What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 134 Stack Exchange communities.

Similar to Questions with nefarious intent?, but different, and more about voting than “Is it possible?”, versus “Is it a good idea to try?”.

If someone posts an answer to a perfectly normal question, and their answer is technically valid but raises moral issues/discussion, what should be the correct attitude to take?

EG: customer wont provide ssh access - ftp only

The answer was technically valid but it's been downvoted to oblivion because what he's suggesting is just plain wrong from our point of view as system admins.

I don't want to labour a point (I studied ethics and morality at Uni) but what's wrong to me isn't always wrong to someone else. Maybe the above was a bad case-in-point (I don't think that falls into any grey areas), but:

TL;DR version: Should technically valid answers be downvoted just because we don't agree with the answerers idea of morality?

share|improve this question
1  
Personally, I do not see that as an issue of morality, but rather one of professionalism. I'll downvote it. –  o.k.w Jan 20 '10 at 23:52
    
Like I said, that was a poor example, but it was the question that got me thinking –  Mark Henderson Jan 21 '10 at 0:30
    
Yea, agree. The line is hard to draw indeed. –  o.k.w Jan 21 '10 at 1:26
    

7 Answers 7

up vote 16 down vote accepted

There are a few different situations here.

Not enough information to determine ethics

In the example, we do not have any information regarding the business relationship this person has with the hosting provider. We cannot infer, then that this breaks the TOS, contract, or in any way is unethical. Some might claim that since SSH access isn't provided, then we can assume that shell access of any kind is prohibited, but I know many webhosts that allow you to put any PHP on the system you like, but will never provide SSH due to the constant support issues inexperienced people bring to the host. They would be happy to have such a script on their system.

Therefore this example exists in a possibly gray area, depending on your point of view, but ONLY if you assume quite a bit based on a small amount of information.

So in this situation, where not enough information is provided to determine the ethics, go ahead and post the answer, or upvote the answer that, under some circumstances may be ethically dubious, but cannot be assumed to be bad due to lack of information. A nice disclaimer is good, but not necessary.

Enough information to determine ethics

If you absolutely know that the answer is ethically wrong under any and all circumstances (all nations, countres, states, districts, municipalites, companies, religions, etc) given the question, then yes, downvote it, and PLEASE comment on why.

However, keep in mind that even if the answer is ethically wrong for the given question, future google searches may land on that page (no SSH access) and the answer, though ethically wrong for the question itself, may be ethically ok for someone searching on those terms that falls into this question.

So even when you know it's ethically wrong to implement a given solution under a particular set of circumstances, it is not ethically wrong to teach someone about possible solutions that may actually have benefit, either as teaching examples, or usable under other situations.

So, largely, I'm not in favor of downvoting because your system of ethics and surrounding assumptions prohibits it.

But the downvote is yours to do with as you please.

If you truly find it objectionable under all circumstances, though, flag it for moderator attention so it can be deleted.

share|improve this answer
3  
Wow. I think you've thought about this more than I have! –  Mark Henderson Jan 21 '10 at 2:57
1  
If there is not enough information to determine ethics, it is worth adding a comment that you believe in certain circumstances a particular action would be wrong. –  Casebash Feb 2 '10 at 4:43
    
@Adam, Both meta.stackexchange.com/a/3545/159916 and meta.stackexchange.com/a/23326/159916 seem to disagree with your post. Your answer forks on the point "determine ethics", but how do we determine ethics when it changes with time? Indeed, different countries have different ideas of what's ethical and what's not. –  Pacerier Sep 24 at 14:00
    
@Pacerier As far as I can tell, they are in agreement with my post. Note my conclusion: "I'm not in favor of downvoting because your system of ethics and surrounding assumptions prohibits it." –  Adam Davis Sep 24 at 15:29

I like to think of it this way:

It's my vote, and I'll downvote you if I want to.

So yes, if there's anything I don't like about the answer, I might vote it down, whether it is incorrect or merely displeasing to my personal sense of aesthetics.

After all, that's the very nature of the sites: I've accumulated a certain amount of reputation by demonstrating responsibility, and in so doing have been conferred the ability to downvote. The site is trusting me to make these decisions, so I shall do so.

More waxing poetical: I don't actually do this very often; more usually I will just leave a comment "tsk, you shouldn't do it this way!" and leave it at that, because I don't like those little red marks in my rep history. Or, when faced with a series of "correct" answers, I will only upvote the answer that both answered the questions and doesn't do anything evil. My point is that we all have the ability to downvote and we should feel free to use that ability with discretion.

share|improve this answer
3  
-1 for aesthetics. UGLY POSTS NEED LOVE TOO! –  Shogging through the snow Jan 21 '10 at 0:03
1  
"I'll downvote you if I want to." - does this also apply to serial downvoting? –  Andrew Grimm Jan 21 '10 at 12:08
1  
@Andrew: if I legitimately have a beef with a series of posts all in succession, then yes conceivably one might downvote them all at once, but that would be futile as there are heuristics to catch that. If one wished the votes to stick, it would be prudent to distribute them over a number of days. Theoretically, of course. :) –  Ether Jan 21 '10 at 18:20
    
PS. Yes, I deliberately phrased my answer to be provocative and controversial. It's a good debate to have! –  Ether Jan 21 '10 at 18:21
1  
@Æther - your comment is evil, but I can't downvote it! :) –  Andrew Grimm Jan 21 '10 at 22:14

I downvote such answers, unless the poster provides a disclaimer, such as "This is the correct answer to your question, but you shouldn't do it because it's evil." Or, "This works, but it will kill kittens, so don't try this at home," or something to that effect.

Here is an example:

http://stackoverflow.com/questions/1671444/copy-on-delete-of-browser-history

Note that I didn't downvote the question, although I did post a comment expressing how evil I thought the question was. I also didn't downvote the accepted answer, as it contained a "this is evil" statement.

I did post my own answer explaining my ethical position. It got six upvotes, even though it didn't answer the OP's question, so I guess some people agreed with the ethical position.

share|improve this answer
1  
@Robert: agreed: from a strict right vs. wrong perspective, you shouldn't have gotten upvoted if you didn't actually answer the question, but IMHO you did something better: you answered a question that should have been asked. –  Ether Jan 21 '10 at 0:12

I see nothing wrong with the Script, sorry. It's the sysadmins job that the user can only do what they are entitled do. This script does not do any magic, it just does what any other PHP application could do.

If the user uses this to gain access to stuff they shouldn't have access to, it's the admins fault for not having secured that content properly.

If the user uses this to cause too much load, it's the admins fault because there was no limiting in place.

if the user uses this to shoot himself in the foot - it's the users fault, and you can bill him for support - unless legal screwed up and did not put a proper contract in place.

If the user wants support for it, you're free to handle this using the normal support policies.

Always keep in mind: If something is possible, someone else will know about it. If that person is a black hat, you have a problem. So it's the admins duty to know about stuff that's going on. That answer might actually do admins a favor, because now they know about the existence of this script and can make a security audit: Could it cause you any harm? If yes, how can you properly prevent it? Might be a good ServerFault question by the way.

In my opinion, the border is exploiting security vulnerabilities, that is: "The admin has blocked this script, can I circumvent that?" The answer to that is usually a quick close, downvote, delete, so I think we're fine on that front. (Related: We allow Jailbreak Questions about the iPhone on SU)

Edit: I think this came across a bit harsh, because it was specifically targeted at PHP Shell. PHP Shell is completely harmless in my opinion. It does not give any additional access and does not break the system. If you upload a file that contains the desired System() call, it would work equally well. Unlike stuff like Jailbreaking, PHP Shell is not hacking the system. So in my opinion the correct solution is not to disallow such questions, but rather add a comment or something to let admins know that they can just disable stuff like that in the PHP.ini. Disallow calls to system(), exec() and some other functions and the script stops working - In my opinion, this is the real solution for the problem, rather than trying to pretend it doesn't exist.

share|improve this answer
2  
Doesn't "If the user uses this to gain access to stuff they shouldn't have access to, it's the admins fault for not having secured that content properly." seem awfully naive to you? –  Ether Jan 21 '10 at 3:34
    
Naive? Maybe, but I'd call it realistic. See the second-to-last paragraph: Someone will do it, so we can as well raise awareness for the possible issue. –  Michael Stum Jan 21 '10 at 4:34
    
With regards to the last sentence: do some people have a different attitude towards breaking other people's systems than having their own systems broken? –  Andrew Grimm Jan 21 '10 at 12:06
    
No idea, i found that weird to that we allow Jailbreaking questions, because that is really breaking the system. As for PHP Shell, this doesn't break anything. Everything you can do with that is possible anyway by uploading a PHP Script that contains the desired system() call. So they don't gain any additional access. I clarified my answer. –  Michael Stum Jan 21 '10 at 18:00
    
Jailbreaking the iPhone is a modification of something the user paid for and owns. Making somebody else's site do something that somebody else doesn't want is entirely different, and is a misuse of their stuff. Nor is "the admin should have made absolutely sure nobody could do that if they didn't want that happening" an excuse for doing something. Heck, my house is not well secured against a competent burglar, since somebody skilled with lockpicking could easily get in. Should a lockpicker feel justified in unlocking my door and using my stuff? –  David Thornley Jan 21 '10 at 18:16
    
@David, some people (lawyers) would say "yes". And those people (lawyers) suck (I hope my friend who's a very competant lawyer doesn't read this. She earns 10x that amount I do and works hard for it and she's a really really nice person. Not that I've ever seen her in court). –  Mark Henderson Jan 21 '10 at 21:19
    
@David: Your house example doesn't work though, because you have not invited the burglar. A better example would be having a flatmate using the shared bathroom and looking at the private stuff you have in the cupboard. The user is already on the server, and the user is already given explicit permission to execute the script in question. I'm specifically addressing the PHP Shell example, and this is not circumventing anything. It's not a Hack and also not a "Hack". The user got permission to do what it does. –  Michael Stum Jan 21 '10 at 21:21
    
An example that I would object is if the user asks how to use PHP Shell on a system that blocked the system/exec calls, as this would qualify as circumventing the system and would more qualify with your House example, so I'd see this as a hack/blackhat and I do agree that those are bad. But I really believe there is more to gain by showing admins ways to prevent the usage of "bad stuff" rather than pretending the bad stuff doesn't exist. –  Michael Stum Jan 21 '10 at 21:23
1  
@Michael: Okay, suppose I keep my bedroom door closed. Should my flatmate feel free to search my room and leave my stuff flung around, just because I didn't lock it? Lots of small site owners don't know much about security, and don't nail down everything. While telling them is a good idea, doing stuff they've suggested they don't want without prior authorization is not. –  David Thornley Jan 21 '10 at 22:02

I hesitate downvoting "technically valid" answers for the question regardless of morality, lack of warnings about blowing up your system unless the "warning" is a core part of the issue. For example, I would downvote a blatant SQL injection flaw in a question about security. If you don't like an answer, simply don't upvote it, and upvote other answers if they better suit your taste. Downvoting "correct" answers doesn't look fair to me. It's not ethical!

share|improve this answer

Absolutely! In fact, I relish the opportunity to down-vote answers that suggest things that, while perhaps technically feasible, introduce behaviors that I don't ever want to encounter (as a user or as a developer).

You get one vote, so vote according to your conscience. If you're alone, it won't matter; if you vote with the moral majority then you've helped the community indicate to future readers that this option is unlikely to be acceptable.

share|improve this answer
2  
so, you downvote if you disagree? I feel that's completely wrong: only downvote if it's actually WRONG. Otherwise, leave it alone. –  warren Jan 21 '10 at 0:05
1  
@warren: but "wrong" is a somewhat subjective thing, especially when arguing with a n00b about how things could be done vs. how things should be done. –  Ether Jan 21 '10 at 0:11
1  
@Warren, the criteria for downvoting is: "This answer is not useful." It even has a tooltip over the downvote arrow that says this. –  Robert Harvey Jan 21 '10 at 0:12
2  
@Æther - "wrong" is not necessarily subjective: if the answer provided does not do what the asker wants, it's wrong. If it does, but its ethicity is questionable, the answer, per se, is NOT "wrong" - it's an answer. Its application or use may be wrong, but the answer is not. –  warren Jan 21 '10 at 0:23
3  
@warren: but there are more reasons to downvote than simply being "wrong". We are essentially being asked to be teachers on SO: when teach an apprentice how to fight, a good master not only teaches how to use his fists, but also when not to be violent, and when to walk away. There is more to a craft than the mere use of tools. –  Ether Jan 21 '10 at 0:38
3  
@warren: I don't want web pages to disable my back button. Ever. Under any circumstances. So any answer giving instructions for this is WRONG. But there are untold numbers of programmers out there at this moment searching for ways to disable the back button on whatever browser is unfortunate enough to browse to their sites. They aren't all bad people; some of them probably have children that they love dearly, and who they would never subject to this kind of cruelty... But they'll do it to their users, possibly include me, if they aren't quickly educated. And so I vote... –  Shogging through the snow Jan 21 '10 at 0:51
    
@Shog9 - that's a preference - and you can leave a comment indicating that you do NOT want that to be done, and that if it is, you will not be back to their site. However, since it is their site, they can do whatever they want to, no? If you don't like it, then don't go back. It's not a reason to tell them it's "wrong" by downvoting. –  warren Jan 21 '10 at 15:41
    
@warren: they can do whatever they want regardless of anything I do or say. But I'm still going to do my best to discourage them; I'm not going to pull punches because someone else might feel differently - "someone else" can vote too if they feel strongly. (and as for the "don't go back" - you'd probably be amazed at how often crap like this shows up on sites I must go back to: insurance forms, intranet apps, etc.) –  Shogging through the snow Jan 21 '10 at 16:00
2  
@Shog9 - "do my best to discourage" should not include downvoting, in my opinion. Punishing a technically-correct, though ethically-dubious, answer by downvoting seems to be forcing your ethical standard on others, whereas commenting on it hiliting the dangers allows both the answerer and the asker to weigh the pros and cons of the suggestion –  warren Jan 22 '10 at 1:35
    
@warren: and that's your prerogative, to cast your votes as you see fit. By all means, continue! But as for forcing ethical standards onto others... I think you overestimate the power of a down-vote. –  Shogging through the snow Jan 22 '10 at 1:53
2  
@Shog9 - feel free to force your ethical standards onto others, but by admitting you do, does it not taint the site? I'll happily comment as to the ethicity of a given answer, but I will not force my views on someone via said downvote. What happens when they don't know/consider the ethical implications? You've just said that YOUR ethical standards are the only ones to consider, and are RIGHT by definition of them being yours: that's a pretty impressive claim to have made. How can you claim any personal ethical standards are the bar of perfection you have just claimed? –  warren Jan 22 '10 at 2:01
1  
@Shog9 about the back button, have you consider that within an order page it may not be wise to have the back button enabled? If it is someone will click on it... then you have to deal with support on why a user has been billed twice etc –  monksy Jan 22 '10 at 2:06
    
@warren: again, if you think voting equates to forcing your views onto others, you are - at best - somewhat naive... Do you refrain from down-voting yourself? Or do you merely consider your own opinions to be firmly grounded in irrefutable fact as opposed to the wooly preferences of others? As for the rest of that screed... If you intend to put words in my mouth instead of conversing honestly, then this discussion is at an end. –  Shogging through the snow Jan 22 '10 at 14:20
    
@steven: actually, there are ways to avoid that without breaking the user's browser. However, that's a topic for SO (search for "redirect after post"). –  Shogging through the snow Jan 22 '10 at 14:28
1  
@Shog9 - as I stated earlier, I downvote only if the answer is distinctly wrong: it does not do what the asker wanted, is off-topic, etc. Obviously you prefer to also downvote if it just doesn't suit your fancy, or ethical views. That's also your prerogative. –  warren Jan 22 '10 at 22:38

I downvoted that particular question but I don't make a habit of doing so to every question that I believe is so wrong it should never have been posted.

With such questions I don't try to impose my personal morality, although it may certainly appear so at times. I look at the question and ask myself, as a professional system administrator, "how would I react if someone did that on my network?".

No it's not a question of morality or ethics, which are at best extremely fluid concepts, it really is a question of professionalism. System administrators who help, and at times even encourage, others to circumvent systems put in place by our fellow system administrators do not deserve a job but do deserve to have the same thing done to them.

Farseeker's reply to my comment was quite frankly way over the top, as it completely ignored context. Context is everything. The question may well be considered perfectly acceptable and receive effective answers elsewhere but it should not have been asked on a site intended for professional system administrators. Even more importantly, it should not have received that first answer.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .