28

I have certainly seen my fair share of questions that are unanswerable without context and / or a threat model. Having something in the FAQ to point at would be amazing. I also like the content of your FAQ blurb, but would lower the language to make it a bit more accessible. Maybe something like: Security is always relative, and depends on the context. A ...


15

If it's the sort of thing that pops out as the first result when you do a google search using the exact terms in the question, and the answer describes exactly what is needed, then we aren't exactly adding any value. Basically, we do expect you to do some basic research before asking the question. A Wikipedia article with the same name as the subject of the ...


15

The problem isn't with homework or homework-related questions per se. The problem is with how most homework questions are asked. Most homework questions tend to misrepresent the issue at hand because they're about previously taught cases. That makes it difficult to correctly answer the question and usually brings a long discussion by the OP under the answers....


15

Agreed. In some cases, it seems like this question would be unclear. In most cases, it feels like it would be too broad to answer, as you'd have to dig deep into that particular implementation. My only worry is that in some rare cases, this might be a valid question. For example, if there's an insecure implementation that people are using, this is an easily ...


14

The problem with these questions is the narrow scope. The answer really only benefits the asker. We have 2 canonical questions for home PCs and Servers that we usually use to close new questions as a duplicate of: Help! My home PC has been infected by a virus! What do I do now? How do I deal with a compromised server? But we are also seeing a lot of just ...


10

We recently had a post here called “Is (x) Secure” Question Anti-Pattern. I don't really agree with it, but the consensus is: yes, it's an anti-pattern. The answers there can likely help you. Regarding your concrete question: First of, it's really two questions: how can I determine the security of a product what is the security of specific product X ...


9

I think there are many qualitative differences between your Splikity question and the referenced Telegram question. Before going into specifics, let's keep in mind the tooltip that is displayed when you mouse over the down arrow for a question in the web app: This question does not show any research effort; it is unclear or not useful When I look at ...


9

We simply do not get many physical security type questions here at all. But we do not want to ban them as a rule (there is useful overlap). I think that questions that could help people make decisions about physically securing information and information systems should be the guiding principle (not a rule, but a general path). But the questions have to ...


8

It should be OK to ask, because we learn from our mistakes and from those of others. But asking the question risks inviting speculation. I don't think a representative from Ashley Madison will ever post the definitive answer because they're probably going to fight this in a courtroom for the next decade, where their lawyers would caution them against ...


8

In some cases, I would say yes, a misunderstanding should be corrected by an answer. In the case of fundamental misunderstandings, or false assumptions that form the basis of a question, we certainly have users who feel that this is automatic grounds for closure, and although I don't know that I 100% agree with that in many cases, it's probably generally ...


8

The version of this I encountered today was "How do I determine which encryption library is trustworthy?", which was getting voted to close based on this kind of logic. But I think it's a very different question, one that I think is on topic. Just because "how do I know who to trust?" is a hard question with no clear answer doesn't mean it is off topic, ...


7

If you're posting a screenshot of something you're talking about, I generally consider that trivial. Let legal deal with the trolls if they come, but unless you have a specific case you're pointing to besides a ridiculous one from here about a month back, don't sweat it and just post up.


7

No - this is by design. If you have a reply to something a commenter has asked, respond to them. For another commenter, reply to them separately. Remember, though, comments are supposed to be brief and temporary, and used to gain clarification of a point - plan for having them deleted.


7

Please see this meta post. The greatest emphasis: Automatic bans never expire or "time out." This means that you cannot simply wait for a certain amount of time. If you do not take action, you will never be allowed to post again. The only way for the ban to be lifted is by contributing positively to the site in other ways.


7

We can help you answer which ciphers you should enable or disable based on your stated threat model, but we cannot help you answer the question of how to select them. This would apply regardless of who asked the question. If I asked whether or not a given mandatory access control policy would provide certain security properties, the question would be on-...


6

I agree that those kinds of questions are not good, and anything to help guide posters is helpful. I just want to point out that our FAQ already includes some wording on this: What background should I give in my question? Security is a very contextual topic: threats that are deemed important in your environment may be inconsequential in somebody else's, ...


6

Screenshots of copyrighted software is by default subject to the copyright of the software. However, when you are using the screenshot to illustrate a discussion of the software operation, this generally falls under fair use or some similar provision (the exact extent of these provisions depends on the jurisdiction but the core principle is the same). This ...


6

The model I have been using is based on the fact that this is a site for Information Security professionals (yes, not only them, but that's the basis). If an acronym is within the standard Body of Knowledge of an Information Security professional, then we need not expand for the community. Or if the acronym is used so ubiquitously that the acronym is ...


5

You can certainly ask follow up questions. The usually accepted technique is to write your question and just refer to the earlier question with a link and a summary. I also think your follow up is on topic - we do try and focus on the relationship between attack route and defence strategy, but both ends of the discussion are relevant here.


5

Given your screenshot, you're attempting to post a question with the tags tea and feistel, which do not exist. Creating tags requires 300 reputation points. The boxes on the right are shown to everyone. They're guidance, not error messages. Pay attention to the actual error message when you attempt to submit the question: Creating the new tags 'tea ...


5

The question format of "how do I discuss [security topic] with non-security people" is on-topic. The answers will not be about making technical decisions, but that's OK. It is because the topic in question is under hot debate in political and legislative circles that we, as security professionals, should be able to ask of each other how to properly discuss ...


5

No. "Where to find a resource" questions are generally off-topic across most of the SE sites, because the answers are simply links to an external site. To answer your question, you won't find what you are looking for. Any security review becomes obsolete once the code is updated. Closed source code reviews will be posted by the vendor (and then only as a ...


5

If you want clarification on an answer, asking in a comment is what you should do. However, if you want to extend the scope of the answer or ask about how the answer applies in another context, then it is likely that you are asking a separate question.


5

Depends on the question. In general, I would say: "Here's a traffic dump. Notice anything strange?" Will be closed as "needs focus". "Here's some relevant subset of trafic. I suspect X. Is that correct?" Probably OK question! "Here's some small subset of trafic that I don't understand. I expected X but got Y. What is going ...


5

We are not a code/site/log/packet dump analysis site. As you can imagine, we'd be flooded with random stuff to wade through.


5

I'm actually going to put it back in. I removed the name because you said in your earlier version that you thought it was malicious and you wanted us to review it. The question could have stood more generically on its own without naming it. But now that the question is more generic, and the point is that the app is deceptive, the name becomes relevant. So, ...


4

I'm responding to @ArtjomB's comment that if the answer to a question is not publicly known, then the answers will be primarily opinion-based by definition. I see no problem with this here on InfoSec.SE. Nor any reason to close the question. On this site, "expert opinions" are ok and actually quite valuable to the community. An analysis of how an attack ...


4

The question falls under the form of I need advice on how to explain Cryptography in layman terms Of which there is really only one truth about what cryptography is in all of IS:SE, and that is that it is a tool in the most basic of terms. They needed help clarifying this which is a question opened up to some opinions about how the argument should be ...


4

The preferred mechanism for this is the Bounty. Once you have enough rep you can set a bounty on your question (or other people's questions.) This highlights the question, and generates interest. Publishing the question again is definitely frowned upon - this will get closed very quickly, and will likely get you down votes. As @paj28 commented, editing a ...


Only top voted, non community-wiki answers of a minimum length are eligible