14

This is a variant of the solve-my-homework issue:

I noticed a few times that users ask questions without disclosing that their problem is taken from a running security challenge. Well-phrased questions that stem from "hacking games" can be good. But what concerns me is when someone asks us to help with an ongoing competitive challenge that has a ranking system or offers rewards. Even if they disclose where it's from we're basically helping them cheat.

Should I call them out / add a note about the source / vote to close, or is it entirely irrelevant where a question comes from when it's on-topic?

4 Answers 4

Reset to default
11

Hacking challenges, just like homework, are there for people to learn. And just like homework, we should help them with their thought-processes and not do it for them. The standard, "tell us what you have done and how you think it should be solved" comes into play.

If you see a question that is from a challenge, then please do note it in a comment, edit the question, or even flag it (depending on severity or runaway voting/posts).

1
  • What would happen if you flag it? Would you go on a hunt to see if it is actually from a challenge? We (on crypto.SE) had one that was an internal challenge within a University...
    – Maarten Bodewes
    Commented Oct 24, 2018 at 12:32
3

I think it is a little more gray. There are some questions I've seen in the past that are straight from the OSCP. Cheating on the OSCP (or SANS, or ...) has major consequences. I avoid those questions and I think SANS/Offensive Security/other certifications should be closed immediately.

Other questions I've seen are from WebGoat, hackthissite, or other challenges. They fall in the challenge bucket, but exist for the purpose of teaching. I'm more willing to help people learn for those.

But it's not always clear where the questions are from and when the specific challenge ends. Do we implement a blanket "do or do not close" policy? I'm learning towards putting on hold until the asker can confirm where the question is from.

1
  • If anyone sees an OSCP question, please follow my advice above and flag (I consider certification exam questions high severity).
    – schroeder Mod
    Commented Jan 3, 2017 at 11:24
2

I would suggest to put such a question On Hold, until the competition is over, if you can prove it's for an ongoing competitive challenge. Even though those competitions is for learning-getting the answer straight up won't help them learn in the long run.

1
  • We're having the same discussion on the crypto site. But sorry, I don't see how it is our responsibility to track competitions. I'm certainly against having it as a responsibility for the moderators. The asker is certainly not the person to do it (they're breaking the rules, right) and "the community" cannot do it either because you cannot give assignments to non-entities.
    – Maarten Bodewes
    Commented Oct 24, 2018 at 12:30
-1

Not only do I think such questions are on-topic for Security.SE, I think of them as good practice for social engineering (a critical skill in many security challenges.) If they can convince someone knowledgeable to help them, they're better qualified than someone who flounders without asking for help.

3
  • 1
    Why would you approve of people tricking us into solving their homework? I often answer poor questions if I think I'll learn something and don't feel "social-engineered" afterwards. Also I disagree that applying social engineering is a critical skill. And from my experience such questions are often too localized to be of any use for someone else.
    – Arminius
    Commented Dec 27, 2016 at 22:49
  • Sorry, but no. Not only do I think this is not a skill to be exercised on a website for getting answers to honest questions, but this crosses ethical boundaries. Do we start answering certification challenge questions because we were socially engineered in to answering them? If anything, I think we should be more strict about those kinds of questions and close them rather than leave them.
    – h4ckNinja
    Commented Jan 2, 2017 at 21:20
  • 1
    Why do I approve? Because we have no realistic hope of stopping them. We have no effective penalty, no perfect diagnostic, and no incentive nor reward for not helping them. Better to acknowledge that we will tolerate them rather than pretend we can stop them.
    – John Deters
    Commented Jan 2, 2017 at 21:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .