Is Security.SE only for professionals?

Question

I recently asked a question that made it to "Hot Network Questions" and picked up a huge number of views, upvotes and favorites in a very short time.

The moderators put it "On Hold", because the quality of the question indicated (accurately) that I am not a security professional (I am a humble programmer), and therefore my question was too vague and showed no prior research.

All true.

But as a lay person who has only a surface appreciation of security issues, what then is the correct forum for me to ask such a question? In this case, I truly do not understand the fine distinctions within the field of biometrics or identity theft, that I could ask a more focused question, or do any preliminary research. So I asked the general noob question, and I got a lot of answers that I found very helpful to my understanding. And then the question attracted so much attention that it got shut down.

So, given that I asked a dumb noob question and got a lot of value out of the answers, I'm very happy that I came to Security.SE. It just leaves something of a bad taste that in shutting down my question, the moderators are effectively telling me I'm not welcome here.

So I wish to clarify: is Security.SE only for the elite people in the Know? And if so, where else should people like me go to get their questions answered?

Answer 1

Shaul - first off, the moderators had nothing to do with the close. It received 5 community close votes.

Secondly, there is nothing that says anywhere that this was closed because you were a 'noob' or not professional.

The problem with is, and various commenters tried to explain to you, is that the question is too broad. This is why it was closed, and the close reason gives links to the help centre so you can see what you might need to do to improve it. And upvotes are not an indicator of whether something is on- or off-topic. Especially if something ends up on the Hot Questions list - upvotes then come from individuals all over the network, so are not necessarily related to our site.

If you look at the multitude of other biometric questions we have on the site you will see some of the risk calculations you should be aware of.

We encourage questions from anyone who has a problem that fits within scope, and who can write the question to be answerable. This does not require any security knowledge, although it does help if you have a little.

Answer 2

To complement what @Rory says, I'd like to point out that there is no rule that says that any question fits somewhere in the StackExchange network. By design, the SE sites concentrate on questions that can be answered in about one page of text. Of course, longer answers exist, because some people tend to exhibit a larger than average level of verbosity, given the occasion. However the general point remains: if a question is "too broad" then it is too broad everywhere; i.e. there is no such thing as a "correct forum" within the SE sites for such a question.

This implies that while the SE sites are a great source of detailed information, they cannot really cover the Big Questions that have a large scope. These must be handled somewhere else; the Internet is a large place.

Unfortunately, asking for pointers to introductory information on a broad subject, the very thing you need to make that "preliminary research", happens not to be a good fit for an SE site either, for different reasons. It is not that SE people don't consider such questions invalid, or too noobish; it just is that experience shows that they don't mix well with the dynamics of the SE sites as they operate today. Personally, when I try to imagine how would work a site that can help people understand these "too broad questions" or at least direct them to appropriate resources, well, it no longer looks like a Web site; rather like a university library.

Answer 3

I do not think you need to be a pro, but the people who tend to get up enough votes to review close votes and make those decisions tends to be people who are security pros or are at least very into security.

Discussion questions, especially on high level concepts or news stories are going to generate more opinion type questions. Support questions are usually pushed out to Super User or Server Fault - a lot of people think firewall questions or questions on how to use a security scanner are security question. Generally, the questions that those with review close vote privileges like are those on security theory, practices, situations. A lot of questions on this site get moved out or tend to be duplicates more so then something with more of a support feel like Stack Overflow or Super User.

Stack Exchange in general is not about generating discussion, but generating a resource for answers. Lots of people vote on questions, but that audience probably has a different spin than those who do the close voting.

Questions which tend to get high votes or lots of feedback are those which are on simpler concepts which more people can understand, want to know about, feel comfortable voting up or down, or are going to come up in Google. So a question like yours is accessible and allows for opinionated answers, thus it gets upvoted by the masses. I would not say the average casual user votes in line with site's Help Center. The people who are into flagging questions or who have the close vote privileges are usually more familiar with these concepts and vote as curators and not on their own personal interest.

I do not think you should walk away feeling unwelcome. The question is interesting, but more of a discussion. It is not a good fit based on the objectives in the Help Center.

Answer 4

So, I read your question, and I also would have voted the question as too broad. SE sites are for specific and targeted questions that neatly reduce to explicit answers.

Your question (whilst interesting) was beyond the scope of what the site was intended for. Your question could be the topic of a full college semester. Too broad. Why? Your actual question was this:

"Can anyone please explain clearly what the risks are, if any, with biometric systems?"

All the context to your question becomes irrelevant when you brought up emotion--for the purposes of this site.

Information security is one of the most context-dependent disciplines in existence. The questions I would have for you if you asked me as a manager or a client are legion:

Who are you protecting against? What are you protecting? For how long do we need to protect it? Besides biometrics, what other authentication mechanisms are in place, manual or automated? What is the accepted level of risk before we even have this conversation?

I might answer a question if I only have to ask 1-2 of these. But not all.