64

This Stack Overflow question (now deleted) clearly states that the author intends to perform a DoS attack on a web site.

I think it is at least unethical, and possibly illegal (accessory before the fact) to assist in this. How do we handle questions that are potentially or blatantly illegal or malicious? seems to indicate that such questions should be deleted. I have flagged it for moderator intervention.

I want to be sure that this question is off-topic here. Does Stack Overflow condone such questions?

9
  • 1
    @MartinSmith, yes, that is the question I have linked in my question. I'm only asking because nobody seems to be doing anything about the target question. So, my question is if Stack Overflow condones the sort of question in the target question. Is it somehow different than what is covered by the linked [meta] question?
    – Ron Maupin
    Commented Jul 24, 2016 at 18:27
  • Question is closed and almost deleted now.
    – Pekka
    Commented Jul 24, 2016 at 18:33
  • 2
    First call to action is to get such questions closed, best would be with a duplicate so it only requires a dupe-hammer. If you need close voters drop a link in SOCVR. They have normally enough members around to close questions that have no future value. After it is closed the delete voters can do their job. (post is deleted, 19 minutes after you brought it up)
    – rene
    Commented Jul 24, 2016 at 18:33
  • 3
    The post was closed as "Too broad"... ;-)
    – peterh
    Commented Jul 24, 2016 at 18:42
  • 8
    I saw that, did something about it, couldn't believe I had to be the first SO user to DV that question. Sad, isn't it. Commented Jul 24, 2016 at 22:44
  • 1
    It seems appropriate to me that you flagged the question for moderator attention. I would then feel the need to do no more. This sort of thing actually happens all the time in forum sites. Commented Jul 25, 2016 at 2:01
  • 2
    @MikeRobinson, since I didn't see any movement, I was asking to see if I misunderstood.
    – Ron Maupin
    Commented Jul 25, 2016 at 2:03
  • Nice, just the link I was looking for i.e. about how questions related to circumventing trial periods are handled, regarding this question Commented Jul 25, 2016 at 2:22
  • @HansPassant even sadder: the question got 2 answers. Commented Jul 26, 2016 at 8:53

2 Answers 2

101

As the Meta answer you linked says, this question is not really problematical because it's about a DOS attack. Learning how to attack can be part of learning how to defend: in other words, writing such a program is a legitimate activity in learning about network security.

That's actually the problem, though: network security is not on topic for Stack Overflow. This isn't a programming question.

It's also too vague and broad, as far as I can see. I wouldn't want to migrate it to a site where it would be on topic, because it's frankly not very good.

It should be closed as it stands, and removed from Stack Overflow for being off topic.

7
  • 33
    Network security is on topic on SO, but only in a limited scope. There are ways in code to harden against DoS attacks. But I agree, in the broad scope, it's usually off-topic. And for everything else you've written I also agree with.
    – bwoebi
    Commented Jul 25, 2016 at 2:53
  • 10
    Too broad, so I guess a good candidate for documentation beta? :)
    – rogerdpack
    Commented Jul 25, 2016 at 17:05
  • 3
    @bwoebi the operative word (?) here is "in code". If there's no code involved, then obviously.
    – Braiam
    Commented Jul 25, 2016 at 17:39
  • 3
    This logic seems really disingenuous. It's a malicious post about attacking a server, you shoehorn it into the topic of defending a server, then close it as off topic since it's about defending a server?
    – djechlin
    Commented Jul 26, 2016 at 1:20
  • 12
    Q&A don't kill servers. People do!
    – Gordon
    Commented Jul 26, 2016 at 5:42
  • 2
    Migrate it to Security.SE then? Commented Jul 26, 2016 at 5:54
  • 1
    Don't migrate crap. Someone would need to fix it up to Security SE's standards before flagging it for migration. Commented Jul 27, 2016 at 1:09
36

Let's assume the question as written was programming related:

"How to spawn mulitple UDP requests in C#"

And the body was "I'm writing an app to do a DOS attack on a website. Here is my code, the app crashes when I spawn 2 threads..."

Should there be a "Do no evil" rule, that prohibits these questions on Stack Overflow?

Well for one, the person has to be incredibly stupid to admit to wanting to build a DOS app and to then actually go use it to commit DOS attacks. Ignoring the ability to track people on the web, that person has increased the risks of getting caught for very little gain.

Assuming they were that stupid, the likelihood of them assembling the rest of the knowledge required to carry out that attack would be beyond their abilities.

It's more likely, the person is curious about DOS attacks, and wants to learn about them by writing their own app.

If a malicious person wanted to write a DOS app, but got stuck, and did not want to trigger this hypothetical "Do no evil" rule, it would be trivial to omit the parts of their question where they are admitting to do harm, and phrase the question in a manner that was acceptable to our current (and proposed) guidelines.

Said more plainly: At best, such a rule would really prevent only the very stupid from achieving their goal. Everyone else would easily mask their question.

I think a simple comment asking "Why do you want to build a DOS app?" would suffice.

8
  • 2
    What a reasonable answer Commented Jul 26, 2016 at 5:04
  • I agree. But could you explain what exactly you mean with the stupidity thing? If they'd be attacking from the same iPhone they wrote this question from, I could see your point, but aren't there plenty of other ways to cover your tracks? I don't want to go too far OT, just a quick line or two, thanks.
    – Sir Jane
    Commented Jul 26, 2016 at 8:43
  • 1
    You are right. There is one additional problem though. If it could get stackoverflow in legal troubles answering such questions, it might be smart to disallow them regardless of the harm preventing effects.
    – morten
    Commented Jul 26, 2016 at 8:56
  • @sirjane My comment is less about the difficulty in tracking someone online, and more to do with unnecessarily increasing the risk of being caught simply because you admitted to wanting to commit a crime. You've increased your risk, but gained nothing for that risk. As an aside, if a person is smart enough to successfully cover their tracks, it would stand to reason they would be smart enough to figure out how to issue lots of web requests, or at the very least figure it out without having to tip their hand.
    – Alan
    Commented Jul 26, 2016 at 20:20
  • 1
    @morten Probably not. Publishing things like The Anarchist's Cookbook while holding little or no social value still isn't illegal. Making or using many of the things in it is. Commented Jul 27, 2016 at 0:33
  • 2
    @Tibrogargan, while publishing or owing a copy of The Anarchist's Cookbook is not illegal, sending a copy of it to someone who told you he wanted to cause damage, and then he uses something from that book to cause damage can certainly get you into legal trouble.
    – Ron Maupin
    Commented Jul 27, 2016 at 14:00
  • @RonMaupin Specific to the US, can you post links to case law that supports your claim? I am not a lawyer myself.
    – Alan
    Commented Jul 27, 2016 at 16:06
  • 3
    @Alan, neither am I a lawyer, but I know someone who provided material support (information) for a crime, and he was convicted as an accessory because the perpetrator of the crime had told him about it before committing the crime. For Texas, see PENAL CODE, Sec. 7.02. CRIMINAL RESPONSIBILITY FOR CONDUCT OF ANOTHER, especially 2 and 3. I imagine most states have similar laws.
    – Ron Maupin
    Commented Jul 27, 2016 at 16:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .