-3

If the consensus really is that security tool questions do not belong here, should the tour site be updated to list these questions (e.g. what tool should I use to perform security task x?) as an example of what not to ask here?

It seems many people are being penalized with downvotes / question closures (including myself) for asking questions about which security tools we should use for task x (e.g. log file review). Although I read the tour page, I did not see any reason to not ask such a question.

Here is a question about this in meta: Asking about software solutions

Here is an example question that has been penalized (downvoted): https://security.stackexchange.com/questions/72267/os-x-pentesting-and-information-security-tools-which-are-your-favorite

Another example: my question about good log file review tools was downvoted, closed, then deleted, with the reason given that these questions tend to go out of date quickly. I began to delete it myself when the downvotes and closure were applied, but was warned that I should not delete a question with answers applied, so then I did not delete it.

I personally believe such questions add value (e.g. someone can see what good log file review tools are). Perhaps to resolve the questions being out of date, the reader of the question can see when the answers were provided and judge whether or not it is still valid, and even provide a new list of tools when the old list is sufficiently outdated.

6

The key problem here is that 'best' is an opinion, and Stack Exchange is very much not a place to ask questions that will result in opinions.

As an example, I may really like tool X. Someone else may hate it and prefer tool Y, which I think is terrible.

How would you decide which is correct for you from that info?

We already have two great pages for what you should and shouldn't ask, and this is covered well:

To prevent your question from being flagged and possibly removed, avoid asking subjective questions where …

  • every answer is equally valid: “What’s your favorite ______?”
  • your answer is provided along with the question, and you expect more answers: “I use ______ for ______, what do you use?”
  • there is no actual problem to be solved: “I’m curious if other people feel like I do.”
  • you are asking an open-ended, hypothetical question: “What if ______ happened?”
  • your question is just a rant in disguise: “______ sucks, am I right?”

As an aside, fanatical devotion to a particular tool does happen a lot in the security testing industry. Often with no real basis, as an objective viewpoint shows that many tools are broadly as bad/good as each other and in fat are best used together to minimise specific false positives/negatives.

  • I would think those pages would be good to link to or include in the site tour, I believe this is the first time I have seen them. They are a good resource to know what is expected on this site. – Jonathan Nov 4 '14 at 15:34
  • You get to them from the tour if you click on the Looking for more in-depth information on the site? Visit the Help Center button which you get to right after reading the tour, or from the help link at the top of every page. – Rory Alsop Nov 4 '14 at 15:40
  • It's interesting to me that people have some sort of inherent problem with subjectivity. As if this is an inherent problem to be avoided, and there's one "correct" answer to problems. I would disagree with this approach just out of habbit, and find the idea of "correctness" and a rejection of subjectivity to be destructive, and out of balance thing. It is of course something I unfortunately see far too much of in IT. – Steve Sether Dec 26 '14 at 15:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .