102

I thought we had clearly settled that:

  • We don't try to stop the spread of knowledge simply because it has malicious uses, or even is essential to the creation of malware.

but

  • We also don't allow questions asking for help in creation of malware.

Is that still the standard? This question appears to be on the wrong side of that line. The knowledge itself is trivial and multiuse, but the "code to be debugged" is an obvious attempt to spread a virus and silently infect machines running older versions of Windows.

enter image description here

22
  • 22
    Where had we settled that "we also don't allow questions about the creation of malware"? I mean, maybe we have, but not in the post you link to. Commented Jul 5, 2014 at 1:48
  • 1
    There's also meta.stackexchange.com/q/3528/135695 and meta.stackexchange.com/q/72184/135695
    – Ben Voigt
    Commented Jul 5, 2014 at 2:26
  • 11
    With respect to Chris's argument (which I agree with: treat each case individually), the OP has a somewhat sketchy history. Not cut and dry, but. Commented Jul 5, 2014 at 2:35
  • 37
    Tangential: I, and others, were burned when we gave the benefit of the doubt to a bad seed who seemed to have turned. Then he used the code we helped him write to spam SO at scale. Super. Commented Jul 5, 2014 at 2:39
  • 26
    Here's a hypothetical scenario. A user asks a question on Stack Overflow explicitly about writing a virus to infect self-driving cars, or pace-makers, or air traffic controller and airplane computers, or other critical digital devices. Other users help the OP to write the virus, which goes on to injure or kill a few people, maybe even hundreds or thousands. Does that make the other Stack Overflow users accomplices to the crime, legally?
    – user456814
    Commented Jul 5, 2014 at 22:47
  • 4
    Or a less extreme example. Again, a user asks a question on Stack Overflow explicitly about creating a virus to steal credit card numbers from personal and corporate computers. Other users help the OP to write the virus. After using the virus to steal hundreds of thousands of credit card numbers, the OP sells them on the black market, or uses them personally. Again, does that make the Stack Overflow users who helped the OP accomplices in a crime?
    – user456814
    Commented Jul 5, 2014 at 22:50
  • 14
    I don’t really care one way or another, but that question was awful and should have been closed regardless of whether it was about the creation of malware.
    – Ry- Mod
    Commented Jul 6, 2014 at 17:23
  • 3
    @Cupcake: It at least makes them morons. So someone asks for debugging help for his keylogger (which sends key logs and screenshots to a SMTP/TLS server), and for his "USB spreader", and people are all too eager to help because "rep". There is something very wrong with SO.
    – ninjalj
    Commented Jul 7, 2014 at 11:45
  • 6
    It still has to be a real question. "What's wrong with my code" is not a real question.
    – Robert Harvey Mod
    Commented Jul 7, 2014 at 17:12
  • 2
    what I find really disturbing with the quoted question is the hypocrisy of the author transfer my program to USB devices. And also that the reason why the purpose of the code is so obvious is that the OP posts so (too) much of it.
    – njzk2
    Commented Jul 7, 2014 at 18:16
  • 2
    @Cupcake If a guy brings his car to a mechanic for repairs and then uses it as a getaway car for a bank robbery, is the mechanic an accomplice? If someone buys a gun and then murders someone with it, is the store owner they bought the gun from an accomplice?
    – Michelle
    Commented Jul 7, 2014 at 18:30
  • 11
    @Michelle In the United States, the mechanic is an accomplice only if he knows that the car will be used for a robbery. In this case, we know the code is being used for a virus. If the question was more general, then it would be different.
    – Moby Disk
    Commented Jul 7, 2014 at 18:40
  • 7
    @MobyDisk It's not a crime to deploy a virus in your own sandbox environment for research or testing purposes, though. We don't know the user is going to use the software to commit a crime.
    – Michelle
    Commented Jul 7, 2014 at 18:41
  • 1
    @Michelle - Given the quality of the code, I am highly dubious it's for research purposes :)
    – nevelis
    Commented Aug 8, 2014 at 8:03
  • 4
    @nevelis I've seen some pretty...unfortunate code from grad students.
    – Michelle
    Commented Aug 8, 2014 at 10:39

9 Answers 9

73

It would be interesting to hear what the wise folks at IT Security have to say about this, since I expect they have established their own set of rules on what questions it is ethical to ask. Indeed, some discussion of such matters can be found on their Meta at Clarify our stance on black hat questions.

My feeling is: let the question stand as long as the OP is neither:

  • failing to follow the model of responsible disclosure in a situation where there is a particularly clear moral argument for it
  • blatantly an irresponsible script kiddie looking for someone to help them break a specific system, and the question is too specific to be of use to future readers

Allowing public discussions about how to create malware doesn't just help blackhat malware authors, it also helps penetration testers and people trying to defend against malware. Defending against an attack often requires a decent understanding of how the attack works, which is best obtained by performing the attack yourself in a controlled environment. If you're a web developer, imagine trying to ensure your applications were secure against, say, SQL injection or XSS without ever having an injection vulnerability demonstrated to you, or ever creating one yourself, because merely creating such things or helping somebody to do so was considered unethical. The idea is absurd.

I can't comment on whether I agree with the decision to censor the specific deleted question asked about here, since I'm below 10k rep and so now unable to view it. Judging from the screenshot, the entire issue is moot for this question since - moral issues aside - it deserved to be purged for crapness alone.

9
  • 2
    Are you aware that even the linked wikipedia page mentions that so-called "responsible disclosure" is only one way to responsibly handle security holes and need not be the best one in any case? Full disclosure sometimes has vastly better effects. Commented Jul 6, 2014 at 13:22
  • 1
    @Deduplicator You're quite right; my point about responsible disclosure was born out of a mixture of ignorance of the existing discussion about disclosure in the security field and a lack of careful thought on my part. I've edited my answer to reflect that "responsible disclosure" isn't always right.
    – Mark Amery
    Commented Jul 6, 2014 at 13:56
  • Does helping someone do something as simple as debug their malware make Stack Overflow users liable in any crimes then committed with that malware?
    – user456814
    Commented Jul 6, 2014 at 17:08
  • @Cupcake Legally? Dunno, I'm not a lawyer. I hope not, and don't see how the law could fairly assign liability most of the time. Even the most innocent-looking debugging problem could plausibly have either been asked by someone writing malware or turn out to be useful to a malware author in the future. I expect some legal systems will have case law or even statutory principles dictating that the publication of information or technology that is later used for criminal purposes doesn't render the publisher a conspirator to the crime, but I couldn't quote you any or suggest where to look.
    – Mark Amery
    Commented Jul 6, 2014 at 17:26
  • 9
    Malware generally has to do two things: (1) Make changes to a system that are generally not done, either an escalation of privilege, system library replacement, etc. and (2) hide from the user. It seems very rare that a study of malware needs to study both aspects at the same time (at the very least, installation into hidden parts of the system can first ask the user's permission). So code that does nefarious things without a prompt can safely be banned, IMO.
    – Ben Voigt
    Commented Jul 6, 2014 at 18:39
  • 1
    @MarkAmery: There's a screenshot now. And the question is bad, independent of what the author might aspire to do with any knowledge gained. Commented Jul 7, 2014 at 12:30
  • 5
    To add a note regarding Information Security: there are very few questions that are clearly black hat and not clearly crap. Which is a pity, because as a white hat, I find those questions very interesting — in order to build a secure product, I need to think of all the twisted ways in which people will try to break it. Commented Jul 7, 2014 at 16:48
  • @Deduplicator Once again, I agree with you.
    – Mark Amery
    Commented Jul 7, 2014 at 21:30
  • 1
    @Deduplicator - Somewhere I read the {Responsible|Full} Disclosure is the Prisoner's Dilemma in Game Theory. In this case, Responsible Disclosure is the course until the other side stops cooperating. Once the other side stops cooperating, then Full Disclosure is an option.
    – jww
    Commented Jul 8, 2014 at 4:48
29

I think the way viruses work an spread themselves is very interesting, and it's great learning material. Modern computers should be quite well harnessed against simple viruses like this, and they are very unlikely to become a real global threat.

I've written a 'virus' or two in my younger days. I remember that I once got an (paper) book from the library, that described how viruses work and how to write one yourself. So I followed the steps and wrote an actual, self spreading MS-DOS virus in Batch.

It did hardly do any harm, except mess up my own computer a little, but still I think it was a great learning project.

Currently, I don't have any intention to take over the world with my virus programming skills, but I still think that project was cool. As a kid it's nice to do things that aren't allowed, including climbing over fences, gathering jars full of spiders, abusing fireworks, and -if you're a nerd- mixing up kitchen chemicals or writing a virus. And I think at the level we're talking about, they are all equally innocent. I mean, copying a file and making it hidden? Really? I think it's cute.

6
  • 4
    Yes, but you can learn to copy a file that isn't a virus, or learn to self-replicate a program that at least is missing the autorun portions. You can learn to configure autorun for a file that doesn't replicate itself. You can learn to make hidden a file that isn't autorun.inf. And you can ask the user before performing any of the steps. Only when all these are put together, in a manner that deceives the user, is it malicious. And that ought to be a line that makes it off-topic.
    – Ben Voigt
    Commented Jul 7, 2014 at 16:01
  • 3
    I disagree for the reasons mentioned. The only reason this question if off-topic is because it is very poorly written.
    – GolezTrol
    Commented Jul 7, 2014 at 17:37
  • 1
    Putting the virus together may be "cool" and have geek appeal to young'uns, but that doesn't make it an essential part of learning how computers work. All the steps can be performed and studied harmlessly in isolation. In this instance, (1) detection of removable media (2) self-replication (3) auto-launch and (4) copying a hidden file are all individually interesting tidbits. A ban on questions which combine all four won't impede learning any of them.
    – Ben Voigt
    Commented Jul 7, 2014 at 17:43
  • 6
    In chemistry class we blew up hydrogyn balloons. It wasn't 'essential' for learning chemistry, but it sure was cool. And maybe it was essential. Personally, I was intrigued by this phenomenon of computer viruses, and I spend months learning about them when I was 13, 14 years old. If I wouldn't have, maybe I wouldn't have gained the interest in general programming that I have today. Should SO facilitate it? Well, my book did. It's just great fun to see how you can combine a couple of simple steps in something seemingly so sophisticated, and it makes it attractive to get started.
    – GolezTrol
    Commented Jul 7, 2014 at 18:02
  • 1
    @GolexTrol: SO's function isn't to raise people's interest in programming. That is (one) function of a tutorial. SO is not meant to be a tutorial, or get anyone started in programming, but a reference. Anyway, a programming book that puts together a virus "to make things interesting" and doesn't include basic safeguards like user confirmation, isn't intriguing, it's a menace.
    – Ben Voigt
    Commented Jul 7, 2014 at 18:05
  • 1
    I didn't say that SO should be a tutorial, or that it's sole purpose is to raise interest. Nevertheless, since SO is used not only by 'workers' but also by scholars and computer enthousiasts, you will get questions about stuff like this. I think there's no harm in trying to write a virus, only in deploying it. But since this discussion sounds as if it could be endless, let's agree to disagree. If this answer isn't enough, make sure to read the answer by Gilles as well, with which I mostly agree. :)
    – GolezTrol
    Commented Jul 7, 2014 at 18:42
15

I think you will find that any (hypothetical) rule that "we allow Questions about writing malware" would not achieve consensus. There would be enough people who feel strongly that such Questions should not be allowed that they'd be downvoted and closed anyway. And probably deleted too.

Same for people asking for help cracking license protection schemes, work around web-crawler blocks, sending spam and so on.

11
  • 2
    questions about how to defend are wellcome? Commented Jul 5, 2014 at 14:57
  • 5
    @DarioOO: If they are programming questions, yes.
    – Ben Voigt
    Commented Jul 5, 2014 at 19:28
  • 14
    How about the case where one acquire a movie/game some day, and today it is not on sale anymore. the cd/dvd is unreadable because those things gets scracthes etc. download it from peer2peer but some starforce or other sheisse is blocking this legitimate license owner to play his game/watch his movie. I strongly belieive (and French law also says so) that you are entitled to legally crack the protections in this case. imagine the frustration and anger at SO community to get your question closed, because of rigid views... Same thing than the Scunthorpe problem.
    – v.oddou
    Commented Jul 7, 2014 at 2:29
  • According to you creating maleware is not programming!!! Since sharing knowledge is what we should care about.
    – STEEL
    Commented Jul 7, 2014 at 10:47
  • @Stephen: So, to summarize your post: Too many morons, therefore it does not matter what we decide. Commented Jul 7, 2014 at 12:32
  • @v.oddou: Your comment only applies to the "same for cracking license protection" addendum in the answer, and isn't relevant to the original question, correct?
    – Ben Voigt
    Commented Jul 7, 2014 at 15:57
  • We do enforce some rules. For example, each time Apple releases a new iOS version, you'll find 5 users to close questions because “we don't answer stuff that's covered by NDA”, even though there is a clear policy that we don't enforce NDAs. Moderators summarily reopen such questions (when there is no valid reason to close them). Commented Jul 7, 2014 at 16:50
  • @BenVoigt: Yes, it is slightly off, because license crack != virus. Personally I would tend to refuse all help into virus making related questions, and would devise some kind of obvious different background coloring to "tag" the question as ethically controversial, so that people will "feel" a "discomfort" into answering it. I spoke about license because of the relation with the Scunthorpe filtering issue. If we decide to apply censorship, we are no better than China and its a slippery slope to Orwellian realms. However we can freely decide to not answer :)
    – v.oddou
    Commented Jul 8, 2014 at 7:20
  • "If we decide to apply censorship, we are no better than China and its a slippery slope to Orwellian realms." - That is an extreme view. Consider that just about every country in the world applies censorship in some form or another.
    – Stephen C
    Commented Jul 10, 2014 at 3:28
  • @Deduplicator "So, to summarize your post: Too many morons, therefore it does not matter what we decide.". Only if you assume that everyone who disagrees with you is automatically a moron. I don't ... so IMO, that is an incorrect summary.
    – Stephen C
    Commented Jul 21, 2014 at 3:49
  • @Deduplicator - A better summary would be that StackOverflow operates by consensus, and decisions that are not backed by a consensus will be difficult to implement. Not impossible, difficult. And probably requiring concerted moderator action of some kind. (Like when the "homework" tag was stomped.)
    – Stephen C
    Commented Jul 21, 2014 at 3:55
13

We have clearly settled that we do allow questions about the creation of malware. Why are you bringing this up again? Why do you want to change the policy?

From the top-voted answer on Should virus or illegal-activity related questions/code be allowed? (copying the entirety of Ondra Žižka's answer because it's a good one):

Why not, virus coding is knowledge like anything else. It can be used for antiviruses, system core programming etc.

Studying viruses is not bad per se. Releasing them is. Studying security vulnerabilities makes good people fix them, bad people exploit them.

Censoring virus-related topics will not stop virus authors. Those are good enough to go on without stackoverflow.com. It will only decrease knowledge about the viruses, and potentially raising developers for companies like AVG, Avast, etc.

Of course, not those openly illicit. But let's not be naive - a real virus creator would not go here and ask "Hey I want to make a virus." Those who would are most likely not capable of creating it anyway.

From the top-voted answer on Dealing with questions of nefarious intent:

Basically, what I'm saying is that you have to treat each post on its own merits.

From the top-voted answer on Should "virus source" questions be deleted outright?:

Personally i have no issue with the OP asking specific questions about the code, as it is programming related after all. There is nothing wrong with studying virii, it is the use of the code that is criminal.


Speaking as a professional white-hat developer, I want to see black hat questions. They tell me what I'm supposed to defend again. When designing a defense, a lot of the difficulty is imagining how it could be breached. I want to know what my adversaries are up to so, so it would be highly counterproductive to prevent them from speaking in my presence.

This is in addition to the futility of recognizing nefarious content as such. One man's malicious spyware is another man's IT policy enforcement tool. The only clearly malicious content is script kiddies, and we have other reasons to close “how i rite virus???? plzsendtehcodez!!!!”.

8
  • I feel like you're misrepresenting several of these. The last one was 100% against the question, for not disclosing its harmful nature. And such questions are overcome by policy changes anyway -- please explain what this code I didn't write does questions are now solidly off topic. So all that the malicious code that's left is malicious code written by the author. And I'll repeat what I've said in comments on other answers: It's perfectly possible to learn any single technique in virus writing without putting them together and creating something actually malicious. Also possible to prompt
    – Ben Voigt
    Commented Jul 7, 2014 at 17:09
  • the user before performing potentially harmful changes. I don't think it's unreasonable to demand that potentially harmful code on SO come with some basic safeguards against accidental execution. The sort of black hat discussions a white hat wants to be aware of won't take place on SO regardless of our policy on this anyway, because the threats that should be concerning you aren't dumb enough to discuss them where their techniques can be found by Google, and seen by 10 million non-sympathetic users.
    – Ben Voigt
    Commented Jul 7, 2014 at 17:12
  • @BenVoigt You are misrepresenting the third quote: it is in favor of the question, as long as the black hat nature is not hidden. The discussion you started here is about questions about “programming viruses and malware”, not about editing questions to make a potential malicious nature apparent. Commented Jul 7, 2014 at 17:32
  • @BenVoigt Prompting the user is needless clutter in understanding the techniques involved, and it's rather silly besides (what does “prompt the user” mean on a server?). Commented Jul 7, 2014 at 17:33
  • 1
    @BenVoigt I do get value out of questions about writing exploits on Information Security — a clearly black hat topic. Most of the threats that I'm concerned about do get discussed publicly; I think you're confusing threats and vulnerabilities. Commented Jul 7, 2014 at 17:35
  • By "threats" I was referring to the competent subset of your adversaries, the ones you mentioned in "I want to know what my adversaries are up to so, so it would be highly counterproductive to prevent them from speaking in my presence." The adversaries that threaten you aren't discussing their techniques on SO, no matter our policy. Because they're trying to keep those techniques away from your eyes.
    – Ben Voigt
    Commented Jul 7, 2014 at 17:36
  • 1
    @BenVoigt How do you know who my adversaries are? That's a remarkable feat, when you (as far as I know) don't even know what kind of product I make. Most techniques to exploit my product are well-known in general terms — buffer overflows, race conditions, incorrect configuration, etc. They get published in conferences like Black Hat and DEFCON. Why wouldn't they appear on SO? Commented Jul 7, 2014 at 17:45
  • Despite the name, Black Hat and DEFCON are white hat, or at most grey, conferences. I don't need to know what subset of "all the competent black hats" pose a threat to you personally, to know that the ones who would be willing to expose their techniques on SO, if our policy permits that, aren't causing you to lose sleep.
    – Ben Voigt
    Commented Jul 7, 2014 at 17:53
10

I feel questions about writing malware are on topic, but I also note that no one is required to answer them and users may downvote for any reason. Thus asking such questions is unlikely to be productive for the asker, not to mention such questions are on the public record should any knowledge gained be used in anger.

Questions about analyzing malware are on topic, either here or perhaps at Reverse Engineering (though I'm not familiar with that site's policies), and malicious web app modifications ("my WordPress got hacked, what's this script trying to do?") might be on topic on one of the web-related sites.


Aside: one of the other answers mentions people looking to work around web crawler blocks. I've answered a couple of questions in the [jsoup] tag about scraping sites that try to stop non-browser agents or that have a terms of service forbidding automated access. I usually don't have enough context to determine if the asker is good or evil, but the information is being served to the public, and I know a motivated web server can make things arbitrarily difficult for a scraper, so even if I should enable an evildoer the damage is limited. As this is a [discussion] I'd like to hear (in the comments, or in another question if there's enough interest) what the community thinks.

2
  • 3
    "my WordPress got hacked, what's this script trying to do" is not a valid question on SO Commented Jul 5, 2014 at 18:07
  • 1
    @ZachSaucier: hence "on one of the web-related sites". Though maybe it's off-topic there too, I don't profess to be an expert on their policies. Seems like there should be somewhere to ask for help figuring out what was compromised, but maybe that's not anywhere on SE. (Please tell me if you do know and I'll edit my answer.) Commented Jul 5, 2014 at 18:09
10

In my humble opinion it would be a very bad idea to banish this kind of uncomfortable questions.
By doing this, you're actually censoring someone's right to knowledge.

There's a very big difference in having the knowledge to do harm and doing it in the first place.

Every hacker I know, and I'm speaking of true hackers not the TV shows hackers (See 1), obviously have some extensive knowledge on malware creation, hacking, cracking, disassembling and so on...

By denying this kind of questions, you're going to deny the very same right to understand and learn these concepts. Which is bad.
Really bad.

Oh noes! An eveil hacker!

13
  • 7
    I disagree. Anyone is welcome to specific bits of knowledge, if they write a proper question focused on that knowledge. We're under no obligation, nor should we help, with the process of combining bits of knowledge into a malicious total.
    – Ben Voigt
    Commented Jul 7, 2014 at 15:58
  • 10
    There's no such thing as a "right to knowledge." SO is a privately-owned website, and you're welcome there so long as the overlords decide you are welcome there.
    – Robert Harvey Mod
    Commented Jul 7, 2014 at 17:09
  • BenVoigt: OP asked: "Should questions about programming viruses and malware be allowed?" not "Should I write a malware for an asking user", so I don't see your point here. @RobertHarvey while your comment isn't wrong, I strongly hope that SO doesn't stick to an "The ball is mine hereby I choose the rules" attitude... otherwise the whole "community" can GTFO
    – domokun
    Commented Jul 7, 2014 at 17:28
  • 1
    @domokun: I was merely commenting on the entitlement attitude, though my comment is one hundred percent true.
    – Robert Harvey Mod
    Commented Jul 7, 2014 at 17:29
  • @domokun: No, I didn't ask that. Check the post edit history. I asked whether the policy is to allow questions irrespective of potential use in malware, as long as the question is not about malware. (Non-programming questions about malware, which includes reverse engineering, would belong on Information Security. Reverse engineering is off topic on SO, a policy I don't necessarily agree with.)
    – Ben Voigt
    Commented Jul 7, 2014 at 17:46
  • @BenVoigt Ok, I didn't saw the edit, and I also didn't noticed you were OP :) Anyway, the point of SO is help others achieving some specific goal, I think. I don't see why parts of code that could be built into a malicious code would be treated differently
    – domokun
    Commented Jul 7, 2014 at 18:14
  • 1
    @domokun: That's the policy I'm advocating: Parts of code that could be built into a malicious code are fine. The question at issue is different, the code already is integrated in a harmful way.
    – Ben Voigt
    Commented Jul 7, 2014 at 18:17
  • @BenVoigt I understand this, but my point is that you cannot know that this code will be used in a malicious way. The user may want to learn and understand how a malware works (an potentially how to stop one) by building a real malware. There is no problem in that. Smith and Wesson have built hundreds of thousands of guns, but nobody never prosecuted them form murder. Can you get the parallax?
    – domokun
    Commented Jul 7, 2014 at 18:27
  • @domokun: I consider questions like this: stackoverflow.com/questions/24606532/… (the OP is trying to exploit a vulnerable test program, which they are obviously doing to learn) OK, while I consider questions like "help me debug my USB spreader" not OK. There is a clear malicious intent there.
    – ninjalj
    Commented Jul 7, 2014 at 18:35
  • 1
    "censoring right to knowledge"? What is this right to knowledge? The closest I can find is article 19 of the universal declaration of human rights: "Everyone has the right to freedom of opinion and expression; this right includes freedom to hold opinions without interference and to seek, receive and impart information and ideas through any media and regardless of frontiers." I don't think they mean "right to learn about malware" though.
    – Floris
    Commented Jul 7, 2014 at 19:06
  • @Floris I'm not talking about laws, which differ from place to place. I'm talking about a higher right that every people should have, that is the right to learn. Learn something. Whatever. "Good" or "bad", even though both words are pretty subjective. Do you think that people should be denied to learn about a malware? It's perfectly fine for me, but I beg to differ and I strongly disagree with you. It's not what you learn (or know) that matters, is how you use that knowledge.
    – domokun
    Commented Jul 7, 2014 at 20:49
  • 1
    Yes we disagree. There is such a thing as "dangerous knowledge", and if you have such knowledge I believe you have an obligation not to share it - nobody has a right to demand that you do. Knowing that knowledge can be abused I can choose to keep it hidden - that is a perfectly moral choice. Choosing to share it and saying "it is up to you how you use it" is not automatically wrong but can be misguided. If an angry man with a gun says "did you see a girl come this way" and you point at her hiding location, are you "just sharing knowledge"? Without knowing your audience it is better to be safe.
    – Floris
    Commented Jul 7, 2014 at 20:54
  • According to this line of thought, every participant to an Information Security course should be screened and admitted/denied based on someone else judgment, which fortunately isn't the case. Anyway, security through obscurity in the age of knowledge would not work. If they want the answers and they're motivated enough, they'll find them, eventually.
    – domokun
    Commented Jul 7, 2014 at 21:13
10

Why not! the faq section clearly describes that if the question is

  • a specific programming problem, or
  • a software algorithm, or
  • software tools commonly used by programmers; and is
  • a practical, answerable problem that is unique to software development

… then you’re in the right place to ask your question!

then it is allowed and on Topic.

StackOverflow is all about about programming Q&A. We just simply can't allow such questions to be asked just because they are unethical.

I think that we should provide the source of knowledge and leave it up to the users that how they use that knowledge.

5
  • 4
    The site also states that Meta Stack Overflow is moderated by you. As users we can and do shape what is or is not possible or allowed on the site all the time. It seems that this issue is just not addressed directly in the FAQ, yet. Commented Jul 7, 2014 at 11:29
  • 1
    yes exactly... my point is that as in my knowledge SO is all about programming Q&A not about what is ethical and what is not. :)
    – SMR
    Commented Jul 7, 2014 at 11:32
  • 2
    Going by the responses to this question so far I don't see any consensus in either direction so I don't imagine any policy changes happening. But as always it is up to a user to choose how they wish to vote or if they'd like to provide an answer to a question. I don't imagine too many of these types of posts will be getting much positive attention or high quality answers. However, they also won't be closed purely for having a topic about compromising systems. Commented Jul 7, 2014 at 11:37
  • That's not to say though that the posts will not be closed for other reasons and that people may be less lenient and more strict when applying the off-topic or poor quality guidelines to the post. Commented Jul 7, 2014 at 11:39
  • yes I agree with you. and if the community thinks that we should not allow such questions then we can also make it the part of the FAQs.
    – SMR
    Commented Jul 7, 2014 at 11:42
-2

Such questions should be allowed. Its enhancing the way you do coding . And what do you think of answerers to such questions?

See, its not about if question is good or bad .Its about Good answer no matter what kind of Question is asked.After all ITS ALL ABOUT CODING ,AND CODING IS NOT LIKE GOOD OR BAD THING.

7
  • 1
    Code that performs system changes without prompting the user for permission is a bad thing.
    – Ben Voigt
    Commented Jul 7, 2014 at 16:02
  • 1
    @BenVoigt Code that performs system changes without prompting the user for permission is IT policy enforcement. As a developer, I agree: it is a bad thing. Commented Jul 7, 2014 at 16:43
  • @Gilles: IT Policy enforcement is off-topic on SO. Besides, a well-written policy deployment tool should still prompt for user confirmation unless the correct command-line arguments for unattended operation are provided. That again is a level of safety.
    – Ben Voigt
    Commented Jul 7, 2014 at 17:15
  • 2
    @BenVoigt Why would programming an IT policy enforcement tool be off-topic on SO? Why would a policy deployment tool have an interactive mode at all? Commented Jul 7, 2014 at 17:29
  • @Gilles: (1) Programming topics encountered while developing such a tool are on-topic, development of the tool is not, and policy topics are not. (2) For testing and debugging, and to prevent accidental activation. And SO questions are necessarily in the debugging phase.
    – Ben Voigt
    Commented Jul 7, 2014 at 17:34
  • 1
    @BenVoigt (1) “Development of the tool is not” — I don't understand what you mean. Development is on-topic on SO. If you mean that a question involving the tool as a whole would likely be too broad, then yes, sure, but this has nothing to do with the present discussion. (2) An interactive mode for testing? Are you a real programmer? I do automated testing. I don't want to click a zillion confirmation prompts to run my fuzzer! Commented Jul 7, 2014 at 17:38
  • @Gilles: Your fuzzer is not a policy deployment tool. And automated tests can use the unattended switch too. But not all testing is automated.
    – Ben Voigt
    Commented Jul 7, 2014 at 17:48
-23

It depends if this site is meant as white hat or hat-less, as a white hat site as i believe this to be no we should not allow questions which are clearly designed for writing or fixing malware but aside from that we should not disallow a question just because it could be reworked into malware ... or at least this is my opinion

5
  • 4
    we should not disallow a question just because it could be reworked into malware does make little sense to me: any post could be reworked and turned into anything else - even not by the OP. We see some question defacements when the OP gets a satisfying answer. Often they turn it into asdfasdfasdf or even worse. Who can prevent a question to be turned into something else, i.e.: a question about malware? Commented Jul 5, 2014 at 8:24
  • that's what i said as a double negative means a positive... maybe i should have said "we should not reject" ... or "we should not refuse" ... where is your problem with my statement? was my wording too fancy for you? Commented Jul 5, 2014 at 14:49
  • 2
    Calm down. I just pointed out that all questions (and answers too) can be defaced. By anyone. So, a good question or a good answer can turn into anything else. That's why I couldn't find a logic in your last sentence. Commented Jul 5, 2014 at 15:00
  • I think that in this area, we cannot tell something is white or black. Let say it is on a grayscale. And it is the role of everyone to detect if something will be used for the "wrong" purpose. Stackoverflow is a wonderful site, and it's alive!, that's us that make it this way... for the best or not...
    – codea
    Commented Jul 5, 2014 at 15:06
  • 1
    As a white hat, I definitely want to see questions which are clearly designed for writing or fixing malware. If you don't want to see such questions, you aren't a white hat, you're a fraud who attempts to hide his incompetence by silencing his would-be adversaries. Commented Jul 7, 2014 at 16:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .