2

Sometimes I have doubts while asking question or answering question, if the question is really about information security. Especially when they seem as a cryptography or malware analysis, or computer network questions. Some questions are even directly depended on mathematics.

I can easily understand questions like: What are the security risks of logging the hash of rejected passwords? belong to security.exchange. But some of the questions make me doubt.

For example this question: https://crypto.stackexchange.com/questions/60544/breaking-a-small-scale-example-diffie-hellman, which has been migrated from security.exchange. From my point of view, it should even be question of math.stackexchange.

Another example: Why can a man-in-the-middle attack not happen with RSA? . It s direclty about the cryptographic theory of RSA. But is it in topic since it is about applications of cryptography?

Or Overflowing the buffer yet not jumping to address, is not it related to reverse engineering?

Furthermore, there are some questions about network protocols, network tools, pen testing-tools. There are many questions related to 'nmap' and its usage. The topics are very close to each others and they are often discussed together. They are very related to each others. That's why it is very difficult for me to categorize them clearly.

Briefly, I want to have a sort of questions, that I can ask myself to decide if a question is belong to security.exchange. Therefore, I can answer or ask a question without having doubt of out off topic. What I want to ask is which questions should I ask myself to state if a question is belong to here or somewhere else?

1 Answer 1

Reset to default
3

The broad boundaries we have are:

Questions about cryptography (maths, theory etc) go on Crypto, but if they're are about implementing Crypto systems they may be more suitable here. Generally here on Security.SE we can handle some simpler crypto questions, but Crypto.SE is the place for Crypto.

Reverse engineering is generally not on topic here at all.

The scope of each site is pretty well defined in the relevant help pages accessible from the top bar on each site.

But if in doubt, it doesn't really matter. If the community thinks it should be migrated somewhere else it will be.

4
  • 2
    "about implementing crypto" - should emphasize this refers to "implementing crypto systems", i.e. using crypto. Not implementing an algorithm.
    – AviD Mod
    Commented Jul 13, 2018 at 12:23
  • Simple cryptography questions are also on-topic on Sec.SE. The rule of thumb seems to be that, whenever it gets into deep crypto or math, it should go on Crypto.SE.
    – forest
    Commented Jul 14, 2018 at 3:24
  • Thanks AviD and forest - updated
    – Rory Alsop Mod
    Commented Jul 14, 2018 at 8:33
  • Overflowing the buffer and not jumping is about exploit development, which should be on topic here. It is worth mentioning that trying to divine the intent of the poster just muddled the waters, writing riot kits and exploits are things that good guys do too. If we don’t push the boundaries of offensive security then we don’t get good defense.
    – wireghoul
    Commented Aug 4, 2018 at 22:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .