A few weeks ago I had a question related to YARA rules syntax where YARA was used in VirusTotal. I asked it here first, because YARA is a tool made firstly for security researchers, and got no replies.

I then deleted my question and asked it on StackOverflow. Using the search function, it looks like more YARA questions are in StackOverflow than here but, as said earlier, it is quite a specific tool directed at people who work with security.

A rough example of such case could be:

"Why does my rule testRule match a file that does not have a string $a1 when I specify it in the condition?"

So a question of such nature should be asked here or somewhere else?

1 Answer 1


No. Questions about syntax belong on sites closer to the relevant technology. Just because the file is used in a security tool does not make it a security question.

Think in terms of the OSI model. Syntax is a file/parser layer. Security is a few layers above that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .