How should we treat questions that are, or have seeds of, evil or malicious purposes and actions, such as writing spambots and malware?
Should they be answered like regular "everybody keeps their pants on" questions? Or should there be some other type of response to this bad behaviour lot?
I've seen a few of these, though they are usually couched in the terms that Jonathan mentions in his answer.
The other ones have usually had comments/answers along the lines of "why do you do this?", "this sounds like spamming", etc. and often the asker responds with what seem to be perfectly plausible reasons.
I think that there are five levels of action that you can take:
Basically, what I'm saying is that you have to treat each post on its own merits. The other thing you could do is check out the poster's profile and see what other questions/answers they have posted. If everything else points to them being legitimate, then just answer the post; if not, flag it and explain your concerns to a moderator.
As mentioned, there is a problem with characterizing a question as "evil". I saw a question about "Monitoring Internet Usage in my small office". The asker was downvoted to oblivion, as were the answers (myself included). Over time the votes have been removed/canceled out by upvotes, but this person's technical question was downvoted because of the community being angry about being "spied on".
Later I read a second question by a different person about "monitoring internet traffic through a particular router" and, because this person phrased the question differently, they got HUGE upvotes, even though the question was essentially the same.
We, therefore, have to split questions into two aspects:
Stack Overflow is fundamentally about the first question. It is a technical "question and answer" site. If the hackers get better (and they will) then the security teams will also get better. If the "way to hack" is published on SO, then the security guys will use that to learn "ways to protect". As Bruce Schneier says on his blog all the time, "Secrecy is not security".
If a question bothers you, don't answer it. But if I can, I still will, because it's not my job to go visiting their intentions. And if it is a technically interesting question, I'll upvote it too.
It is going to be tough to know who's evil and who isn't. After all, nobody in their right mind will say
I need to spam 900 email accounts 3 times a day with Viagra ads.
Instead, they'd ask
I've got 500-1000 employees that need to receive product stats three times a day. What's the best way to do this?
If they're slick enough, we'll all take the bait.
Unless it's totally 100% obvious that the code/act described in the question is illegal in the majority of countries, leave politics and legal issues out of Stack Overflow. There might be questions that give corporate folks a legal headache, but if that happens, I assume they will take action directly. That's the exception to the rule. The general rule is:
Assume good faith for all users on the site. Making different topics in our field taboo is something that will not pay off in the long run. A likely scenario could be a question regarding the DeCSS code for breaking encrypted DVD movies. DeCSS is legal in a lot of countries (Norway to name one), but violates the DMCA in the US. Depending on your beliefs and/or location, you should feel free to refrain from answering, but don't downvote or flag the question.
See also: What to do when I suspect a person is asking questions to become a cracker?
I find that most of these questions can be dealt with by essentially a single answer:
Don't do that. Even if you have a legitimate reason, your program would be detected as malware by (antivirus/antispam/antispyware) software and you will lose all your customers.
There isn't any neat dichotomy between technical and ethical issues, because having the appearance of evil becomes a technical issue (AV stopped your installer from uncompressing your file / AV stopped your program from executing / AV deleted your DLL / AV deleted your data file).
In my opinion, spambots should be open source and all necessary knowledge to build them should be public. I wouldn't mind answering a question that would enable some people to spam me the next day because this type of information serves both sides: the good and the bad guys. In the long term, all you are doing is accelerating technological evolution by spreading information.
To explain myself better, I'll exemplify: There are the antivirus makers, and the virus makers. If you post in a public forum how to make a virus, the virus developers will use it to fortify themselves, while the antivirus makers will use it to prevent this. After some time, the net effect is almost zero.
You could probably vote these as spam using the flag function.
I would say use the Google motto of "Do No Evil". If you have moral qualms against answering a question, then don't answer it and comment as so. More than likely questions like this will get closed very quickly anyway.
