Are questions from end-users on topic here?

Question

I'm new here. The help says the site is for "security professionals", but I'm wondering whether the site is also open to questions about security from end-users.

Basically my question is about how I (as a user) can assess the security risks associated with installing a Chrome plugin, along with details about my specific case.

Would that be on topic here? If not, is there somewhere else on the Stack Exchange network where it would be? (Maybe SuperUser?) Please let me know.

Answer 1

Yes, absolutely - the "for security professionals" is the target for your questions, i.e. "when you want to ask a security professional".

Naturally there is a heavy bias towards experienced professionals, but we do not exclude questions from non-professionals. However...

That said, we do expect a certain level of understanding - if it can be answered by doing basic research, e.g. reading the relevant Wikipedia article, then please don't ask that.
Also I assume that you've read the Help Center / OnTopic sections, and made sure your question is ontopic..

It does sound like you have a good question - how can a non-expert assess the security risks associated with installing software, assuming you are familiar with the technical parts of that - so go right ahead!

(On the other hand, that may have already been asked and answered, so I would suggest start by doing a search.... :-) )

Answer 2

I want to be able to reference this meta thread in close comments, so I'm gonna add my $0.02. I would love to get feedback.

The issue here doesn't seem to be about whether the asker is an end-user or not, or even their knowledge level, but about the nature of the question. From what I've seen in the year that I've been active, security.SE seems to be most favourable towards questions about security architecture, or the design of secure systems. The most upvoted answers tend to be theoretical / logical, sometimes with a bit of math, or a diagram, or links to further reading. The most upvoted questions are those that prompt this kind of answer, and can come from a variety of askers: programmers, network admins, physical security specialists, human security specialists (aka "trainers"), or people looking to secure their personal machines / home networks.

I my experience, the point is to encourage users to post questions of the form "how do I design this with security in mind?", rather than "how do I configure software X for security?". The latter belongs on SuperUser (for end-user software) or ServerFault (for server software). The end result will probably be that we tend to cater less to end-users, but not because we're specifically excluding them, just by the nature of questions that we like to answer, and those that tend to get very little attention here.

Chrome plugin example:

Questions about Chrome plugins that would be on-topic here include:

• "What are the risks / concerns with installing a plugin that does $X?"
• "Is it possible for a plugin to protect me against attack $Y?"
• "I'm writing a plugin, what's the best way to do $Z?"

Questions about Chrome plugins that would not be on-topic here include:

• "I have installed plugin $Abcdef, how best to configure it?"
• "Should I use plugin $Ghijk or plugin $Lmnop?"
• "What's the best plugin for doing $A?"