2

Are security tool related questions not security questions or something? Just a question?

https://security.stackexchange.com/q/6463/618

Short explanation: I am doing some anti-virus research. FastBT is very intriguing. It is a tool for doing something like binary instrumentation with a specific purpose of adding an additional layer of security at run-time. It works great on Linux based OS-es. I'm looking for a windows patch-set or a similar tool/implementation for windows without having to right a pin-tool from scratch or delve deeply in to DynamoRIO.

There are no active tags for binary-instrumentation or dynamic-binary-instrumentation.

I had a link in the original question to the FastBT project page. It is a dynamic binary instrumentation engine for detecting memory faults before they leverage execution and recording processes dynamically at run-time without debugging(read as way faster).

Maybe the individual that closed/down-voted has no idea what dynamic binary instrumentation is in the context of security research or didn't take the time to check the provided link.

7
  • I think it's more related to the fact that I was a prolific poster on questions.securitytube.net and now there's some desire to lock me out of security.stackexchange.com
    – RobotHumans
    Commented Aug 22, 2011 at 4:42
  • 3
    I think you are reading more into this than exists. I have not seen your posts on securitytube.net. In fact I hadn't heard of securitytube.net until you mentioned it here.
    – Rory Alsop Mod
    Commented Aug 22, 2011 at 7:35
  • 1
    From your comments, I can only assume someone has misrepresented themself as me for some reason. Can you ping me a link to the relevant place on securitytube?
    – Rory Alsop Mod
    Commented Aug 22, 2011 at 12:33
  • 1
    The site came down per stackexchange no longer allowing private groups. I can pull it out of the database dump at some later time.
    – RobotHumans
    Commented Aug 22, 2011 at 12:36
  • Here's the google cache that has a profile that seems like you: webcache.googleusercontent.com/…
    – RobotHumans
    Commented Aug 22, 2011 at 16:01
  • Interesting - so it has a grab of my profile from here...Or is it me? I can't find any record on my machine of ever being there, and I don't remember the URL, but it is exactly what I would have said.
    – Rory Alsop Mod
    Commented Aug 22, 2011 at 17:40
  • 4
    @Rory I think I see what's happening. Questions.securitytube.net was, AFAICT, a paid for stackexchange 1.0 site. This-security.stackexchange.com-is a community run stackexchange 2.0 site. Other than using the same company's software, the governance of the two sites are unrelated so whyever questions.st was closed, it's not a conspiracy to promote security.se (though we welcome on-topic questions from its denizens).
    – user185
    Commented Aug 22, 2011 at 18:00

3 Answers 3

Reset to default
4

My interpretation of Rory Alsop's comment "There doesn't appear to be a security question here." doesn't mean that the posts content is not related to security, but that the sentences do not contain a clearly identifiable question.

The most likely questions would be:

"What binary translation tools are available for Microsoft Windows?"

This type of question is not necessarily security related as you can use binary translation tools for lots of purposes. IT Security moderators have tended to close or migrate questions that are requests for resources that are not necessarily security related.

I think a different version of the question:

"What binary translation tools are available for Microsoft Windows that are efficient for virus analysis and are effective at preventing viruses from harming the host system ?"

Would be a valid security question.

My understanding of the threshold for a IT Security questions is not

Would a IT Security profesional know or want to know X?

but

Would an IT Security professional know or want to know X significantly more than, or to the exclusion of other types of professionals.?

IT Security profesionals perform a lot of job related activities that are not security activities: fill out time cards, backup their computers, read about trends in computing, etc.

However IT Security profesionals perform some activities that other professionals rarely or never do: internal threat analysis, threat mitigation strategy formulation, user IT security training, user security awarness campaigns, forensic data analysis, expert witness for computer crime trials, vulnerability analysis, password policy formulation, compromise recovery, penetration testing, etc.

The context matters little. If the question out of context is not obviously security related, then it may be simply IT related.

Asking how to get a particular piece of software to run on a particular computer system is assumed to be an IT problem (SuperUser or ServerFault) unless a security component makes it unlikely that an IT profesional would know the answer. For example the software is used exclusively for forensic analysis as evidence in a legal matter.

10
  • okay, i thought i expressed the question in the title. the content in the other area was simply a pre-emptive response to "what is fastBT and how is it related to security"
    – RobotHumans
    Commented Aug 22, 2011 at 4:00
  • do you think this one is more acceptable: security.stackexchange.com/questions/6470
    – RobotHumans
    Commented Aug 22, 2011 at 4:22
  • 1
    I know you are going to be confused about this but no. Your question is similar to 'Does anyone have a patchset to get IDA Pro running under WINE'. IDA Pro is a Windows disassembly tool often used for examining malware. Getting IDA Pro to run on Linux under WINE would be an activity a virus researcher would perform. My understanding of the threshold for a IT Security questions is not 'would a IT Security profesional know or want to know X' but 'would an IT Security professional know or want to know X much more than other types of professionals.
    – this.josh
    Commented Aug 22, 2011 at 5:06
  • IDA runs fine under wine with no patches btw.
    – RobotHumans
    Commented Aug 22, 2011 at 5:08
  • does the OR what else provides similar functionality not cover it?
    – RobotHumans
    Commented Aug 22, 2011 at 5:09
  • 2
    The IDA Pro question was an example, not a real question. The point of that question was that installing or fixing a software tool is an IT question not an IT security question. A question about finding a tool that does X, where X is a feature commonly used by system administrators, programmers, testers, database administrators, computer science professors, or the like, is an IT question, not an IT security question.
    – this.josh
    Commented Aug 22, 2011 at 5:28
  • valid point. the issue here really is that OR what other tool provides similar functionality in a security context is valid. if it's not, i'm okay with deleting my 10k points worth of answers from other stack sites as long as they are actually gone. make sense? if i can only answer retarded user questions and can't ask a question, the format is useless. this wouldn't have been a problem on securitytube.
    – RobotHumans
    Commented Aug 22, 2011 at 5:32
  • I think 'OR what tool provides the same functionality?' is roughly 'What tool [for Windows] provides binary instrumentation?' My interpretation is that the function 'binary instrumentation' is not exclusively a security tool. It appears that binary instrumentation is of interest to software companies, programmers, system administrators, security researchers, and computer science researchers. Asking "What are good ways to do anti-virus analysis?" may generate some useful replies.
    – this.josh
    Commented Aug 22, 2011 at 6:35
  • but i don't need virus analysis. i need assembly structures directly before policy violation. if i just needed binary instrumentation other stuff would be sufficient. basically what i'm hearing is you can't ask questions because you're smarter than our moderators.
    – RobotHumans
    Commented Aug 22, 2011 at 6:43
  • 2
    The question is not an IT Security question - as it stands it is a pure IT question.
    – Rory Alsop Mod
    Commented Aug 22, 2011 at 7:33
4

@This.josh's answer is pretty much spot on the money. The question is not an IT Security question. The tool you are discussing is an IT Security tool, but the question is purely an IT question - does anyone have a patchset to make application X run on Windows doesn't have anything to do with security, no matter what application X is.

I have migrated it over to SU.

The question "What is a tool/implementation for windows similar to FastBT" would be on-topic, so feel free to ask that here.

3

I agree that the question you linked is off-topic for the site. From the FAW:

IT Security - Stack Exchange is for Information Security professionals to discuss protecting assets from threats and vulnerabilities

Questions about whether some tool can be built for a particular OS do not fit into that categorisation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .