Whilst writing an answer recently, I had to ponder how much of the subject I should demonstrate, in terms of a real exploit scenario. In the case of the answer I wrote, I think that we're relatively safe since the demonstrated exploit was on a fictional piece of code.
However, we're bound to get situations in future where people ask about specific vulnerabilities. Should we give them full answers, with near-tutorial levels of detail, or should we provide more vague information that fits most scenarios?
Here's my thoughts so far:
- Single-vulnerability questions should be closed as Too Localized, unless they're high profile and warrant a decent writeup on the subject.
- Knowledge is inherently amoral. What's done with it is outside our jurisdiction. However, in cases where malintent is shown, we should close the question.
- Generic advice is useful to lots of people, but less useful to the asker. We'd have to judge this on a case-by-case basis. Should we have a line in the sand, or should we leave it up to the answerer to judge?
I'd like to hear your thoughts on this.