Should the Security Stack Exchange tour page list best security tool questions as bad questions?

Question

If the consensus really is that security tool questions do not belong here, should the tour site be updated to list these questions (e.g. what tool should I use to perform security task x?) as an example of what not to ask here?

It seems many people are being penalized with downvotes / question closures (including myself) for asking questions about which security tools we should use for task x (e.g. log file review). Although I read the tour page, I did not see any reason to not ask such a question.

Here is a question about this in meta: Asking about software solutions

Here is an example question that has been penalized (downvoted): https://security.stackexchange.com/questions/72267/os-x-pentesting-and-information-security-tools-which-are-your-favorite

Another example: my question about good log file review tools was downvoted, closed, then deleted, with the reason given that these questions tend to go out of date quickly. I began to delete it myself when the downvotes and closure were applied, but was warned that I should not delete a question with answers applied, so then I did not delete it.

I personally believe such questions add value (e.g. someone can see what good log file review tools are). Perhaps to resolve the questions being out of date, the reader of the question can see when the answers were provided and judge whether or not it is still valid, and even provide a new list of tools when the old list is sufficiently outdated.

Answer 1

The key problem here is that 'best' is an opinion, and Stack Exchange is very much not a place to ask questions that will result in opinions.

As an example, I may really like tool X. Someone else may hate it and prefer tool Y, which I think is terrible.

How would you decide which is correct for you from that info?

We already have two great pages for what you should and shouldn't ask, and this is covered well:

To prevent your question from being flagged and possibly removed, avoid asking subjective questions where …

• every answer is equally valid: “What’s your favorite ______?”
• your answer is provided along with the question, and you expect more answers: “I use ______ for ______, what do you use?”
• there is no actual problem to be solved: “I’m curious if other people feel like I do.”
• you are asking an open-ended, hypothetical question: “What if ______ happened?”
• your question is just a rant in disguise: “______ sucks, am I right?”

As an aside, fanatical devotion to a particular tool does happen a lot in the security testing industry. Often with no real basis, as an objective viewpoint shows that many tools are broadly as bad/good as each other and in fat are best used together to minimise specific false positives/negatives.