It's not hard to come up with a real question that's not too localized, that is clearly only for black hat purposes and in my opinion should get deleted. For example:
How do I do an ARP Spoofing Attack: I'm trying to steal my neighbors passwords/credit card numbers. I set up a fake version of a popular shopping website and I can connect on their open wifi network. I think I could do something like ARP spoofing or something to redirect them to my fake site. It would be very appreciated if someone could give me a clear tutorial on how to carry out these attacks or suggest tools or other attacks that will do this for me.
Compare to a similar, but perfectly valid question on the same topic:
What is the threat from ARP Spoofing: How are the attacks done and what can I do to safeguard myself from them?"
I would expect stupid answers to the first question posting links to kiddie hacker scripts with little to no explanation of what's going on so being of no use to white hats, but being immediately useful to kiddie black hats. I wouldn't expect answers to the second question to be such low quality. Instead, I'd expect them to explain the threat (what is ARP, how does level-2 routing work) and ways to prevent it (e.g., secure the wifi network, use https and other secure protocols).
The difference is subtle, but I believe quite important. We shouldn't deliberately assist black hats or people doing blind penetration tests (that cannot be in any way differentiated from black hats). Personally, I would like something to that effect to be present in the rules; otherwise we run the risk of doing illegal things in some jurisdictions, though I am not a lawyer. (Does suggesting ways for someone to do a successful SQL injection attack on a specific application count as abetting a criminal?)
You should not ask questions asking for assistance in doing illegal activities like breaking into a system you do not have permission to use, or searching for exploits in an web application that you did not write and do not have the source code for and we have no way of knowing if the web application's owners have given you permission to legally evaluate its security. However, it is encouraged to ask and answer generic questions about various types of attacks, essentially in the context of how do the attacks work and how to best prevent them from occurring on your systems. A general guideline of questions and answers should be whether this question could be useful to a white hat (e.g., not automated kiddie hacking scripts), but a description of weaknesses in certain weak methods and how they should be fixed.
Long edit in response to Gilles:
My claim is that "too localized" and "not a real question" will not capture all black hat questions. NaRQ can usually be avoided with clear language focused a specific aspect of an attack. Localization can be avoided by asking about an attack relevant to many computers/situations. (And in any case many too localized attacks are less localized than highly-upvoted questions like "I just discovered major security flaws in my web store" ).
I have no problem erring on the side of explaining principles behind an attack to increase the knowledge for defensive measures. Yes, resources on the internet exist for black hats with tools and tutorials, but we don't have to be one of them (asking specific questions could be quite useful to script kiddies even if the knowledge exists elsewhere).
I don't think my belief is unique: let's look at other parts of the four of the five quotes you gave (Graham Lee's answer did want to allow any question asking about how to build malware without regard to intention):
These all seem to agree that intent is important; and the belief that black hat useful only questions/answers should be against our policies.
This is not an academic issue that only exists for trick questions. There have been mod-removed questions that specifically asked how do I do some black hat activity (e.g., how to exploit windows 7 remotely ) that were not too localized and easily could have been phrased as a real question.
Another example is "How can I check whether it's SQL injection? How can I exploit it? I don't have access to the source code but can query it with more requests.". I think questions like that (part of an attack or blackbox pen test) should be deleted, not edited into something resembling a legitimate question. I have no problem with a quite similar question (possibly from a gray/white box pen test) saying "the PHP source code executing the SQL query says pg_query_params($dbconn, 'SELECT * from text_table where plainto_tsquery($1) ', array($user_input); and gives error messages like ... is this vulnerable to SQL injection?". This is perfectly fine as it will be useful to know if you have to fix your weak source code (despite being more localized). Note, the original version of the question had mod-removed answers that basically said "try running this set of SQL injection kiddie scripts".
How about something along the lines of
This site is not intended to be a resource for black hats to ask for assistance in implementing attacks (or doing blackbox penetration tests that simulate a black hat attack). That said educational discussion of insecure practices, including demonstrating example code that bypasses weak security practices is encouraged to enlighten everyone on how to best defend your system against existing attacks. While we prefer to err on the side of more disclosure, questions and answers that focus exclusively on implementation of black hat attacks may be moderated.
