10

Back in 2011, there was a question on meta, asking if physical security questions are on-topic. The general tone of the answers seem to indicate that these questions are welcome.

My question now is, are questions regarding locks (lock design, lock picking, etc.) considered on-topic? For example:

  • Are there reasons aside from manufacturing to not make every pin a spooled or serrated pin?
  • What is a "zero-cut"?
  • Why are locks with high pin count more susceptible to raking?

2 Answers 2

Reset to default
6

We simply do not get many physical security type questions here at all. But we do not want to ban them as a rule (there is useful overlap).

I think that questions that could help people make decisions about physically securing information and information systems should be the guiding principle (not a rule, but a general path).

But the questions have to at least tangentially be related to physically securing information. Design decisions for locks are probably out. Lockpicking tips/advice is also probably out simply because of the potential rabbit holes it opens up that would be off-topic (I concede that "hacking" and "lockpicking" are not philosophically different, but it's the subsequent rabbit holes I'm worried about).

The problem I tend to see with physical security questions is that many (most?) of them cannot be answered by the existing community. We just don't have the expertise for it. A few times, I have done independent research or interviewed experts in order to provide an answer. If we get "too many" unanswerable questions, even though they are on-topic, then those questions don't add value to the site, and that's what we need to keep to a minimum.

10
  • I had suspected that these would be off-topic, but I doubt Stack Exchange really has any sites where that would be on-topic.
    – user163495
    Commented Sep 18, 2019 at 8:38
  • I'm not saying "no" to your example questions, just that they need to relate or be applicable to security decisions around securing information and information systems. The bigger concern is if they would be answered at all.
    – schroeder Mod
    Commented Sep 18, 2019 at 8:41
  • 1
    My approach would be: "My lock secures my apartment, which secures my personal computer. It is therefore vital to me to select a good lock. To be able to select a good lock, I need to understand what makes a good lock, and what measures can be taken to prevent common attacks." As far as answerability goes, it depends on whether or not we want those questions to be answered on our site or not.
    – user163495
    Commented Sep 18, 2019 at 8:43
  • 2
    ... or server room or paper records room. I get where you are going, and your goal is on-topic. The questions just need to align, in some way, to that without too many leaps in logic.
    – schroeder Mod
    Commented Sep 18, 2019 at 8:45
  • 1
    Questions about fixing electrical outlets are not on topic, even though a firewall plugged into a faulty outlet could go down due the fault, and since Availability is a core security topic, then "obviously" electrical repair should be on-topic here. It's those leaps we want to prevent.
    – schroeder Mod
    Commented Sep 18, 2019 at 8:47
  • 1
    Yes, I absolutely get the idea. "Finding a good car so I can commute to my job so I can conduct my pentest" is also not on-topic.
    – user163495
    Commented Sep 18, 2019 at 9:25
  • 1
    That IR answer is just absolutely great! :-)
    – Anders
    Commented Sep 19, 2019 at 14:50
  • 1
    I really would like to read questions and answers about physical lock design and physical security, though - LPL is one of my "watch every video" youtube channels. Is there no place for that on SE at all?
    – Adam Barnes
    Commented Sep 20, 2019 at 11:15
  • 1
    @AdamBarnes "Hello, I'm the lock picking lawyer, and what I have for you today is an answer on why having a high pin count may be a bad idea"
    – user163495
    Commented Sep 20, 2019 at 14:26
  • You had me REALLY excited for a second, you cheeky boy.
    – Adam Barnes
    Commented Sep 21, 2019 at 15:03
0

We simply do not get many physical security type questions here at all.

 

The problem I tend to see with physical security questions is that many (most?) of them cannot be answered by the existing community. We just don't have the expertise for it.

 

If we get "too many" unanswerable questions, even though they are on-topic, then those questions don't add value to the site, and that's what we need to keep to a minimum.

My guess:

Even though such Qs are theoretically on-topic, people typically intuitively think they are not because they typically associate the phrase information security with digital security only.

Example: This Q which, even though was finally allowed to stay as per the rules, had amassed a fair amount of close votes early on - hinting the close voters were not aware physical security Qs are allowed - hinting people are typically not aware of it. If even regular users did not know this, perhaps potential question-askers or expert question-answerers not yet accustomed to the site won't know this as well!

Thus my proposition is to:

  • Make physical security questions off-topic here, but
  • Set up a new site: physicalsecurity.stackexchange.com that will be especially about questions about physical security.

My guess is that the proposed new site would fare much better with such questions than this site because it would be obvious to everyone that it would be about physical security so it would be better able to attract questions about the topic as well as experts able to answer them.

Also the proposed new site would be better able to avoid topic inconsistencies like these:

But the questions have to at least tangentially be related to physically securing information. Design decisions for locks are probably out.

This doesn't seem intuitive - once questions about the purpose of certain parts of locks are allowed, why are design decisions not allowed? Both topics seem just too close to each other for me.

Unlike this site, however, the proposed new site would be able to fully cover the topic of physical security.

6
  • I would not like to split sec.se into itsec.se and physsec.se. It would be too much overlap. SO doesn't have java.so, cs.so, cpp.so, py.so, etc. either.
    – user163495
    Commented Sep 30, 2019 at 13:08
  • @MechMK1 It would seem so, but the current system simply doesn't seem to be working... would it be better to have psysical security Qs declared offtopic here?
    – gaazkam
    Commented Oct 1, 2019 at 9:29
  • I honestly would like to see physical security questions be declared on-topic here.
    – user163495
    Commented Oct 1, 2019 at 9:34
  • @MechMK1 Yes, but this simply doesn't seem to be working. They are on-topic, but almost no one asks them, almost no one is able to answer them, if such a Q is finally asked then it's likely to gain close votes as if it was off-topic and I guess most ppl don't even know such Qs are on-topic here... If you can remedy this without declaring such Qs off-topic here or giving them a separate site, I'd be content, but I cant see such ideas in this thread yet :(
    – gaazkam
    Commented Oct 1, 2019 at 10:13
  • Well, this serves as a good discussion point on what is on- and off-topic
    – user163495
    Commented Oct 1, 2019 at 10:24
  • @MechMK1 Yes, but out of all problems this can only solve one: site regulars giving spurious close votes. I suppose it won't help with the lack of such questions in the first place, nor with the lack of experts able to answer them
    – gaazkam
    Commented Oct 1, 2019 at 18:45

You must log in to answer this question.