10

Today I asked a question about potential security vulnerabilities associated with different ways of implementing a piece of software. I received a vote to close the question on the grounds that it is "primarily opinion-based" (as well as a downvote around the same time).

For context, I rarely post on Stack Overflow, so I'm not familiar with the conventions here. However I'm a regular contributor on the Mathematics Stack Exchange, where questions such as "Can my proof be simplified?" or "What are some important applications of Theorem X?" are rarely viewed as being "opinion-based", and are often well received. On the Mathematics Stack Exchange, an "opinion-based" question would be something like "Is algebra more difficult than geometry?". So, based on this prior experience, I wouldn't have expected that a question about potential security vulnerabilities associated with different implementations of software would be viewed as opinion-based on Stack Overflow. I could well have made a mistake, but it wasn't done intentionally.

What I'd like to know is:

  1. Is there any way my question could be made less opinion-based so as to receive an answer (and contribute in a positive way to the site)?
  2. Or, if my question is irredeemable, then is there some other place where I can get my question answered - perhaps some other Stack Exchange site that uses different criteria for assessing whether a question is opinion-based?
  3. In future, should I refrain from asking about the security implications of software design choices on this site?

By the way, I've done some digging on meta...

  • This meta post says that one should avoid asking about "best practices" on Stack Overflow. This is useful to know - though I'm not sure this advice is applicable to me because I'm asking about concrete security vulnerabilities that could result from a given design choice as opposed to best practices.
  • This meta post suggests the Software Engineering Stack Exchange as a place to ask questions about dev process - though again, I'm not sure how relevant this is to me because my question isn't exactly about dev process. I could also try the Information Security Stack Exchange - but that doesn't feel right either since that that site is for information security professionals, whereas I'm a developer.
  • This meta post distinguishes between opinion and expertise. It suggests that questions seeking expertise are acceptable here. But then, this meta post suggests that any question that would answered with the words "I favour" or "I would probably" are opinion-based. I'm struggling to reconcile these views.
9
  • 10
    You have a design / whiteboard question. Those are not a good fit for SO. Some design questions might be on-topic on Software Engineering.SE. Looking at the specific question maybe Information Security.SE is worth considering.
    – rene
    Commented Apr 22, 2023 at 20:07
  • @rene Thanks! I'll try Information Security SE.
    – Kenny Wong
    Commented Apr 22, 2023 at 20:08
  • 4
    Be sure to read their help center, and peruse their meta site before asking there. You could also ask on Meta Stack Exchange using the [site-recommendation] tag, which I've added to this question as well. Commented Apr 22, 2023 at 20:52
  • 1
    When the circumstances and/or criteria in a question are vague or general enough that sound technical justification cannot be given some may consider that an answer would be an impressionistic guessy hip-shot "opinion" where others might vote to close for lack of focus or detail.
    – philipxy
    Commented Apr 22, 2023 at 22:47
  • How was your (now self-deleted) (re?)post at Information Security received? (Didn't it get an answer?) PS Please do not post a question to multiple sites. (But if you move a question to another site: ) Please don't delete a post while under active discussion at its meta.
    – philipxy
    Commented Apr 24, 2023 at 10:33
  • @philipxy Sadly no answer, no comments, very few views. In any case, the answer I got here on SO was enough to point me in the right direction. By the way, how do you move a question to another site?
    – Kenny Wong
    Commented Apr 24, 2023 at 10:35
  • Delete & repost if permitted & there's no reasonable answer & not otherwise subverting site protocols. One can migrate-flag or mod-flag for "migration", see the help center & Q&A at meta.so & Meta Stack Exchange. But: Make sure a post is good & on-topic at the desired target site.
    – philipxy
    Commented Apr 24, 2023 at 10:41
  • @philipxy Ah so moderators can help out. Thanks!
    – Kenny Wong
    Commented Apr 24, 2023 at 10:42
  • "This meta post distinguishes between opinion and expertise. It suggests that questions seeking expertise are acceptable here." - I have to wag the finger there - you are taking that out of context. The meta post is about the phrasing of the close reason. It is implied that whatever you ask, you are asking for expertise. It is in the same boat as asking for answers that work - no need to ask, the site rules enforce it. The site demands answers that are factual, understandable and complete, if that is not the product of expertise I don't know what is.
    – Gimby
    Commented Apr 25, 2023 at 8:40

2 Answers 2

11

I probably wouldn't have voted on this question myself, but I can see some reasons why others might have voted to close it as opinion-based.

Generally, well-received questions on Stack Overflow either ask for a definitive answer, or an explanation of something. Your question asks for an expert judgement, and your question already contains both your own judgements in favour of each option, and links to two authorities which say different things. This doesn't seem like something that can be resolved definitively by one answer, though perhaps I am wrong about that.

There is also the matter of which expertise would be required to answer your question. Stack Overflow users have a pretty broad range of expertise in programming, but protocol security is quite a specialised topic, and I don't think we have that many users with the required expertise ─ particularly because there is a separate Information Security SE site where those experts are more likely to spend their time. So at least on Stack Overflow, it may be more likely that a question like this gets opinionated non-expert answers.

-2

People who don't want to answer or don't know the answer or don't like the subject of a question just pick any close reason they want, because they won't be held accountable anyway.

There's nothing wrong with your question as it currently stands. It is about which of two standard OAuth flows to implement, whether the advertised security added by the more complex one is realistic and relevant, and whether either is "good enough".

Those are all answerable with facts and on-topic because they are about programming (securing web applications has everything to do with programming).

Don't let anyone who wants to create a make-believe subset of Stack Overflow as they want to see the site make you believe otherwise, no matter how harsh (bordering on rude/offensive) they make their comments sound.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .