4

I was looking at Need to access old forgotten router that only supports SSLv3 and while I am fine with having it on the site, I am wondering if it fits on this site.

On the Topic help page it explicitly says:

IT Security Stack Exchange is for Information Security professionals to discuss protecting assets from threats and vulnerabilities.

Empasis not mine.

This question does not seem to fit that description. Perhaps it could be argued that it was about protecting an outdated router from vulnerabilities, but this isn't even mentioned in the question. Therefor, it would seem that this (very popular) question is off-topic. If this is allowed, it would seem that a question about training a dog would be on topic because you want to train the dog not to urinate(threat) on your server(asset).

Is this question on topic?

  • If it is, what makes the dog-training question off-topic?

  • If not, should it be? How would the definition be expanded to allow this question without allowing too much?

4
  • I believe it is on topic, and falls within the portion of the quote just after your sentence: ".... Topics include, but are not limited to:"
    – user84662
    Dec 24, 2015 at 1:26
  • @iancnorden My understanding was that a question must fit under the sentence I quoted, and that the proceeding was simple examples of what topics valid questions might fit under, whereas your interpretation seems to be OR; A question is on topic if it fits under the first sentence or fits under one of the listed categories. If it is as you think then the page should be clarified, and that would answer my question.
    – Shelvacu
    Dec 24, 2015 at 1:31
  • Well then, wouldn't the act of penetration testing, as an example be the opposite in this case? You are leveraging vulnerabilities, risks, or flaws to gain access or subvert systems. The act or in the course of penetration testing you are not then protecting assets. I think your interpretation is much too strict.
    – user84662
    Dec 24, 2015 at 1:55
  • @iancnorden This question is not about penetration testing. It isn't about leveraging a vulnerability to access a system; if the question was “this appliance runs an SSLv3 server, how can I gain access to it?” then it would of course be on-topic, but “I have all the credentials and necessary access, what software can I use?” has nothing to do with security.
    – Gilles 'SO- stop being evil'
    Dec 24, 2015 at 16:59

2 Answers 2

Reset to default
6

From my perspective, the question is off-topic. It is actually more of a SuperUser-type question, as the answers indicate that the solution is found in a browser config. So, I can see your confusion.

But, it turns out to be an interesting problem, and this community loves puzzles. This question was highly voted, along with the accepted answer before I came across it, and decided to leave it simply due to its popularity.

So, strictly speaking, it's off-topic, but this is a community site, and the community regulates itself, so, some of the interesting but off-topic stuff stays alive.

Dog training is tangentially relevant to security, and loosely at that, and the solutions are found in the realm of dog training and not security. The effect might end up applied to security, but the question itself is about dogs, not security. From my perspective, loosely tangentially relevant questions (and we get a lot of those) need to be directed to the community that will best provide an answer and the application of that answer to security is left as an exercise for the reader.

2
  • I don't see what makes this problem interesting. It's trivia (which is presumably why it got so many views). This community isn't the right place for it, either. What do security professionals know about choosing a web browser supporting a deprecated protocol? The only connection with security is the fact that the protocol was deprecated for security reasons, and it's completely irrelevant for the problem at hand. Super User would be the right place for it.
    – Gilles 'SO- stop being evil'
    Dec 24, 2015 at 16:56
  • 2
    Now I know how you became a mod, very wise decision! You let the community win. 51 up-vote win over 3 votes to close the question.
    – Ulkoma
    Dec 24, 2015 at 21:53
3

As you surmise, the question is off-topic. It isn't about designing or analyzing a security policy. It isn't even about configuring a tool to implement a security policy, which is strictly speaking off-topic (configuring IT tools is off-topic here, and usually on-topic on sites such as Super User, Unix & Linux, Android, Server Fault, Network Engineering, etc.) but is sometimes borderline as there isn't a clear-cut line between understanding the policy and approximating it with the tool's capabilities (on-topic) and figuring out what to write in the configuration file (off-topic). Nor is it about using tools primarily used by security professionals (e.g. penetration testing or forensic tools).

The question asks how to find a program supporting a particular protocol (SSLv3). The fact that the reason such programs are hard to find is related to security isn't relevant to the question. It's no different from “I have an old, forgotten server that only supports rsh but I only have SSH clients, how can I connect to it?” or “I have an old, forgotten server that only accepts Gopher requests, how can I send one?”.

It seems that some people have voted to leave the question open, possibly because the question went viral and got a lot of views. Please don't do that. Having a lot of view, or having a high score, is not a reason to keep an off-topic question open. Migrating this question to Super User is the correct action. (Or perhaps closing it as unclear, because the asker didn't specify what operating system they have available — but in a typical office we can probably presume that Windows and Linux are available.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .