a decision to make, attract regular folks with genuine IT Security questions, or continue to attract bits and pieces of the CISSP crowd with sysadmins who've been migrated here from serverfault, and programmers who've migrated from stackoverflow.

I'm not knocking the site, it's a good resource and I'm finding the opportunity to answer some of these questions helps me dig deeper into knowledge areas I'm already adept with. Unfortunately in order to get out of beta I think the site is going to have to become friendlier to engineers. If not users, these individuals can get us closer to going live, and I think it's perfectly acceptable (if we maintain a strict tagging policy) to gain more of that audience.

To be honest, I've started popping around on Serverfault, and the questions there that are asked which are security related are often downvoted and closed rather than answered well. I'd imagine if we can get more of these questions migrated here it would help answer some questions.

The big cons aren't only for CISO types, they go over strategies used by the badguys to compromise hundreds of thousands of end users. The "family IT guy" could use our expertise to help limit our adversaries resources. If we maintain strict editorial control over the questions, and make sure there aren't too many "hinky" ;) questions I think it's better for us all.


IMHO, the correct answer is that we do not draw the line what so ever between the two groups of noobs and pros. Questions from both groups are equally valid to a IT Security (the reason for this site) perspective. A question at one end of the spectrum is no less relevant than a complex or technically difficult one. You are under no obligation to answer the question if you think its beneath you. However someone asked it - Because they want to learn! Drawing a line simply isolates these people and causes untold harm to the site.

  • as was repeated here before, its not about expert/noobs. Its about professional/corporate usage, as opposed to home/private usage. Think about it as the difference between what someone might need at work, as opposed to your momma.
    – AviD Mod
    Commented Nov 24, 2010 at 12:08
  • Or better yet, the difference between ServerFault and SuperUser. (Of course most questions are not necessarily SF-scope in nature, also SO, and also many others).
    – AviD Mod
    Commented Nov 24, 2010 at 12:10
  • @AViD yes I agree about the difference between ServerFault and SuperUser, however I disagree about your deliniation between corp and home. Imho, home's are becoming more and more challenging from an IT Security perspective, and in general the same skillset applies to making them more secure. Commented Nov 24, 2010 at 22:54
  • 1
    However, if this site wants to attract higher-end experts, e.g. CISO's and such, the question-set must remain on-topic. As it is its already tipped a bit to the lower-end, sysadmin-ish "how do I configure this" type of questions, and not enough advanced, research-based or risk-analysis type questions.
    – AviD Mod
    Commented Nov 25, 2010 at 5:50

Questions such as the example you give would be more suitable on Super User. I think you can draw the line with questions about security from a user or programing perspective on the appropriate sites, with questions specific to security such as how to secure against an attack or certain tools or techniques would be on this site.

As for the focus, some people seem to think this is only for enterprise security professionals, when the FAQ makes no such mention of enterprise. We should just keep it for people in the security profession, without qualifying by scale.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .