2

The DMCA protects (cf. Fair Use) research of any software system (including reversing) for the purposes of interoperability. This is how security researchers survive... If I'm interested in discussing how an existing security system works to understand how I can inter-operate with it from a software standpoint (or even if I simply want to understand it so I can learn from it), is this the appropriate forum for that? Does it matter if the system is proprietary or not as far as this community here is concerned (the DCMA says, "no")?

2
4

As far as the security part goes, yes it is on topic. The tricky bit though is having an actual question - SE isn't really built for discussions. If you have a specific question (and a security question, not just a question about a security system), go right ahead.
If you're not sure, you can ask here if the specific question is a good fit...

15
  • Btw to be clear - we don't really care what the DCMA says :-) Though Wassenar might be more pertinent.... – AviD Jan 7 '16 at 8:05
  • I recently had a question put on hold because it was about inter-operating with a "proprietary system" that I guess people assume no one can answer. Is there some other factor that would cause the community here to gripe about questions of that nature? – David Cowden Jan 7 '16 at 8:41
  • @David, it could be you were asking about details that no one else would know? Or perhaps (we have a standard close reason for this) you were asking to be given instructions on hacking a specific system, and not from a place of knowledge. (ala "giv meh teh codez"). Which question was it? – AviD Jan 7 '16 at 9:05
  • I was asking about the algorithm used to generate codes for multi-factor authentication of a user for a popular software system. The company that owns the system forces users to use their mobile app in order to obtain authentication codes. What I'm interested in is if this is a actually a technical limitation of their system, or if they use a standard two factor scheme like most enterprise services do. If the latter is the case it means I can potentially obtain the seed and configure my existing rolling code software to generate codes for use with this service. – David Cowden Jan 7 '16 at 9:19
  • But, based on people's reactions, I suspect the former is the case, meaning I cannot do what I desire. In any event the question is certainly able to be answered ("yes" the system uses a standard scheme, or "no" the system does not). I simply wanted to ask the community here in the off chance that someone happened to be familiar with the software system. The aversion seems to be along the lines of, "how could anyone know?" but my counter is "well that's what interoperability research is for". security.stackexchange.com/questions/109850/… – David Cowden Jan 7 '16 at 9:22
  • I think the problem with that question is that as it is a proprietary, closed source system, it is unlikely that anyone would have an authoritative answer. Or, if one does have internal knowledge, unlikely they would be able to talk about it publicly. – AviD Jan 7 '16 at 9:25
  • Edited my above comment to clarify. Yeah I understand that logic but I guess that kinda brings us in a circle. If no one can be an authority on a proprietary system, is discussion of reversing it for the purposes of inter-operability considered on-topic? Perhaps I'm a security research who's taken a look at one of the clients and notice it links against a popular security library known to be helpful when implementing rolling codes for two-factor auth setups.. I might have relevant insight. Or maybe the question piques my interest.. idk. That's kinda why I wanted to front it to the community. – David Cowden Jan 7 '16 at 9:29
  • Yeah I get what you're saying, but you're implicitly asking if someone has done that research, not asking something specific that would help you do the research. Also, despite being a security system, interoperability per se is not really a security question... So this does leave the question being a bit borderline, on several axis. That said I do think you have the germ of a good question there, I just don't know what it is :-) If you can edit your question (or ask a new one) to focus either on specific aspects, or research guidance, it could be a lot more useful. – AviD Jan 7 '16 at 9:36
  • Thanks, I'll give it some thought. – David Cowden Jan 7 '16 at 9:38
  • @DavidCowden: If this is the question I'm thinking about, what annoyed me mainly was that the answer, whatever it could be, could obsolete very quickly since, as a proprietary system, the owner company is free to make it evolve or change it in any way at any time. If, for instance, you would bring an authentication scheme built from some reverse engineering and asked if it is a standard one or a custom one, I think such question would be more on topic. – WhiteWinterWolf Jan 7 '16 at 10:42
  • @WhiteWinterWolf I'm more than happy to investigate myself.. I guess I just wanted to get a feel for the waters before I dove in. If someone else has already looked into it why duplicate the work? Like I said, what confused me is that the question was marked off-topic, not that it may have taken awhile before someone (perhaps even I) got around to answering it--people do answer their own questions and it can be quite instructive. – David Cowden Jan 7 '16 at 11:14
  • As for volatile questions, is that a formal policy or just a guideline? I can fathom plenty of questions that have the potential to go obsolete quickly as standards and best practices change. I took a glance at the top questions this month and security.stackexchange.com/questions/108428/… seems pretty volatile as it's asking for the current state of affairs surrounding a recent vulnerability. But I'm new here, if volatile questions should be avoided, well, now I know. – David Cowden Jan 7 '16 at 11:21
  • David - regarding your specific question that got closed. It is off topic because you ask for discussion, and because it should really be asked of Valve themselves. – Rory Alsop Jan 7 '16 at 14:55
  • @RoryAlsop I didn't ask for discussion. I asked for an answer. Read my comment there and read the question, please. Sorry that I implied a longer discussion/explanation type answer is what might be suitable for the question. It's also on hold, not closed. If you read the comments here then clearly there's a gap in how questions about researching proprietary systems are handled. That or the community is entirely subjective... – David Cowden Jan 7 '16 at 20:57
  • The idea that "no one probably can answer that, even though an answer exists" is pretty bogus IMO... I might as well just read literature and query Google if all I care about is preexisting knowledge. – David Cowden Jan 7 '16 at 21:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .