6

I have been guilty of providing answers with poor and or misleading advise. Specifically here. My initial response was to not worry about NTP vulnerabilities, but thanks to some comments, I realized how important and relevent it is. Given that IT Security is such an important topic, and that incorrect or poor answers could lead to vulnerabilities or exposure, should we be more careful in offering advice, or is it acceptable to give your best effort at the time?

4

Here it is absolutely valid to give your best effort if you think you do know the answer - the whole point about everything being voted on, and editable by anyone means over the broad population the 'best' answer tends to come out.

I too have often had to change my answer because although I may have been convinced I was right (either because the answer was right once but has changed, or because I was just misguided) it became evident I wasn't.

If no-one has commented on your answer it may be appropriate to remove it if it is wrong, but in general editing and marking why (as you have done with your answer) seems appropriate, and doesn't lose the comment thread.

  • 2
    I haven't had an especially good impression of voting as a mechanism for avoiding subtly insecure answers on this site, for subjects that are subtle and only understood well by a small fraction of the IT Security community. – D.W. Jul 8 '11 at 2:03
3

It's great that you're bringing this up, because particularly (as you point out) in the realm of security it is critical that we be as explicit as possible about any potential limitations, weaknesses, or related issues in our answers.

I don't mean that every answer should contain IANAL (I am Not a Lawyer) or anything crazy like that, just that we should be very, very explicit about the scope of our answers on a security site. Only the paranoid survive!

Per the (excellent):

http://msmvps.com/blogs/jon_skeet/archive/2009/02/17/answering-technical-questions-helpfully.aspx

It's OK to provide a partial answer, provided you have some kind of citation or evidence to support it -- and you scope it properly to what you do know and can say with certainty.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .