1

Should this site merge with the Security proposal, and other security-related Stack Exchange site proposals such as Cryptography and Social engineering?

In spite of the previous merges, this site still has a narrow declared target audience (it's for “IT security professionals” only!) and a restrictive name (“IT security”).

I would be interested in a SE site about security in general, from firewalls to locksmithing, from communication protocols to building security, from cryptography to social engineering. Can this site be it?

9
  • PS - Don't take the -1 vote to heart, as it doesn't affect your reputation. It's just a way to show sentiment on good ideas or ones we'd rather not see.
    – makerofthings7
    Nov 22, 2010 at 19:40
  • 1
    Narrow? I beg to differ, its already too broad. IT Security encompasses AT LEAST 5 different professions / area of expertise, with each group speaking their own language with a relatively small shared body of overlap.
    – AviD Mod
    Nov 22, 2010 at 22:39
  • AviD - What are the areas of expertise you see? I just want to match my terms with yours
    – makerofthings7
    Nov 22, 2010 at 23:02
  • 1
    @AviD: All these security people don't talk as much to each other as they should. Which leads to programmers not understanding what environment their programs are run in, IT people not understanding why insiders bypass their firewalls, software designers reinventing techniques known to locksmiths, and so on. I don't see how “IT security” can be considered too broad: it's mostly a subset of Server Fault's topic, and that's already fairly specialized.
    – Gilles 'SO- stop being evil'
    Nov 23, 2010 at 8:32
  • @Gilles: Faaaar from it. If anything, its a subset of SO/SF together, but even that is not covering it.
    – AviD Mod
    Nov 23, 2010 at 8:55
  • 1
    @Makerofthings7: At the very least (and without doing indepth analysis), there are the following distinct areas: appsec, networks, OS, risk management, and compliance. While there is some overlap, and there holes between them too, each is its own area of expertise, often (sadly) excluding or belittling the others, to the point where an expert in one will believe s/he is automatically an expert in all, since "its only applications", or "I always do risk management", or "networks is boring, it dont mean anything anymore since everything is cloud now anyway".
    – AviD Mod
    Nov 23, 2010 at 9:32
  • @AviD - HA! I have no idea how that comment got here (just deleted it). I'm on StackApps and may have wrote that in the wrong window. On StackApps, I can mine StackOverflow data for trends and other information.
    – makerofthings7
    Dec 6, 2010 at 5:07
  • A bit concerned that people are voting this question down. It is a very appropriate question to have in meta as it asking what we should be doing with the site. If you think yes to a merge, you should answer yes, or upvote a yes answer or downvote a no answer. Similarly if you think no to a merge. But the question should still stand, surely?
    – Rory Alsop Mod
    Jan 10, 2011 at 22:11
  • Please see @Iszi's question regarding questions of this type: meta.security.stackexchange.com/q/137/485
    – Rory Alsop Mod
    Jan 10, 2011 at 22:12

2 Answers 2

Reset to default
3

I think Cryptography should stand on it's own. It's not just "security" per se, but I expect there to be a lot of math that most people in Security don't need to know. Additionally we are more likely to have experts check into a localised site than a more broad one.

Similar recommendations go for the other sites you link to.

If you're interested in following a "basket" of forums, simply subscribe to the RSS feed or find a software product that uses the Stack API for your needs.

4
  • Or better, you can even just use stackexchange.com to define yourself a tagset, or use one of the existing ones.
    – AviD Mod
    Nov 23, 2010 at 9:32
  • 1
    I'm not interested in a “basket” of forums: I'm interested in a place where people with a common interest (security) but different specialities (IT, applications, banking, …) can talk to each other. And Stack Overflow shows that it works (there's a common site for C# programmers and Javascript programmers and Lisp programmers and …). There's no need for everyone to read or even understand every question!
    – Gilles 'SO- stop being evil'
    Jan 10, 2011 at 22:47
  • I see your point... collaboration versus information overload. Are there enough people, and topics for the subject of cryptology to warrant a separate group? If there are enough people and topic then separate it. If not, merge it. (IMHO)
    – makerofthings7
    Jan 10, 2011 at 23:16
  • I appreciate the balance is difficult to achieve but I have to say I agree with Giles - keeping security split into further specialities is like having a "C++ overflow" and "C# overflow" and a "Java Overflow" instead of Stack Overflow. I personally think you can learn a lot by cross-pollination of ideas from others and putting everyone into narrow silos destroy that opportunity - not to mention limiting the potential for site growth.
    – Rob Moir
    Jan 11, 2011 at 9:16
2

A challenge, especially in the maturing world of Information Security, is that segregating IT security from the other disciplines makes it very difficult to manage a central risk register at board level.

While I got late to this beta, and I agree that this forum seems to be reasonably targeted, a part of me agrees with Gilles, as in my career I provide experience in all these areas, and it isn't that common at corporate level for a client to just ask for one aspect, so for example I might deliver a perimeter app test but also build in social engineering/physical penetration and an internal infrastructure security audit; closing the circle with a review of policies and standards against actual, and against industry expected practice.

How fast do the betas grow, typically - is it worth being welcoming to all in the startup phase and allow more offtopic (unless we have one which obviously fits into SO or SF) to get the traffic?

-

Was thinking about the crypto bit - and although it relies on a specialist branch of mathematics, IT security depends in no small way on crypto being implemented correctly. The two are very interconnected. Security professionals need to understand the basics of crypto to get the controls around it right, even if they don't understand the maths.

4
  • 1
    I agree that often security is required to be not-just-technical, and I think peripheral topics are in scope here. E.g. Social engineering as applies to security systems, physical security as applies to securing servers, etc I think are ontopic - but would need to be strongly correlated to IT.
    – AviD Mod
    Dec 5, 2010 at 21:53
  • 1
    On the other point, I think its better to be stricter in the beginning, and then accept wider topics. If its welcoming to all, it will be enticing for none. Don't forget, we want the site to be firstly populated by the experts - and these will only come if the questions are specific, professional and strictly ontopic for what they expect.
    – AviD Mod
    Dec 5, 2010 at 21:55
  • Cheers AviD - that helps me get the right picture.
    – Rory Alsop Mod
    Dec 6, 2010 at 18:35
  • Re crypto - its like with SO and cstheory.SE. Of course they are interconnected, and there will be topics applicable to both, and sometimes you need both viewpoints to make any kind of decision - but it really is a different type of conversation. In fact, I would say its exactly the same (for a subset of "security", i.e. cryptography). Applied crypto relies on crypto theory, but its not the same, and an expert in one might not be an expert in the other. They'd be talking on two completely different levels.
    – AviD Mod
    Jan 10, 2011 at 6:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .