0

There is a community rule for flagging questions here in SECSE:

Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem.

Over my time as a contributor at security stack exchange I do not believe I have seen a single legitimate use of this rule, but more than that, I feel the wording is unhelpful.

I think the clearest support for this statement is the two answers below by moderators stating that the rule is useful for closing questions that are not about breaking the security of a specific system:

It has been an incredibly useful rule for us as mods to get rid of not so many "show me how to hack" questions

@Rory Alsop

it's too broad, but it also requires that the asker be taught a whole foundation of knowledge first before any answer will help. It's that last point that the close reason helps with

@schroeder

I have seen this reason be used as a reason to close generic exploitation/privesc questions against Windows 10 or IIS, which are generic OS and web server, not a "specific system".

The rule also states that it's actually ok to assist someone exploiting a specific system as long as they understand the concepts involved and can clearly formulate the issue they are stuck on. Which seems counter-intuitive for a rule against breaking the system of a specific system.

IMHO this rule should simply be removed or replaced with a more sensible one (if someone wants to suggest an alternative).

9
  • 2
    Can you propose a "more sensible one"?
    – schroeder Mod
    Jun 18, 2020 at 7:22
  • Interesting thought. Could you give some examples of questions where you think the rule has been misused? (If you don't want to link specific questions, I understand.) I use the rule quite seldom since "to broad" often works equally well.
    – Anders
    Jun 19, 2020 at 17:11
  • 1
    Stumbled upon an example myself. It has three close votes with that reason even though it seems completely on topic to me.
    – Anders
    Jun 24, 2020 at 10:43
  • @schroeder, not really, hence the suggestion was to retire it rather than replace it.
    – wireghoul
    Jun 27, 2020 at 10:06
  • "IMHO this rule should simply be removed or replaced with a more sensible one." It's right there in your post ...
    – schroeder Mod
    Jun 27, 2020 at 14:37
  • 1
    It is my opinion that it should be removed/retired (per the title and the order of the sentence you quoted), but I'm accepting that although I don't have a better suggestion others might have. So in my opinion a better replacement could be an acceptable solution. Arguing English semantics/grammar seems counter productive (it's my second language). If I had a proposed replacement I would have included it in the post
    – wireghoul
    Jun 27, 2020 at 22:25
  • I'm not arguing semantics or grammar. I'm trying to understand what you want. If you don't have a better option, that's fine, but to better understand what you are saying, it can be helpful if you had an example. What might be more sensible for you? All you've done is say why what exists isn't to your liking. What might be?
    – schroeder Mod
    Jul 7, 2020 at 14:02
  • You are focusing on the "specific system" part of the close reason, but that's not the only context. Rory and I are answering you with the rest of the close reason ...
    – schroeder Mod
    Jul 7, 2020 at 14:06
  • But lack of research when not breaking the a specific system isn't violating this specific rule, it's not two separate conditions, but I also agree the wording of this close reason is not good and that lack of basic research is a good close reason, it's just not this close reason
    – wireghoul
    Jul 8, 2020 at 11:52

2 Answers 2

Reset to default
6

You may not have seen the countless times we have used it. It has been an incredibly useful rule for us as mods to get rid of not so many "show me how to hack" questions. Most of them are ones that require a training course to answer.

Yes, it is also handy to get rid of "I want to hack my partner's facebook" etc but that isn't the main aim.

1
  • In my few years here I have yet to see a valid use of this. I do tend to vote to reopen if I think it's been wrongly closed. Perhaps you can provide me with some good use cases where this rule was the perfect reason to close. Other close reasons like too broad already deals with "teach me to hack" which is obviously not asking asking about hacking "a specific system"
    – wireghoul
    Jun 27, 2020 at 10:04
3

... used as a reason to close generic ... questions against window 10, which is a specific OS, not a "system".

You have a very strangely narrow definition of "system". "OS" is an acronym for "Operating System". A "system" does not need to be the full technology stack for a discrete computing device.

"But the rule also suggest that it's ok to assist someone clearly planning to commit a crime"

You have made a huge leap in logic with this statement and you have a poor understanding of digital crime and the foundation of "ethical hacking". The major determining factor whether breaking the security of a system is a crime or not is permission. We do not ask if people have permission nor can we verify that, so every question could be in the furtherance of a crime.

replaced with a more sensible one

Ok, given your concerns, let's consider the antithesis:

"I am a penetration tester on an assignment (here is my permission slip). I found this strange web page on the company site. I normally test networks, not web pages. Help me get admin access."

There is no way we are going to answer that. It has two obvious problems, it's too broad, but it also requires that the asker be taught a whole foundation of knowledge first before any answer will help.

It's that last point that the close reason helps with. The question could be very targetted and specific, but the asker would need a book for the answer to make sense.

The close reason also handles "lack of research"-type questions. Where people just want answers and do not want to spend the time to understand what they are trying to do. They want instant results in the moment, not to learn.

So, yes, the close reason can be applied in a variety of different situations, and one closed question might not look like another.

2
  • IMHO Windows is a generic operating system, while it is a system it is generic. You do not know the specific configuration of the target, hence I do not feel that it is an appropriate use of the close rule. Questions about local privilege exploitation would otherwise always have to be closed. For your other examples, lack of research and broad questions, other close reasons exist that cover these. Perhaps I should have asked for examples of questions where this is the only valid close rule.
    – wireghoul
    Jun 27, 2020 at 9:58
  • "Lack of research" is not an available close reason.
    – schroeder Mod
    Jul 7, 2020 at 14:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .