17

In general, Sec.SE bans questions on tool recommendations. This answer appears to be the most recent statement by a moderator.

I propose we reconsider this ban and allow tool recommendations in specific circumstances. In particular, when the question is "How do I...?" and the answer is "Use ... tool". An example I've just seen is this which could be reworded as "How do I audit Java code for security flaws?"

Tools are a crucial part of doing technical security. This restriction creates a significant gap in the kind of questions that can be asked here. Sure, people can go off to other sites to get answers, but why not just allow them here? Well, people have spoken before about that and there seem to be two main reasons: timeliness and spam. However, I think that both of these are poor arguments, for the following reasons:

Timeliness: most tool recommendations are not especially timely. For "How do I do a port scan?" the answer "Nmap" has been valid for at least 15 years. In any case, many topics covered here are timely to some degree, and we deal with this by editing answers and adding new ones.

Spam: any blatant spam can be dealt with by flags and moderation, just as any other topic. I think the real concern here is self-promotion: get your mate to ask "How do I skin a womble?" then you answer "Buy the all-new Acme womble skinner". This is a fair concern, but we can deal with this in the usual way. If skinning a womble isn't interesting to the community, the question gets downvoted. If the Acme womble skinner is a duff product, the answer gets downvoted.

Seriously guys, reconsider the ban on tool recommendations, it detracts from the site.

  • 1
    Nope. There's another site for those. – Iszi Nov 9 '15 at 19:37
  • 4
    @Iszi - Security tools are a specialist thing. SoftwareRecs doesn't have the patronage of security people that are on this site. – paj28 Nov 9 '15 at 21:11
  • FWIW I totally agree with @paj28 , I find the timeliness argument amusing given that we're ok with SSL questions (there's been just one or two changes in recommendations there in the site's lifetime) tool recommendations are in many cases more stable than other areas. – Rory McCune Feb 29 '16 at 13:33
7

There's a missed element to your 'Timeliness' argument, which is 'completeness'. How do I do a port scan? Nmap, sure. But unicornscan if you want it fast, hping3 if you want to stay under the radar, but really, you should write your own tool in C to make sure your signature is completely unknown to IPS.

Tool recommendations have too many different options, even in something as simple as a port scan. Then start the debates: "Nmap sucks for UDP scanning!" (well, it does).

Yes, as I state in the Meta question you link, there really are valid tool questions.

As for the Java question you linked, it really, really looks like a shopping question, one that will suffer from a timeliness issue. I do not think that that particular question could easily be reworded as "How do I audit Java code for security flaws?" and still retain the author's intent. But I do agree that other questions that are worded to ask for tools could be reworded as you suggest.

All that said, if the community wants to revisit this issue, that is certainly possible, but I fear that although potential opportunities might be missed, the overall quality of the questions and answers would remain high.

  • 2
    How many votes do I need for this to become Sec.SE policy? :-) – paj28 Nov 11 '15 at 22:22
  • In a world with so many different tools to achieve the same goals, I think its very useful that people with knowledge can give their recommendations. Even with closed questions, I have learn about tools that I didn't even know they existed, like in the example: "unicornscan" (thanks!). How can we learn which tools are better for doing X functionality if we are not allowed to ask here? Its just my humble opinion. You know better than me what is best for this community. – lepe May 14 '16 at 14:51
  • 1
    I know that recommendations may never have a correct answer and that it is one reason to ban them. Maybe one solution is to promote the use of softwarerecs (if the question comply with the rules). I was thinking: How difficult it could be to create a sub-section like: security.softwarerecs.stackexchange.com linked to this community? – lepe May 14 '16 at 15:19
  • Having softwarerecs as a separate site does seem to isolate it from many of the experts who can answer...? – Bryan Field Aug 11 '16 at 19:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .