What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 128 Stack Exchange communities.

There seems to be multiple proposals on Area51 about computer related security:

Maybe they aren't exact duplicates, but for many questions I think there is hard to know which one to ask the question on. I think they would be stronger together merged as one site.

E.g. if I wonder about "ARP poisoning" that could be placed on "Application Security" in the form of "How can I protect my application against ARP poisoning" or on "Computer Security" in the form of "How can I protect my system against ARP poisoning" or on "Network Security" in the form of "How can I protect my network against ARP poisoning". Okey, it's maybe a bad example, but it is hard to distinguish between the sites.

What is the difference between them? And should it be better if they was merged to one site?

share|improve this question
    
after merging, do you think the scopen and the name of 'application security' should be reconsidered and changed a bit? is it even possible now that it's in the commitment phase? –  pootzko Nov 9 '10 at 22:54
    
@pootzko: Yes, I think "Computer Security" is a better name. But I'm not the one that decides that. Good that they finally were merged before the beta phase. –  Jonas Nov 9 '10 at 23:52
    
well, I don't know who does decide that? who should we turn to? –  pootzko Nov 10 '10 at 8:16

4 Answers 4

up vote 3 down vote accepted
+50

It seems to me that Computer Security is about securing your personal system, while Network Security is focused more on routers, servers, etc. Application security is a whole different barrel of monkeys, nothing to do with protecting the system or the network. Just the software they run. However, I don't think it would hurt anything to merge them.

share|improve this answer
4  
You mean that Application Security is for Developers, Computer Security is for Users and Network & Security is for Sysadmins? –  Jonas Oct 21 '10 at 17:04
1  
However, if I want to ask a question about "ARP poisoning" then I would likte to know how I as a developer can design against it, and also how I as a sysadmin can protect against it, and how it affects me as a user, so security is merely an orthogonal aspect of computer systems. –  Jonas Oct 21 '10 at 17:08
1  
@Jonas: I couldn't have said it better myself. You seem to understand the difference... Your question about "ARP Poisoning" is 3 different questions, asked from 3 different perspectives, with 3 different sets of tools, privileges and abilities. Simply the end goal is the same. –  John Oct 24 '10 at 0:19
    
If it's Application->Developers, Computer->Users, and Network->Sysadmins, then the proposals need to be closed as duplicates of SO, SU, and SF. –  Gnome Oct 25 '10 at 10:57
    
@Roger: I definitely agree with that. This is the reason why I bring up this discussion. I would prefer to have a single stackexhange site for Computer Security or they are duplicates of SO, SU and SF. –  Jonas Oct 25 '10 at 11:09
    
I agree, up to the point of merging them. Definitly different monkeys. –  AviD Nov 12 '10 at 12:02

To me, security is a meta-topic that shouldn't have it's own site at all. Computer security can stay with SuperUser/ServerFault as appropriate, Application Security can stay at StackOverflow, and Network Security can go on ServerFault or a dedicated Networking site if people really think one is necessary. Those are the places that have the relevant experts.

share|improve this answer
1  
I disagree, Stack Overflow doesn't have the best target audience to answer security question. Programmer in general aren't necessarily good with security. I see answer on Stack Overflow with highly insecure code, I fail to see how can Stack Overflow be the best place to ask question about security when there are answer with insecure code hanging around. –  HoLyVieR Oct 26 '10 at 14:26
    
There are tons of beginner questions, so of course there is insecure code. That doesn't affect the community's ability to answer questions where security is the main concern. Unless your plan is for the Security site to be a "No Noobs" clubhouse you'd end up with lots of insecure code there too. –  Brad Mace Oct 26 '10 at 14:50
    
I actually think there would be nice to have a community site (Q&A on stackexchange) for Security people like those who go to Black Hat –  Jonas Oct 26 '10 at 21:11
    
I had actually mentioned that on the original proposal, but @Jeff from OWASP convinced me otherwise - especially now that I see all the specialization of sites going around. –  AviD Nov 12 '10 at 12:03

As the creator of Network & Security, I'm against this. "Proposed Q&A site for network administrator: hardware, configuration, monitoring, and technologies." The main purpose is network not security, unlike others site it's not "Network Security" but Network & Security just because Security is a big part of networking (firewall, IDS, etc.)
May be it's a bit unclear and may be I should rename it to 'Network'

share|improve this answer
    
Thanks for the clarification. After reading this, I agree with you, there would be nice to have a site about networking. But I think it would be good to change title to something like "Computer Networking". –  Jonas Nov 9 '10 at 7:42
2  
the networking part would be a total duplicate of Server Fault though. So I think it is best to overall close this as a dupe of Security. –  Jeff Atwood Nov 9 '10 at 22:33

I agree they should be merged.. And also I think people make too much problems about all this categorizing. If you ask the question in right way it does not matter if it's app/comp/netw security, it's all still security, and you'll get your answer right..? Even more probable you'll get a good answer because there are more security experts in one single place instead having them scattered in 3 places. So why have 3 different pages? No reason. =) When I started Computer Security on area51, my idea actually was to have one page covering all these three areas.. I'm not sure though if that was clear from the description and all the proposed questions there..

share|improve this answer
    
+1 I agree..... –  Jonas Nov 9 '10 at 7:37
    
Strongly disagree, that's like saying if you have a headache, get a neurosurgeon, a GP, and a psychiatrist together - they're all experts in their fields, you'll get better answers, right? As a different post here mentioned, these are completely different monkeys, often even different barrels. The terms, environment, context, risk, and solutions are often VERY different. As an AppSec guy, I often have more common language with programmers than with firewall admins, for example. –  AviD Nov 12 '10 at 12:06
    
@avid "defense in depth", baby! –  Jeff Atwood Nov 19 '10 at 9:17
    
@Jeff - even that means different things to different subcategories. But, what did you mean by it here? –  AviD Nov 19 '10 at 9:44
    
@AviD - yes I understand what you mean, but it's not like appsec ppl don't know anything about network security and vice versa... why exclude each other.. why do you have such a strong need to separate these groups? I mean, if there is someone who wants to ask something about appsec - great, he will ask, and he will get an answer, if someone wants something else... great again.. =) –  pootzko Nov 19 '10 at 10:03
    
@pootzko, Actually many appsec guys DONT know squat about networks, and network guys know jack about appsec - and neither even understand Risk Management. However, they THINK they do, since its security and just applications, so how hard can it be? Hence wrong answers are unknowingly given, and I can show you several cases in point on the site already. –  AviD Nov 19 '10 at 10:10
    
That said, since this seems to be the path we're going on anyway, I think we could probably solve most of these issues with tags - I've tried tagging most network q's and such, though the Appsec ones are not explicitly tagged. Time to start... However, there will inevitably be many cases where it is not clear app/network/OS/risk/etc, and the answers will be confused accordingly. –  AviD Nov 19 '10 at 10:11
    
yes, tags + there is always minus points for an answer if someone gives a bad answer.. so if someone sees it and knows it's bad, he should react. my point of view of course –  pootzko Nov 19 '10 at 11:42
    
But @pootzko, MOST network guys have a mistaken view of appsec, as an example. So they would ALL upvote, not downvote, since they're voting according to THEIR point of view. Imagine on SF asking an OS-centric question, without mentioning which OS. Will any of the answers, or votes, make any sense? (unless the OS is explicitly mentioned, of course). –  AviD Nov 22 '10 at 9:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .