23

My question was closed citing "we don't allow questions seeking recommendations":

We don’t allow questions seeking recommendations for books, tools, software libraries, and more. Edit the question so it can be answered with facts and citations.

I'm specifically needing to know if Microsoft has provided a patch for .NET for a very serious zlib vulnerability. This is not seeking a recommendation. It is a factual question which can be answered factually. This information would be of critical interest to any .NET developer.

In summary, I disagree that my question is seeking recommendations, or that it cannot be answered with facts. What can I do about this?

My original question here:

Zlib version used in .NET Framework and .NET Core (in relation to CVE-2018-25032)

14
  • 19
    This is not a programming question, I don't know why people selected the recommendation reason (probably because you are asking for an external resource). For questions asking about security, I would recommend not asking on Stack Overflow. We go fast and loose about security on the daily.
    – Braiam
    Commented Apr 6, 2022 at 10:13
  • 4
    This should have been closed for being better suited to Super User, not for "seeking recommendations".
    – codewario
    Commented Apr 6, 2022 at 15:03
  • 21
    @BendertheGreatest It's not an issue for a computer user, but an issue for a computer programmer. Super user would not be appropriate.
    – TylerH
    Commented Apr 6, 2022 at 15:28
  • 2
    @TylerH it's not an issue a programmer could fix, since the libraries used internally by the .net framework is impossible to control by the programmer.
    – Braiam
    Commented Apr 6, 2022 at 16:53
  • 3
    It's a question about identifying a patch for an existing CVE. 100% this is a "general computing and software" question. Maybe it would be a better fit for Server Fault because it's "professional" but I believe that site is more for networking and infrastructure. But it does not fit here.
    – codewario
    Commented Apr 6, 2022 at 16:54
  • 18
    This is asked in the context of software development. It is not general computing or network administration.
    – Cody Gray Mod
    Commented Apr 6, 2022 at 17:48
  • 14
    @BendertheGreatest As someone who writes C# and .NET applications (read: programming), I (read: a programmer) need to know if there are active rank-10 CVEs in the libraries or namespaces I use, so that I can work to mitigate them in my code if they are not mitigated yet by the library author(s). I have no idea how one can argue that such a question is not on-topic on a programming website.
    – TylerH
    Commented Apr 6, 2022 at 19:55
  • 3
    I agree that it's useful for programmers to know but this is an operational problem, not a programming one. It would be one thing if someone had trouble applying such an update via a script, but the linked question is asking whether a given runtime is vulnerable. There are other communities (on and off the SE network) that are better suited for these types of questions. FWIW I am also a .NET developer amongst other languages.
    – codewario
    Commented Apr 6, 2022 at 20:02
  • 9
    @BendertheGreatest No, it's not an operational problem. It's being asked in the context of writing code. It is a programming question. Otherwise every programming question is an operational problem because the code will eventually be used by someone in operations.
    – TylerH
    Commented Apr 6, 2022 at 20:48
  • 2
    It is not in the context of writing code but I guess agree to disagree
    – codewario
    Commented Apr 6, 2022 at 21:36
  • 10
    The debate here is a good illustration of the vagueness of what the role of "programmer" encompasses. I've never worked anywhere where choosing what libraries to use and determining whether they had vulnerabilities was primarily the responsibility of anyone other than ordinary code-writing devs as part of their ordinary code-writing work... but perhaps @BendertheGreatest has. (When I'd only had experience of tiny startups, I was similarly confused about how anyone could possibly think Apache and Nginx configuration questions didn't belong here.)
    – Mark Amery
    Commented Apr 8, 2022 at 8:47
  • 1
    Related: Should this question have been closed as "seeking recommendations for books, tools, software libraries and more"? (includes some answers about how reviewers are not as careful anymore)
    – MrMythical
    Commented Apr 8, 2022 at 12:15
  • 2
    @MarkAmery that's why the help center in the specific mention "unique to software development". Knowing whenever a software is vulnerable to an issue isn't unique to software development. Heck, there are tools to test web servers, compilers, kernels, etc. all of them that have tangential relationship with "programming".
    – Braiam
    Commented Apr 8, 2022 at 12:20
  • 1
    @Braiam But knowing that information in order to mitigate it at the programming stage is unique to software development.
    – TylerH
    Commented Apr 8, 2022 at 14:33

2 Answers 2

34

I have no idea. This isn't a recommendation question in the way such is defined on Stack Overflow—you aren't asking for anyone to recommend anything. As you mentioned, there's nothing opinion-based about it. I've re-opened it.

That said, there are undoubtedly ways that you can improve your question by adding more details, supporting links, and clarifying that you are searching for a solution to a practical programming problem, rather than simply seeking a link.

Related reading:

0
19

Topic-wise, asking about programming tools, frameworks and libraries is perfectly fine.

In general, you should be able to ask:

  • "How can I know if my source is vulnerable to x."

Don't ask:

  • "Where can I find out-... -"-"
  • "Where can I find documentation about-... -"-"
  • "Where can I download-..."

Better yet, you could ask like this:

  • "Using lib [name] [version], how can I know if my source is vulnerable to x? I heard about x from [source] and I have reason to believe that my code is affected since it uses [feature]. I have checked [sources] but didn't find anything."

Questions phrased as above is not only providing sufficient, specific details, but is also demonstrating the poster's own research effort so far. Such questions are likely to be well-received.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .