5

I posted the question Free tools for security static analysis of C or C++?, which asks "What are some free static analysis tools for detecting security problems in C or C++ code?". I also posted some answers.

My question was changed to a community wiki, and also changed all of my answers to a community wiki, without asking me. When I asked why, the reason given was "this is an "infinite list of X" and as such has to be community wiki, otherwise it should be deleted outright." The question and my answers remain converted to community wiki status, against my wishes.

Can I ask Security.SE moderators to re-consider this decision? Would it be possible to return this question and the answers back to ordinary status, with the community wiki flag removed? I do not think it benefits the site to force this question and all answers to a community wiki, in this situation. Contrary to how it has been marked, I'm not requesting or inviting others to edit my question or my answers; I think my questions and answers are fine as is. I believe my question and the answers are relevant and useful to have on this site and its users.

The justification given didn't resonate with me. The Stack Exchange software already handles questions that have multiple valid answers, without a need for community wiki status. I don't see why this situation requires others to be able to edit my question, or to edit my answers.

I've read the documentation on community wiki status, and I have not been able to find any documentation which says that if a question calls for multiple answers, then the question or the answers should be marked as community wiki.

  • How and when should we use the Community Wiki feature? says nothing about this. In fact, it says questions should not be marked community wiki (contrary to how my question was treated). And it doesn't discuss any basis for forcibly converting questions or answers to community wiki, against the wishes of the author.

  • What are "Community Wiki" posts? says nothing about "list of X" questions or reasons why a moderator might change a question and answers to community wiki against the author's wishes.

  • What types of questions or answers should be made community wiki? does not support this decision. The only situation it lists where a question would be forcibly marked community wiki is where the question is subjective or does not have a right answer. The answers to my question are not subjective and answers are either right or wrong, so that doesn't apply.

  • On When to mark the 'community wiki' checkbox on a new question?, one highly-voted answer says "A question should not be marked CW if it is possible to write valid, helpful and knowledgeable answers which contribute to SO." Under this criteria, I think my question should not be marked community wiki. Another answer says "a question's having more than one answer is not a reason for the questioner to make it CW", which also seems to apply here.

  • Should we have a "List of X" close reason? criticizes "List of X" questions on the basis that they tend to be polls and copy-pasted content. That criticism does not apply to my question.

Jeff Atwood that the question and all answers should either be community wiki or should be deleted. OK, that's his call. It's his web site, and his rules: I'll certainly abide by them. If the decision is to retain the forced community wiki status, then please go ahead and delete the question and all answers, and I'll be sure not to ask "List of X" questions again; sorry if I've inadvertently violated community norms or rules. In either case, it would be nice if the policy were documented for the future.

Edit (9/7): I'm closing this question now. Looks like I have received a definitive answer from @Jeff Atwood. Thanks to Jeff for taking his time to share his thoughts and to elaborate on what he has in mind for the site! Much appreciated. There are all too few organizations where the leaders engage on such a detailed level with the participants; I feel privileged to have the chance to learn more about Jeff's thinking and vision for this site.

2
  • 3
    "The only situation it lists where a question would be forcibly marked community wiki is where the question is subjective or does not have a right answer" -- and what pray tell is the right answer to the question "What are some free static analysis tools for detecting security problems in C or C++ code?"
    – Jeff Atwood
    Commented Sep 5, 2011 at 8:10
  • The exact quote is "if there aren't right or wrong answers, no one should be able to gain reputation from posting, and therefore the question and all answers should be in community wiki". In my question, there are right and wrong answers. For instance, Splint is a right answer, while FindBugs would be a wrong answer. There are, of course, multiple correct answers -- as is true for many of the questions on this site.
    – D.W.
    Commented Sep 5, 2011 at 18:17

1 Answer 1

Reset to default
5

Your "question" is literally

What are some free static analysis tools for detecting security problems in C or C++ code?

Which is functionally indistinguishable from

What is your favorite free static analysis tool for detecting security problems in C or C++ code?

Per https://security.stackexchange.com/faq#dontask

To prevent your question from being flagged and possibly removed, avoid asking subjective questions where …

  • every answer is equally valid: “What’s your favorite ______?”

There's no criterion for answering other than "this thing exists and I know about it". That is the very definition of Infinite List of X.

Now if you want to go back and edit the question to say something like "please explain how the tool works, what it is good for, how often it is updated, and how effective it is at finding vulnerabilities" -- that would help. But it's still an Infinite List of X, just a better one, and still needs to be community wiki if it wants to survive at all.

(Better still would be a question involving an actual set of C or C++ code that needed to be audited for security purposes with a specific set of goals in mind, that is: "a practical, answerable question based on actual problems that you face".)

7
  • 2
    1. I still don't understand why "List of X" means it must be forced over to community wiki. That is not documented anywhere, the justification has not been explained, and it has not been applied consistently on this forum.
    – D.W.
    Commented Sep 5, 2011 at 18:13
  • 1
    2. I disagree with your characterization of my question. I'm not asking for favorite tools. I'm asking for the options. There just aren't that many free tools for this purpose. Contrary to what you suggest, it is not true that every answer is equally valid; for instance, "FindBugs" is not a valid answer, because FindBugs does not work on C/C++.
    – D.W.
    Commented Sep 5, 2011 at 18:13
  • 4
    sure, but that's like arguing that "Border Collie" is not a valid answer for "What are some cool dinosaurs?" It's true, insofar as it goes, but that doesn't mean the question isn't broken. If every 'dinosaur' answer is equally valid -- there are zero meaningful criteria for evaluation in the question -- then it's already covered by your faq as I quoted above. This is just not a place where people should be making Lists of X; if you want to consolidate all those answers into a real answer to someone asking for C++ security code review, feel free.
    – Jeff Atwood
    Commented Sep 6, 2011 at 3:55
  • Thanks, @Jeff! So my take-away is: based on your reasoning, it sounds like this kind of question (and possibly many "List of X" questions) is not really appropriate for this site -- CW or not. Good to know.
    – D.W.
    Commented Sep 7, 2011 at 18:24
  • I think it might make sense to consolidate all the answers you provided there into one canonical answer to an actual C/C++ security code review question someone asked here. And then since it is a) single answer b) by you c) to an actual question a real person asked -- it'd be completely valid.
    – Jeff Atwood
    Commented Sep 8, 2011 at 22:30
  • 1
    I realize you're just trying to help, but that's not the question I want to know the answer to. I realize you consider it inappropriate to ask about C/C++ code review tools in general, and the question is only valid if it is asked in the context of a particular piece of code -- well, you're welcome to your opinion. But, that isn't the question I want to ask. I want to know, generally, about all useful tools. My experience is that the best code review tools tend to be the best across the board, no matter what code you're reviewing -- there's no need to restrict to one codebase.
    – D.W.
    Commented Sep 8, 2011 at 23:38
  • 1
    On a similar note, reading between the lines, I get the impression that you don't think my question was "real". I don't imagine I'll be able to convince you otherwise. I do C/C++ security code review, and am constantly looking for better tools, or additional tools that complement the ones I already use. Whether or not my question is suitable for this site, my question was real and sincere. Anecdotally it is a question I've had other folks ask me as well. I thought I was helping by documenting answers here, but if that's not appropriate, I'm cool with that.
    – D.W.
    Commented Sep 8, 2011 at 23:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .