4

After I took the time to answer this question, it got closed as too broad.

Some points I couldn't stop wondering:

  • I agree this is Too Broad.

  • I also think this should be closed.

  • What about those cases that do not receive an answer?

I personally feel obliged to point out horrible security flaws when I encounter them because I feel the whole topic gets easily overlooked and if users do not get educated or at least have a chance to become aware of the problems, they just walk away, spreading security issues all over the internet.

While I can see why broad questions are a problem generally, in the realm of security, it might be better to allow them. Commenting does not allow to be as verbose on the problems as I was with the answer before the closure (and as it often needs to be to at least have a chance of being effective).

So my question is: Is it a good (morally) idea to close such questions before OP gets at least a chance to see the underlying problems? Should we rather try to allow users to be educated on security problems?

13
  • I think not. Stack overflow is meant to be a Q+A repository, not a guide on how to secure your applications
    – Tim
    Mar 16, 2016 at 11:16
  • Right, @TimCastelijns. Yet, those questions do get asked and the only correct and (morally fine, imho) answer is to point out the problems that the approach generates.
    – Tobi Nary
    Mar 16, 2016 at 11:17
  • Where would we draw the line? Which questions (read: topics) deserve to be left open because there are problems that OP doesn't understand? Security, while it is a very important one, is not the only topic where issues like this can arise
    – Tim
    Mar 16, 2016 at 11:23
  • @TimCastelijns, I see drawing a line as the crucial and hard-to-solve point of my question and am aware of that, yes.
    – Tobi Nary
    Mar 16, 2016 at 11:24
  • 4
    I personally feel obliged to point out horrible security flaws when I encounter them because I feel the whole topic gets easily overlooked - That could apply to almost anything. Some people might feel obliged to point out performance bottlenecks, some might feel obliged to point out readability problems and other potential errors. So, yes, it is completely morally acceptable to close such questions :) Mar 16, 2016 at 11:27
  • @TheLostMind, how does that argument work? In what moral system is 'whatever can applied generally is morally acceptable' an acceptable rule?
    – Tobi Nary
    Mar 16, 2016 at 11:37
  • 1
    @SmokeDispenser - I am trying to say that a broad question is well, broad irrespective of what aspect of programming it falls under. You could write a canonical answer (if the question is common enough) or a detailed blog and redirect the OPs to that (yes, I know that that's an off-site resource). That will serve the purpose right?. Mar 16, 2016 at 11:44
  • 1
    Also note that the close reason clearly states - There are either too many possible answers, or good answers would be too long for this format. Your answer is good but unfortunately, too long IMHO :) Mar 16, 2016 at 11:46
  • @TheLostMind, good call. I might even rethink contributing at all, seeing that the Q got deleted altogether w/o users pointing out their reasoning behind that. My whole point was: this should be not only okay to do but encouraged. Obviously, this is a so horribly wrong that the Q got deleted w/o a comment.
    – Tobi Nary
    Mar 16, 2016 at 11:48
  • 1
    @CodeCaster - I think it will be closed as cannot reproduce :P Mar 16, 2016 at 11:51
  • @SmokeDispenser - The close reason states why the question was closed Mar 16, 2016 at 11:54
  • I saw password, PHP and md5 and now my sides have come off.
    – user1228
    Mar 16, 2016 at 14:31
  • 1
    @Will The "PHP" part should've been enough of a warning.
    – Ian Kemp
    Mar 18, 2016 at 8:42

2 Answers 2

4

Security is a very hard and broad subject, making it trivial to make fatal mistakes.

I don't think it is Stack Overflow's place to correct each and every instance where some self-built security-related system will be reviewed.

When the OP, in 2016, claims things like this:

In PHP I normally encrypt passwords with md5.

They are beyond saving, at least within the bounds of a Stack Overflow answer. They need a good book, a lot more practice and someone to educate them, and any answer you will throw at them will only partially solve the problem.

Apart from that, the requirements of the linked question are unclear, they don't mention in what way they want to protect the password. For example HTTPS could be the go-to solution in that scenario, if they want to prevent eavesdropping.

In other words: from their question it is clear that they lack a fundamental understanding of the subject. That isn't a close reason anymore, so too broad / unclear apply as well.

4
  • Actually, 'You lack a fundamental understanding of the subject' seems like an acceptable close reason for this, as it at least points out the actual problem rather than too broad or unclear. Hm. Should read up on why that is no longer available :)
    – Tobi Nary
    Mar 16, 2016 at 11:40
  • 3
    @SmokeDispenser it's no longer available because it hurts peoples' delicate feelings.
    – Ian Kemp
    Mar 16, 2016 at 11:42
  • 2
    @SmokeDispenser it's no longer available because it would allow easy closing of 95% of the posts and so removal of 95% of the advertising reven..... bad questions. Mar 16, 2016 at 11:46
  • 1
    It was removed as a close reason because people abused it; using it to close questions that are just low quality/poorly researched, or having other downvote-worthy problems, rather than what the actual close reason was for, namely questions where they couldn't be answered because providing the background information that the OP is lacking would make the question "too broad". It's actually not a particularly common problem, and thus wouldn't apply to too many questions.
    – Servy
    Mar 16, 2016 at 14:25
-4

Is it a good (morally) idea to close such questions before OP gets at least a chance to see the underlying problems?

No.

Should we rather try to allow users to be educated on security problems?

Yes. First you must wait for someone who doesn't know what they're doing to post a completely wrong answer. Then you should post an extremely detailed comment on that answer, explaining everything they have done wrong, with bold text and disclaimers for people who later come across that answer and take it at face value instead of taking a second to think for themselves.

That way, when the asker, answerer and everyone else ignores your comment and does the wrong thing anyway because they don't give a s**t about doing it the right way, at least your conscience will be clear.

I mean, it's not like you could instead spend your time writing a correct answer instead.

1
  • 2
    I didn't vote, but sarcasm doesn't really work well with text.
    – CodeCaster
    Mar 16, 2016 at 11:43

Not the answer you're looking for? Browse other questions tagged .