How can attackers bypass firewalls? was closed by the community, though all of the moderators had decided not to cast their weight against it. What is the bar of knowledge that we expect a user to have before asking a question here?
What level are we unwilling to educate below? Should this question be rewritten and formed to discuss why a firewall isn't the end all / be all of attack prevention?
I don't think that question was closed by the community for being "below the bar" of knowledge, but rather the question was poorly phrased, and seemed that the asker did not even give thought to what he was asking.
I don't think we need to have a "minimum expected knowledge" at all - when it comes to security.
A complete security newbie is welcome to ask introductory level questions about security.
However, I think it is fair to expect that the asker at least have a basic knowledge about the content of his question, i.e. whatever it is he's asking security about.
If you're asking the most basic of questions on how to secure an Apache webserver - that's fine, if you know what an Apache webserver is (and how to configure it).
If you're asking how to prevent SQL Injection in PHP, from the ground up - that's great, if you know how to write code in PHP.
If you're asking how to bypass a firewall - you should probably know what a firewall is and what it does (though asking about that here is also okay, but that is a completely different question). You should probably have a clue about how networks work, how they're set up, the difference between a network and a workstation, and so forth.
In other words: we should be willing to educate even kindergarden level - about security. Nothing else. (And btw, even high-level non-security questions would be offtopic, anyway.) Note, however, that sometimes the simplest questions are often answered on Wikipedia, and as always we do expect the asker to do at least a minimal amount of research, before asking.
I think the reason the linked question was closed, was because it was assuming a level of (non-security) knowledge, that was not apparently there. It felt to me that the asker didn't understand network basics, or really what a firewall is and does (and does not do). Or perhaps the question just left a large gap in specificity.
I think that had the asker just came out and said "WTF is this firewall thing, and what does it do for my network?" it would have been ontopic, though then answers would probably have been best served by RTFWA (read the Wikipedia article).
I think the biggest problem with the question was not the minimum expected knowledge, but that the question was not sufficiently specific about what was being asked: the question was vague and over-broad and it was hard to tell what exactly the question was. The comments didn't help derive a narrower focus.
In general, I don't think we need to have much in the way of minimum expected level of knowledge. As the FAQ says, the IT Security site is intended "for Information Security professionals to discuss protecting assets from threats and vulnerabilities"; anything that falls within that scope seems like it could be fine.
However, that said, I do think it is reasonable to expect people to do a little bit of background research on their own first. So, if the question is completely answered by Wikipedia or by the first hit on Google, and if the question-asker hasn't tried to read those, then the question is probably too low-quality for us. So, in that case, I would expect that sort of question might still be closed -- not because of minimum expected level of knowledge, but because of lack of research. They certainly don't need to do a comprehensive literature survey before asking a question here, but they should probably take some very basic steps on their own first.
In short, here are two necessary (but not sufficient) requirements for a question to be a good one (in my opinion):
The question must be specific about what is being asked.
The question-asker should do a little bit of basic research first on their own, before asking. I don't expect the world, but I do expect a little bit.
As always, the faq has good advice on how to ask a good question.
(JeffFerland, I'm sure I'm not saying anything that's particularly new for you -- I just wanted to write this down for others who may chance upon this page.)
