Lets allow tool recommendations in specific circumstances

Question

In general, Sec.SE bans questions on tool recommendations. This answer appears to be the most recent statement by a moderator.

I propose we reconsider this ban and allow tool recommendations in specific circumstances. In particular, when the question is "How do I...?" and the answer is "Use ... tool". An example I've just seen is this which could be reworded as "How do I audit Java code for security flaws?"

Tools are a crucial part of doing technical security. This restriction creates a significant gap in the kind of questions that can be asked here. Sure, people can go off to other sites to get answers, but why not just allow them here? Well, people have spoken before about that and there seem to be two main reasons: timeliness and spam. However, I think that both of these are poor arguments, for the following reasons:

Timeliness: most tool recommendations are not especially timely. For "How do I do a port scan?" the answer "Nmap" has been valid for at least 15 years. In any case, many topics covered here are timely to some degree, and we deal with this by editing answers and adding new ones.

Spam: any blatant spam can be dealt with by flags and moderation, just as any other topic. I think the real concern here is self-promotion: get your mate to ask "How do I skin a womble?" then you answer "Buy the all-new Acme womble skinner". This is a fair concern, but we can deal with this in the usual way. If skinning a womble isn't interesting to the community, the question gets downvoted. If the Acme womble skinner is a duff product, the answer gets downvoted.

Seriously guys, reconsider the ban on tool recommendations, it detracts from the site.

Answer 1

There's a missed element to your 'Timeliness' argument, which is 'completeness'. How do I do a port scan? Nmap, sure. But unicornscan if you want it fast, hping3 if you want to stay under the radar, but really, you should write your own tool in C to make sure your signature is completely unknown to IPS.

Tool recommendations have too many different options, even in something as simple as a port scan. Then start the debates: "Nmap sucks for UDP scanning!" (well, it does).

Yes, as I state in the Meta question you link, there really are valid tool questions.

As for the Java question you linked, it really, really looks like a shopping question, one that will suffer from a timeliness issue. I do not think that that particular question could easily be reworded as "How do I audit Java code for security flaws?" and still retain the author's intent. But I do agree that other questions that are worded to ask for tools could be reworded as you suggest.

All that said, if the community wants to revisit this issue, that is certainly possible, but I fear that although potential opportunities might be missed, the overall quality of the questions and answers would remain high.