22

This questions did strike me as especially hard over on SO, where new and/or low rep users regulary get downvoted and closed very fast. Over here on Sec.SE, because there is way less traffic, the problem is not as maddening as on SO, but still a problem we as a community should try and take care of. In fact, on SO there is a "SOCVR" team in an ...


21

I agree. I think this is mostly a problem with close votes on questions, but I just noticed this deleted answer: The author is the lead of the OWASP Zap Project - one of the more significant open source security tools. He previously answered a few questions on Security Stack Exchange - but has been silent since. A good example of how this behaviour ...


18

Just as a moderator pro tem on Law - (hi, InfoSec! waves)... We have received a number of inbound migrations, and of them, the most successful are those that don't presume domain knowledge - the reason for this is, well, lawyers aren't usually infosec professionals. (I don't even know if I'm using that right, infosec?) Anyway, there are a few that have ...


15

The problem isn't with homework or homework-related questions per se. The problem is with how most homework questions are asked. Most homework questions tend to misrepresent the issue at hand because they're about previously taught cases. That makes it difficult to correctly answer the question and usually brings a long discussion by the OP under the answers....


15

If it's the sort of thing that pops out as the first result when you do a google search using the exact terms in the question, and the answer describes exactly what is needed, then we aren't exactly adding any value. Basically, we do expect you to do some basic research before asking the question. A Wikipedia article with the same name as the subject of the ...


11

This is a huge topic, and a legitimate one. The question at the heart of "topic-ness" is the quality of posts. Too much noise in the questions means that the high contributing people we could be attracting will leave because "there is nothing for them here". This model was highlighted during the game that StackExchange ran for each site. There is a ...


11

Hacking challenges, just like homework, are there for people to learn. And just like homework, we should help them with their thought-processes and not do it for them. The standard, "tell us what you have done and how you think it should be solved" comes into play. If you see a question that is from a challenge, then please do note it in a comment, edit the ...


10

As you will see from the questions in the Related bar to the right, this topic has come up a lot. We have come to the conclusion though, similarly to yourself, that while we will close anything that looks like 'Give me teh koadz' or 'how do I hack banking website x' if it is a question relevant to a security professional and it can be answered as per Stack ...


10

I don't think you'll find many lawyers who are security experts at the same time, some questions require deep understanding of networking and security. There is no general rule in my opinion but I disagree with being more strict as I don't see that much of legal questions anyway. Maybe you should add some examples to your question.


10

We recently had a post here called “Is (x) Secure” Question Anti-Pattern. I don't really agree with it, but the consensus is: yes, it's an anti-pattern. The answers there can likely help you. Regarding your concrete question: First of, it's really two questions: how can I determine the security of a product what is the security of specific product X ...


10

Unfortunately, questions asking for resources, links, sources, etc. are off-topic because the answers would just keep growing without end. They are "open-ended" by default.


9

I think there are many qualitative differences between your Splikity question and the referenced Telegram question. Before going into specifics, let's keep in mind the tooltip that is displayed when you mouse over the down arrow for a question in the web app: This question does not show any research effort; it is unclear or not useful When I look at ...


9

We simply do not get many physical security type questions here at all. But we do not want to ban them as a rule (there is useful overlap). I think that questions that could help people make decisions about physically securing information and information systems should be the guiding principle (not a rule, but a general path). But the questions have to ...


8

In some cases, I would say yes, a misunderstanding should be corrected by an answer. In the case of fundamental misunderstandings, or false assumptions that form the basis of a question, we certainly have users who feel that this is automatic grounds for closure, and although I don't know that I 100% agree with that in many cases, it's probably generally ...


8

That sounds more like a book than a question. How does SSL/TLS work? is really the limit of how verbose we want to be. I think this question with the detail you've outlined would be longer. If you split each of those bullets as a very security focused question, I think that would work here. If you did manage to complete the series on the site, compiling ...


7

Those ones are unlikely to ever be on topic here, as they are very specific, and the correct place to go for them already exists: the anti-malware and anti-virus vendors websites If you go to one of them and use their search, you typically get very detailed guidance on removal and checking. Here we would focus much more on the enterprise security ...


7

Whether a question will be considered acceptable or not has a lot more to do with how it is worded than its actual topic. The general idea is that "pls explain how to hack this site" is a bad question in that any answer might possibly enlighten (a bit) the poor sod who asked the question, but not other readers -- and the whole point of having a Q&A Web ...


7

We can help you answer which ciphers you should enable or disable based on your stated threat model, but we cannot help you answer the question of how to select them. This would apply regardless of who asked the question. If I asked whether or not a given mandatory access control policy would provide certain security properties, the question would be on-...


7

This is the type of question that we get a lot of, and they tend to get closed as opinion-based. Unless there is a very specific, factual question you want to ask. Without knowing what your question actually is, the problem is likely to be that your question is going to depend on your personal history, experience and skills, dependent on the employers in ...


6

I think, based on the lengthy discussion previously held, this type of question does provide value to both attackers and defenders, so is probably on topic here. This question is nicely specific, asking for analysis of a particular type of attack so I think it is okay here - I understand your point that as it is currently worded it is obviously aimed at ...


6

From my perspective, the question is off-topic. It is actually more of a SuperUser-type question, as the answers indicate that the solution is found in a browser config. So, I can see your confusion. But, it turns out to be an interesting problem, and this community loves puzzles. This question was highly voted, along with the accepted answer before I came ...


6

This type of question could be on-topic, but I have yet to see one that actually is. The problem is that without the binaries, we would never have enough data to say much. With the binaries, you can use a malware analysis tool (or VirusTotal) to tell you. As you say that you do not have the binaries, and this is a post-incident wrap-up, I suspect that there ...


6

I'm in two minds on this. From my own perspective, working in a heavily regulated industry, I know it doesn't materially change any of our privacy related work - it just increases the level of controls required, and clarifies some of the detail. But for many other industries, and for small companies, GDPR is really the first key driver they have in the ...


5

The question is about turning high-level security requirements into a concrete workflow. That's a pretty typical type of question for Security.SE. Although the study of security protocols is on-topic on CS.SE, this question is very firmly on the engineering side (designing a specific system according to concrete constraints), and thus off-topic there. I ...


5

Before you ask your question, use the search functionality to see if the question has already been asked. Also, as you type your question, the page will make suggestions as to similar questions. Worst case, members of the community will flag it for you if it is a dupe. All this information is in the FAQ which I would suggest everyone should read before ...


5

Why were you downvoted? Who knows? Only the down-voter can answer that. People are able to down-vote for any reason they like, including personal whim or because they were feeling grumpy that day or because they don't like you. I know it can be annoying. I don't have much more to say on that, so let's move on to the policy question, of what this site ...


5

This one bugged me recently, it was not "off-topic" but "Duplicate" How could online encryption ever work? The poster seems new, mentioned https once in their question, then got hit with "why not use Google before asking how SSL works..." It then degenerated into an argument where people debated with the author about how they better understood what they ...


5

The "difficulty" is entirely up to how the application was designed and what resources they have to analyse player behavior. That makes the question too broad and up to interpretation. One game will be easy, while another will be difficult. Once you put in the LoL example, then it becomes about LoL, and only LoL staff can answer your question. If you ...


5

Setting aside the current example, here is my general approach: If the on topic parts it the major thing, and the off topic part is more of a side issue, I would comment and ask the OP to remove the off topic part. If I was feeling brave (or if the question is old, with no OP around), I might go right ahead and edit, leaving a comment explaining to OP what ...


5

"What product/service can do X?" is off-topic for being both recommendation and a call for lists. The potential answers can be endless and it can be difficult to have a single acceptable answer. Years ago, we had a question that was something like, "what tools to scan a network?" Talk about a fiasco. Everyone was proposing a wide range of tools, bashing ...


Only top voted, non community-wiki answers of a minimum length are eligible