2

Picking the latest I saw as an example of the class, this is an example of "my exploit isn't working".

Should these, in general, be considered as on-topic or off-topic for Stack Overflow?

Strictly speaking, I think they're within the limits of what should be considered on-topic, but I'm borderline uncomfortable with them.

3
  • 1
    I'm totally 'uncomfortable' with them. Such posters are ALWAYS 'investigating', or 'studying', or 'white-hat wannabes', according to their posts and comment replies. Yeah, right - we all believe everything posted on the internet. If there is a suspicion of malware development, I down/closevote immediate. I don't care what else they post - it's as believable as 'I searched the web but found nothing' and 'I Googled it and didn't understand it - please rewrite it agan' posts. Dec 20, 2014 at 17:14
  • 1
    It is off-topic, it is a superuser.com question. He just doesn't know it yet. Finding out why that is, and doing it by himself, would be the legitimate use for the exercise. If he needs help then his teacher can give him the shove in the right direction, giving him an SO answer doesn't help. Dec 20, 2014 at 17:49
  • That one just looks like someone's homework. Secure Coding 101, chapter 3: buffer overflows.
    – jscs
    Dec 20, 2014 at 19:48

2 Answers 2

8

They are on topic.

For all we know the person could be a budding security researcher writing a malicious program to test it out against a system.

Even if they were a malicious actor, the only thing we do by closing these questions is to drive that knowledge underground, or what we call it when other companies do it: Security through obscurity.

So long as they follow the guidelines we set out for every other question, they're welcome.

Robert Harvey has a post about this; and I'm highlighting the portions that apply to this specific type of question:

Your question here is not materially different than the click-fraud one, and the answer is essentially the same: close if it's crap, or if it clearly intends to harm someone else.

That's key: The intent to harm another person (companies are people too, right?).

He goes on to say:

There is, of course, nothing to prevent people from asking general questions about a technique such as injecting code into a DLL. The question you have to ask yourself is this: does the technique have any possible legitimate uses? If you're a white hat, the answer is often "yes," because understanding the technique can help you defend yourself against black hats. (emphasis mine)

That's the key question to ask when deciding whether to close these questions:

does the technique have any possible legitimate uses?

You can't just ask from the perspective of yourself, you also have to ask from the perspective of a 'white hat' hacker.

2
  • 2
    In case of any future legal action/s against any SO contributors for assisting malware developers, your name now goes on the class-action defendant list :) Dec 20, 2014 at 17:33
  • @MartinJames While you were typing this comment, I was editing the answer. Dec 20, 2014 at 17:33
-1

If you vote to close, then give a reason as OT, there is a further form where you can say that it's about injecting malicious code.

(That's what I just did with your example.)

Not the answer you're looking for? Browse other questions tagged .