29

Flag it as spam. I think that's such an edge case it's not worth trying to document and I got plenty of flags on the question. Offering money for a pentest is solicitation of commerce at a point-in-time, so it's not helpful in our Q&A site format for the same reasons that link-only answers are discouraged.


19

If a newer question encompasses a wider and a more detailed field of view, then I think it could be the core question and the older one made a dupe. In your example, the older question really only focuses on the capital letters, which could be explained by the password mechanism doing an upper() or lower() function. The newer question blows the scope wide ...


15

I will stop contributing answers to this subforum This may be the source of your confusion and bad experience - back in the day we used to say this is not a forum. In particular, there are no threads. If you notice (try refreshing the page) answers appear in a random order if they have equal votes with top-voted answers moving to the top. Answers accepted ...


14

Ok, let's look at your 3 answers in question: Hacker from China: You conclude what every other answer did, that the hack could come from anywhere. You then talk about why you don't like software or web sites from certain countries. Then you re-phrase the question to something you want to talk about, and end with "No excuses, email vendors. You know who the ...


13

"When will a vendor implement a new feature?" is not a great question, even if the answer has security implications. Until the information is made public, all we can do is opine. If there was a member of the vendor's dev staff willing to answer, they would either have to: break confidentiality (not something we would want to encourage) disclose something ...


10

Unfortunately, questions asking for resources, links, sources, etc. are off-topic because the answers would just keep growing without end. They are "open-ended" by default.


8

It is unclear - and the comment below the question explains exactly why. If you want a question answered, please make it straightforward for those who volunteer their time to answer it. Also, 15 of your 20 questions on the main site and meta (including this one) fail to meet requirements so have been closed or migrated. This indicates you are not paying any ...


8

Questions about malicious scripts can be on-topic. But that is not an accurate description of your question. “Here's a dump of obfuscated code, what does it do?” is not suitable for Security.SE, not because it's off-topic, but because it's *unsuitable for Stack Exchange. Unfortunately, the classification of close reasons on Stack Exchange tends to lump ...


8

Could you please explain me... how a question about an extension, used for tampering data by many of security experts, is not related to a QA site on Information Security. If that question has to do about the security aspects of the extension, then it would be on-topic. However, if the question is only about installing it - or why it doesn't function ...


7

No - this is by design. If you have a reply to something a commenter has asked, respond to them. For another commenter, reply to them separately. Remember, though, comments are supposed to be brief and temporary, and used to gain clarification of a point - plan for having them deleted.


7

Questions that relate to various laws, where the law is the subject, can be on topic (if about security). Questions asking for legal interpretations or applications of the law are off-topic. Straight up, "is it legal\can I get sued?" is completely off-topic. The flow of logic is simple, and relates to your own answer: "it depends on the jurisdiction". We ...


7

Speaking as a Sec.SE user: this question is about PKI and about the security architecture of an application. It's squarely on-topic. Speaking as an SO user: this question is about application design with a security perspective. I personally find it to be on-topic but borderline; if I found it on SO, I'd suggest a migration to Sec.SE. Since Prog.SE was ...


7

Code analysis isn't generally on topic here. Because there are any number of obfuscated scripts you could dedicate a website to this topic. But that website is not Security Stack Exchange. Far more relevant to us is how we ensure that detection and blocking systems are configured; layered defences; managed anti-malware and antivirus services etc.


7

Since the question in the comments keeps coming up as "What is it you want," I'm going to extract my comment into an answer here: Assume that the links you posted are already broken. Now read your question. Is it clear? You should summarize just enough of the offsite content that someone can answer your question without clicking out of this site. Taking ...


7

I closed it under Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem With my personal emphasis being on, demonstrate an understanding of the concepts involved being missing... it was basically, "Do some work for me."


6

There is no ban on your question - it has just been closed by 5 members of the community, and my quick review agrees with them. That question is definitely off topic here. It is not a question about security. It is not even a question about penetration testing. It is a question you could possibly pose to the Hydra team to ask them why Hydra has that ...


6

From my perspective, the question is off-topic. It is actually more of a SuperUser-type question, as the answers indicate that the solution is found in a browser config. So, I can see your confusion. But, it turns out to be an interesting problem, and this community loves puzzles. This question was highly voted, along with the accepted answer before I came ...


6

The Security.SE Help Center specifically says: You should only ask practical, answerable questions based on actual problems that you face. Chatty, open-ended questions diminish the usefulness of our site and push other questions off the front page. The idea of an AI which is so powerful to automatically solve CAPTCHAs and to automatically write useful ...


5

The question is about turning high-level security requirements into a concrete workflow. That's a pretty typical type of question for Security.SE. Although the study of security protocols is on-topic on CS.SE, this question is very firmly on the engineering side (designing a specific system according to concrete constraints), and thus off-topic there. I ...


5

I hadn't looked at that question until just now, but I can see why it got the close votes. The question itself boils down to "where is product x on vendor y's roadmap" - which is very rarely going to be on topic. Either the vendor has made their roadmap public, in which case having the question and answer here adds no value, or they haven't, which makes any ...


5

You can certainly ask follow up questions. The usually accepted technique is to write your question and just refer to the earlier question with a link and a summary. I also think your follow up is on topic - we do try and focus on the relationship between attack route and defence strategy, but both ends of the discussion are relevant here.


5

The "difficulty" is entirely up to how the application was designed and what resources they have to analyse player behavior. That makes the question too broad and up to interpretation. One game will be easy, while another will be difficult. Once you put in the LoL example, then it becomes about LoL, and only LoL staff can answer your question. If you ...


4

I think your answer post is valid. I'm guessing that some of the canned comments on 'requesting clarification' is down to the limited options. Sure, I can imagine a few minor edits that could make it clearer, but I think it is OK.


4

To contact moderators about a post, use the “flag” button under that post. In this specific case, I don't see a reason to migrate. The question is on-topic here. In fact, it's arguably more on-topic here than on Crypto, since it's about security properties related to information flow, and not about how cryptography works. Furthermore the question has had a ...


4

I think one of the reasons why you are getting poor responses is that your question is not very focused. You might get the same type of responses here. This is what you have said: Prospective vendor has non-standard report You are not sure if you are being overly critical of the vendor How do you communicate caution without making accusations? The ...


4

Do we support such questions at all? In the linked question, OP just dropped some code and asked if it's vulnerable. This sounds to me like a blatant request for code review and definitely didn't demonstrate much research effort. However, I think they could have made it an acceptable question if they created more of a MCVE instead of just half-pasting, ...


4

Yes, that user made an edit to his answer on that question. This is how StackExchange works.


3

As you surmise, the question is off-topic. It isn't about designing or analyzing a security policy. It isn't even about configuring a tool to implement a security policy, which is strictly speaking off-topic (configuring IT tools is off-topic here, and usually on-topic on sites such as Super User, Unix & Linux, Android, Server Fault, Network Engineering, ...


3

As discussed in chat - the question had a close vote and a flag for migration to Crypto. I saw that it wasn't on topic here as currently worded, as there is nothing in it on risk management, and if anything is an opinion piece on how to decide when you are capable of writing your own crypto. I followed the flag for migration, hoping it would be better served ...


3

This question is about IIS configuration. Nothing about it is related to security. Yes, you may think that there is a security benefit in hiding the IIS version number. (But I think you're wrong. Hiding the fact that you're running a vulnerable version doesn't make it less vulnerable.) The question “is there a security benefit in hiding the IIS version ...


Only top voted, non community-wiki answers of a minimum length are eligible