What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

This question got migrated to Server Fault.

In my arrogant opinion, only people with programming ability can find and patch vulnerabilities.

These types of questions: "Please help me my site was hacked!" are not suitable for Server Fault.

Here is a complete and total failure of a thread on serverfault, The only reseblance of a solution is mine. One person who is trying to be helpful has +13, and its not even close to a solution, it's just an explanation.

Here is another post with 13 answers, and not single solution.

This is evidence that the moving posts is only hurting people.

share|improve this question
6  
One question is "an alarming rate"? Out of all questions tagged [security] on SO, there are only about 3% showing up closed - that's actually not terribly high. –  Shog9 Jun 24 '10 at 18:35
    
@Shog9, out of 5080 questions, that's 150ish. I think that 3% seem's pretty high for a close rate (though I think migrating that one was just fine). –  Lance Roberts Jun 24 '10 at 18:38
    
@Lance: well, the average for the site is about half of that... But for a tangential topic, it's about par - [seo] is similar. –  Shog9 Jun 24 '10 at 18:57
    
@Shog9 1 is too many. –  Rook Jun 24 '10 at 19:15
12  
Ok, look here @Rooky - you spammed unrelated questions on SO trying to catch the attention of the folks who'd voted to close this question, and then come here and post this hyperbole-thick rant and now you want... what exactly? Hopefully being taken seriously isn't anywhere in your wishlist... –  Shog9 Jun 24 '10 at 19:22
1  
Rather than ranting and posting comments on unrelated posts, just flag the question (on either site) for moderator attention. If they agree with you then the question can be reopened. –  ChrisF Jun 24 '10 at 19:35
    
I neeed more -1's –  Rook Jun 24 '10 at 19:35
    
Those rate measurements don't mean much until someone looks at the questions. All it might tell you is that plenty of superuser and serverfault security questions are typed into stackoverflow. So we'd need to know how many are 'closed' versus 'migrated', to start with. –  Rosinante Jun 24 '10 at 19:36
    
An explanation can still be useful and all an up-vote means is that the "answer is useful" (this shouldn't be taken as defence of the answer being referred to, just a general point). –  ChrisF Jun 24 '10 at 20:01
    
@ChrisF well i hope all of toughs up votes some how magically fix your hacked site. People are getting hurt. –  Rook Jun 24 '10 at 20:12
1  
Stop editing my post, if you don't agree give me a -1. Tell people to give me a -1, Create accounts just to give me a -1. But for the love of god stop modifying this post. –  Rook Jun 24 '10 at 20:23

4 Answers 4

up vote 6 down vote accepted

The question you linked legitimately belongs on ServerFault. If the question had been phrased as "I wrote a site that was hijacked. How can I write my software to prevent this?", it would be better off on StackOverflow.

Most of the folks on ServerFault are sysadmins by trade rather than programmers, which means they (usually) have a fair amount of programming experience and quite a bit of security experience. Granted, their programming experience is primarily perl and bash (python if you're lucky), but that's not a bad foundation. Don't discount them just because they're not programmers by trade.

share|improve this answer
2  
+1 I would definitely vote to reopen if it was phrased as a programming question. –  Jon Seigel Jun 24 '10 at 18:36
2  
@Randolpho have you ever had to clean up a defaced site? –  Rook Jun 24 '10 at 19:17
1  
@The Rook: You have a point, but the problem is the phrasing of the question, not the subject matter. The question was clearly phrased in a way that implied it belonged on ServerFault. Security questions are not, in and of themselves, disallowed from StackOverflow, as long as they're about programming. –  Randolpho Jun 24 '10 at 19:38
    
@Randolpho i have posted evidence that shows that these types of questions are not being answered on sf. –  Rook Jun 24 '10 at 20:17
    
Thank god you are not a lawyer @the –  jmfsg Jun 24 '10 at 20:25
    
Hijacking a site may or may not be a highly involved task. Sure, it takes a kernel programmer to write a root-gaining memory exploit, but any script kiddie can run a tool that automatically scans a site for PHP vulnerabilities, uploads a remote shell, and installs that exploit. Securing a server usually doesn't require finding the kernel exploit, but the dodgy PHP which allowed it in the first place, and updating to a newer kernel via the distro's package manager. Some sysadmins come from programming backgrounds, too - don't assume that they're all clueless morons. –  Andrew Jun 24 '10 at 23:44
    
The Rook -- have you ever had to clean up a defaced site? -- Restore from backup? -- codinghorror.com/blog/2009/12/… –  alexanderpas Jun 25 '10 at 0:02

In my arrogant opinion, only people with programming ability can find and patch vulnerabilities.

I think you are vastly underestimating the abilities of a typical system admin. Any general system admin almost certainly has a at least a passing understanding of how HTML/Javascript works and can write basic programs in some programming language or another.

People who have specialized in security generally live more on the IT side then the dev site, but obviously any security professional will have some programming ability. If you take a look at the subjects a person who is CISSP certified have to understand you will the majority of the topics tend to live on the IT end of the spectrum instead of the developer end.

These types of questions: "Please help me my site was hacked!" are not suitable for Server Fault.

I think if you take a second to look at those questions the vast majority are very poorly asked and lack detail. Given the lack of details almost all of them can be answered by the information on these two questions.

This is evidence that the moving posts is only hurting people.

Personally I think the evidence is that almost anyone asking this type of question hasn't properly been making backups and doesn't know how to ask a question with enough details that a useful answer can be provided. In many of the questions the poster would not have gotten a better answer on SO, or anywhere else until the improve their question.

The other reason to migrate it to SF is that the user might take a second to read some of the other questions about how to setup backups and setup the OS security to minimize the amount of damage that is possible when running buggy software.

Here is a complete and total failure of a thread on serverfault, The only reseblance of a solution is mine. One person who is trying to be helpful has +13, and its not even close to a solution, it's just an explanation.

What exactly do you think the answer should be to this question? The poster has provided one symptom of the problem and no other details about their system, software, enviroment or anything else. The poster appears to have never came back to the site to update the question with additional details, and a large number of the 'answers' where requesting additional details. I am sorry, but nobody either on SF or SO can read the posters mind.

share|improve this answer

That question has nothing to do with programming as written. Someone has managed to convince various search engines to index the poor OP's domain name pointing to their malware. How is this even remotely a programming question?

share|improve this answer
    
So? That has nothing whatever to do with the criteria for a valid so question. And there's not even any evidence in the question that any site was 'hacked' in sense that you imply. –  Rosinante Jun 24 '10 at 20:22
    
so magically having an iframe on the site that infects browsers isn't evidence of a hack? you have got to be joking. –  Rook Jun 24 '10 at 20:29
2  
The question mentions no 'magical iframes'. The question says, 'search in google and get a malicious site.' I don't actually care what is on display at the site itself. Stackoverflow's scope does not include, I think, being an emergency repair service for messed up web sites. –  Rosinante Jun 26 '10 at 0:12

Once a question has been migrated, there's nothing that normal users can do about it. If you feel strongly that a question was incorrectly migrated, flag it for moderator attention and make your case in the space provided.

Badgering the users who voted to migrate the question does no one any good - they can't revert the action if they wanted to.

share|improve this answer
    
Well i'm trying to get these people to stop migrating them in the first place, because clearly they don't know what they are doing. Just look at the horrible answers they get on SF. –  Rook Jun 24 '10 at 19:38
7  
So, open up shop on SF and start providing them good answers there. –  Rosinante Jun 24 '10 at 19:40
5  
@The: if you want to convince people that there is a problem, you need to show evidence of it. One data-point is not a trend, and one borderline question isn't likely to inspire any great sense of injustice. FWIW: your answer on SF seems as suitable for that site as for SO - the question wasn't asking anything specific about the code on his site (we don't even know if he wrote it...) and your answer reflects this. –  Shog9 Jun 24 '10 at 19:40
    
@Rosinante i did, and i don't like SF at all. –  Rook Jun 24 '10 at 19:55
3  
is it the colors @the? –  jmfsg Jun 24 '10 at 19:56
    
@Shog9 good point, i have updated my post. –  Rook Jun 24 '10 at 19:59
2  
@The disfunction on sf does not justify off-topic questions on so. –  Rosinante Jun 24 '10 at 20:23
    
@Rosinante how is a sys admin supposed to find and patch vulnerabilities that worms use to spread? This is a task for a programmer. –  Rook Jun 24 '10 at 20:31
    
@The How is that anything to do with stackoverflow? An unqualified sysadmin is no more likely to succeed in fixing something with advice from so.com than somewhere else. You don't seriously expect to see an so answer containing detailed instructions, followable by an unqualified sysadmin, for repairing a particular site? –  Rosinante Jun 26 '10 at 0:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .