13

Recently I asked this question concerning escaping passwords in PHP and found this morning the question has been closed as primarily opinion based.

Why would that be so? The question is clear and the answer posted is thorough and definitive. Is there anything I can do to improve the question to get it reopened?

EDIT (duplicate question suggestion) This is not a duplicate question based on the duplicate provided because that Q&A asked about a POB question receiving lot's of downvotes which the question here did not receive. As a matter of course it received quite a number of up votes and a stellar number of views. It also did not ask how the question can be improved, which I am doing here.

EDIT improved the question as suggested by answers here.

EDIT Now, even after editing, it is closed again with 2 votes to reopen. please advise me on how to improve the question so that it may remain open.

51
  • 14
    "Is there anything I can do to improve the question to get it reopened?" - No, I thought it was rather well done. Being closed as primarily opinion-based means that those guys don't know anything on the subject. Commented Apr 27, 2016 at 12:53
  • 6
    related: meta.stackoverflow.com/questions/321870/…
    – TZHX
    Commented Apr 27, 2016 at 12:57
  • 4
    I don't think it's POB. Just because answers say different things doesn't make it so, the key word being primarily. Answers can contain opinions, so long as they're based on logic and explained.
    – TZHX
    Commented Apr 27, 2016 at 13:02
  • 2
    @JayBlanchard Because the question without the self-answer is complete trash, not unlike the hundreds of one-liner questions we get here everyday. I agree the self answer makes it somewhat unworthy of outright deletion, but only just. Maybe a historic lock would be better.
    – Magisch
    Commented Apr 27, 2016 at 13:03
  • 8
    @JayBlanchard Both upvoted answers heavily contradict each other, indicating either that the correct solution is a matter of opinion (POB) or that the question is broad enough to allow 2 completly contradictory answers to be correct (too broad).
    – Magisch
    Commented Apr 27, 2016 at 13:04
  • 2
    Wouldn't that question be a better fit for Information Security in the first place? Commented Apr 27, 2016 at 13:06
  • 4
    And 3/5 people failed audits associated with the post. Check the timeline. The post is clearly controversially on-topic. Disagreement is fine, and I don't personally have any problem with it being reopened (people are entitled to that opinion). But I thought it was POB/too-broad, and it was causing issues with the auditing system, so I closed it.
    – ryanyuyu
    Commented Apr 27, 2016 at 13:09
  • 3
    Let's keep in mind that the question was probably posed as a typical innocent one "comparison". One that Jay sees often from our peers here. Then Jay establised a canonical with a quality answer.
    – Drew
    Commented Apr 27, 2016 at 13:13
  • 2
    I don't think the proposed duplicate is a good candidate. While some of the information on the target is relevant, it doesn't answer this question completely. Specifically, the duplicate target fails to answer_why was this question closed_ and how can I improve it.
    – ryanyuyu
    Commented Apr 27, 2016 at 13:32
  • 6
    "opinion based / too broad" As long as a question can be answered based on facts and or references the question isn't opinion based. This doesn't mean that there can't be different answers, which may refer to different references. A question is then too broad when either there are too many possible answers, and right now there are 2 which isn't that many, or the question can't be answered within a few paragraphs (And remember that the limit for an answer is at 30,000 characters).
    – Rizier123
    Commented Apr 27, 2016 at 13:36
  • 3
    @Rizier123 Unfortunately the question doesn't mention any contexts such as UX, security, or programming. It just asks if it should do X. If it mentioned such scopes then maybe it wouldn't be too broad.
    – TylerH
    Commented Apr 27, 2016 at 13:43
  • 8
    @Rizier123 Generally if you have to span a comment over three comments to fit, you should probably just be posting it as an answer.
    – animuson StaffMod
    Commented Apr 27, 2016 at 13:59
  • 3
    @Fred-ii- I responded to your flag on why your comments were deleted. These will probably be deleted too since they aren't about the meta post. If you want to raise a separate question, you can; but I can save you some time: Comments are ephemeral and subject to deletion for any reason. Want your point of view to stick around? Post it as an answer. Edit: Looks like another mod responded to your flag before I did. So I'll do a 'what they said' in their response.
    – George Stocker Mod
    Commented Apr 27, 2016 at 14:02
  • 2
    @GeorgeStocker Point taken George, and thanks for giving me a straight answer. Commented Apr 27, 2016 at 14:03
  • 2
    @JayBlanchard Got it. I'd also recommend some other example questions the canonical intends to cover, like "Is cleansing a password compatible with hashing?" or "Can I escape a password I plan on hashing?" etc. (not that those specific examples are good ones...)
    – TylerH
    Commented Apr 27, 2016 at 14:21

5 Answers 5

11

Is there anything I can do to improve the question to get it reopened?

The Meta effect has already taken care of getting the question reopened, but isn't the recommended way for all users to take.

It appears to me that there was some intent behind this particular Q & A that is not expressed in the question itself, although it's hinted at in the timing of the self-answer. I think Drew perceived this correctly:

...the question was probably posed as a typical innocent one "comparison". One that Jay sees often from our peers here. Then Jay established a canonical with a quality answer.

Here's where the question could be improved. If you are creating a Q & A as an intended canonical that is expected to answer a question that is either frequently posed by new users or as a convenient sidebar advice piece, then you could say so in the question. For example:

When considering hashing and persisting users passwords, developers may also think of treating passwords as they would other input data. This question is intended to provide a canonical answer for questions like this:

Should I escape or cleanse user-provided passwords before I hash them and store them in my database?

That way, it looks like the question that a new user might pose, but with context to explain it.

8
  • 1
    Whilst I agree that some context is better, the question remains the same and is still POB in your suggestion (and the original question as the OP more-or-less copied your text).
    – Adriaan
    Commented Apr 27, 2016 at 14:07
  • I have edited my original question based on what you have said here. Thank you for providing the suggestions! Commented Apr 27, 2016 at 14:07
  • @Adriaan I'm not sure how to address the breadth of the core question, rather I'm suggesting that it's possible to frame it in such a way that it is irrelevant.
    – Mogsdad
    Commented Apr 27, 2016 at 14:19
  • I have added some of the other suggestions I have found here along with yours @Mogsdad. Based on some other suggestions I'll be looking for ways to add value to the question and will be updating it more. Commented Apr 27, 2016 at 14:23
  • Thanks @Drew. I have covered that in some of the linked posts. Does it need to be more obvious? Commented Apr 27, 2016 at 14:41
  • 2
    I would drop a caveat statement close and underneath your two references in the answer that suggest "60". People often skim then fly off to their Create Table statement
    – Drew
    Commented Apr 27, 2016 at 14:44
  • 1
    You should not be including meta commentary in a question. A question is where you ask a question, not where you explain why you're asking a question. If you want to make a good canonical question you should be just asking that question well, there is no need to say that you're writing a canonical version of the question, and stating that you intend to in no way changes the quality standards for a question.
    – Servy
    Commented Apr 28, 2016 at 18:36
  • 10-4 @Servy, was going on a recommendation that had been posted here, but has since been deleted. Commented Apr 28, 2016 at 18:56
20

Questions that usually start with Should I do X are frowned upon by the SO community because in my opinion they ask whether I should be doing something rather than how should I do something.

In your question, you ask whether you should be cleansing user passwords. We can have at least 3 types of answers here :

  1. Some people might say that cleansing would be better
  2. Some might disagree with option-1.
  3. Some people might say do X before cleansing Or don't cleanse if you are doing Y Or do-this-do-that.

And we will end up with lots of comments mod flags flying around needlessly. All 3 answers are correct in one or the other way.

Think about it, how is your question different from Should I use ArrayList over HashSet?. Without proper context around the question, we can always end up with contradicting answers which are NOT wrong.

If your question had started with how should I cleanse passwords..., then it would (perhaps) have been a completely different story.

8
  • 1
    Ah! Thanks for pointing that out! I'll make some changes to the question. Commented Apr 27, 2016 at 13:27
  • 1
    @JayBlanchard - Just make sure that it doesn't move from POB -> Too Broad :P
    – TheLostMind Mod
    Commented Apr 27, 2016 at 13:28
  • @TheLostMind Respectfully, it's already there.
    – TylerH
    Commented Apr 27, 2016 at 13:28
  • 3
    @JayBlanchard Also make sure that you don't invalidate existing answers by fundamentally changing the question.
    – Magisch
    Commented Apr 27, 2016 at 13:28
  • 2
    I agree here. That was the reason I VTCed it as Primarily Opinion Based. Just a side note: a one-line question without code is usually not received well. Not even a whole lot of rep to back it will prevent that, especially with robo reviewers around in the queue who just see that sole line of text.
    – Adriaan
    Commented Apr 27, 2016 at 13:32
  • I have now made it a "how should I" question. Commented Apr 27, 2016 at 14:11
  • Thanks for the suggestons @TheLostMind, I have used your suggestion and will continue to seek ways to add value to the question. Commented Apr 27, 2016 at 14:24
  • 2
    Should is literally the most important question in engineering Commented Apr 28, 2016 at 14:06
4

In addition to Magisch and the previous POB close reason, I think the question is way too broad.

"Should I escape/cleanse passwords?" lacks any kind of specific context. What is your concern about uncleansed passwords? What is the problem you're trying to solve/avoid? This question belongs on http://security.stackexchange.com but not here, in my opinion.

3

I was one of the people who closed this question. Its important to note that I didn't downvote it or either of the answers, as I think they're both decent.

There are two main issues with your post:

  • It is very short and unspecific. It heavily looks like the dime-a-dozen one liner questions we get daily in masses. That alone is not enough to condemn it, but its a red flag. It came to my attention at all because it was a controversial "known good" audit in the close vote queue

  • Both answers (heavily upvoted) contradict each other directly. This means one of two things:

    1. The question is broad enough that two completely contradictory correct answers are possible.
    2. The answer to such a question is primarily based on user opinion rather then fact.

Both of which are valid close reasons. I agree that it shouldn't quite be deleted, so maybe a historical lock would be better? The answers to this would probably be a great fit for the Information Security SE, so consider posting that there maybe.

As to improving it, I don't think it can be. Questions like "Should I do X?" with no further context or specific problem scenario are very rarely on topic here.

3
  • 1
    On further review I don't see the second answer as contradictory, rather the poster seems to be adding to what I said. Commented Apr 27, 2016 at 13:16
  • 5
    @JayBlanchard Your answer says "You shouldn't sanitize the password input, here is 5 reasons why not" The second answer says "You should sanitize password input based on this standard, here's why" thats contradictory IMO.
    – Magisch
    Commented Apr 27, 2016 at 13:18
  • 3
    That's why I'm curious about who's right there, and why I believe posting the question on Information Security would get us the answer. Commented Apr 27, 2016 at 13:19
1

The close reason states (emphasis mine, to show where I don't think it fits):

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.

The answers given aren't "almost entirely" just opinions. To state that they are is, bluntly, ridiculous. They're based on references, facts, and specific expertise. I also disagree with suggestions that the question is too broad, the scope that you've added with you edit was already largely implied with the tags.

I think some people were reacting quickly to a meta post about a bad audit (and I can agree, it's not really obvious enough for the audits; and just from it's length looks a lot like what a reviewer would expect to be a known-bad question), or were called to arms in a chat room.

The question is alarmingly short, which is usually an alarm sign for a bad question. On first reading, it may look too broad. But, in context with the tags, it's simply that you've asked a direct question; without any of the preamble that most questions would have to attract an answer of that detail.

Some people just seem determined that it's off topic, and, since it's a PHP question, I can't really disagree too much.

29
  • 4
    Before we start accusing certain chat rooms of posse or mob behavior, maybe we should find some evidence that that happened. Leaning on the crutch of "blame SOCVR for close reasons we don't like" is really harmful to the community, even if you're just insinuating it rather than outright saying it.
    – TylerH
    Commented Apr 27, 2016 at 13:36
  • 1
    @TylerH I'm not blaming anyone. Try not to feel persecuted. Do you deny people were driven to that post from the meta post about the audit, and the post made in your chat room?
    – TZHX
    Commented Apr 27, 2016 at 14:31
  • 1
    I don't know anything about a bad audit meta post; I came upon this one organically, and I've been in that chat room all morning. You may not think you're blaming someone, but it's pretty clear finger-pointing even when you make the supposition that "people were called to arms in a chat room". Even if it's true that people landed here from a chatroom, language like that is divisive and doesn't elicit constructive discussions.
    – TylerH
    Commented Apr 27, 2016 at 14:45
  • 2
    @TylerH There was an explicit "please close this" message in a chat room. That's undeniable. There was also a meta post (linked to in the first batch of comments under this question) today. To try and deny that these two things contributed to the question being closed is ridiculous. You're taking half a sentence of my answer, spinning it to meet your persecution complex, and posting comments saying people are being harmful to the community. I blamed no one; I pointed out why the question got the attention it did from the two highest profile sources that matter.
    – TZHX
    Commented Apr 27, 2016 at 14:50
  • 1
    I haven't denied anything, please don't make stuff up. Can you link to that CV message in that chatroom? And also I'm not saying "people are being harmful to the community", I'm saying that your one half of a sentence is harmful to the community. I said what I meant, not something else. Your aggrandizement is untrue, misleading, and not constructive, not to mention offensive.
    – TylerH
    Commented Apr 27, 2016 at 15:20
  • 3
    @TylerH Saying "I've been in the room all morning", and demanding evidence for something when you could surely find it yourself, well, I took it as denying -- sorry. That was a misunderstanding on my part. But, my sentence is factually correct. If the behaviour it describes is harmful (and I don't claim it is, SOVCR performs a valuable service, and were it not for obvious personality clashes with y'all I'd probably want to be part of it if I ever got to 3k rep), that's not on me...
    – TZHX
    Commented Apr 27, 2016 at 15:29
  • 1
    ... That the attention Jay's post received was that lead to this post, was the result of a meta post and a chat comment, though, that is not deniable by a reasonable person.
    – TZHX
    Commented Apr 27, 2016 at 15:29
  • 1
    The burden of proof always lies with the one making the claim. It's not at all unreasonable to expect you to evidence something when you're one saying it happened. I didn't see it happen, and I'm assuming you did, since you're claiming it happened. Therefore it'd be less work for you to find the link than for me to look for it (you knew when it was posted, what it looked like, etc.). That's the reason I asked you to provide the link.
    – TylerH
    Commented Apr 27, 2016 at 15:34
  • 1
    I didn't call your post offensive. I called your aggrandizing comments offensive, specifically that you were attributing a persecution complex to me and putting words in my mouth. I'll repeat my request that you not make things up :-) I've acted in good faith the entire time.
    – TylerH
    Commented Apr 27, 2016 at 16:33
  • 3
    You said: Leaning on the crutch of "blame SOCVR for close reasons we don't like" is really harmful to the community -- when I did absolutely nothing of the sort, I simply deduced from the available information why the post had been closed.
    – TZHX
    Commented Apr 27, 2016 at 16:38
  • 1
    Without providing any kind of evidence to support your accusation, that's a reasonable comment to make. I'm immensely confused, by the way, as to how you consider taking offense to something as no longer acting in good faith. The two are not mutually exclusive.
    – TylerH
    Commented Apr 27, 2016 at 16:41
  • 1
    Okay, well, you have 10 accounts that all upvote your questions and answers. I said it happened, so I don't need any evidence for it to be considered true, do I?
    – TylerH
    Commented Apr 27, 2016 at 16:45
  • 2
    But, in this case I am correct. And you are not. The evidence is easily accessible for both claims. Your confrontational attitude demanding evidence when it would be easy for you to retrieve it yourself, and you assuming I "misrepresented" what you said rather than misunderstanding it when I gave you the benefit of the doubt shows me that you're not discussing in good faith, but simply being argumentative for fun.
    – TZHX
    Commented Apr 27, 2016 at 16:52
  • 3
    That chat transcript is public. The meta post is public. My reputation history is public. Where does the difficulty lie?
    – TZHX
    Commented Apr 27, 2016 at 18:17
  • 3
    I know. I apologised to who I felt might deserve it. But, No. The "accusations" were linked, one and the same. They weren't even accusations (I never claimed or suggested that someone had done something wrong), simply a statement as to what happened. Again, I'm bored of this. It's been fun though. Have a nice day.
    – TZHX
    Commented Apr 27, 2016 at 18:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .