Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 158 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

I've seen this many times before, but it came up again today. Someone supposedly concerned with testing their site for vulnerability posts a link and requests to be "hacked".

In the true vein of security and paranoia, we have no proof that OP actually owns the site, and no legitimate agreement with the actual site owner that it's "OK" to attack the site.

This could be seen as a feeble attempt at ruining a competitor site. Even if all you see is "lorem ipsum" text and you know the site is not live, it could certainly be an site in production that belongs to some one OP recently had an argument with, for example.

Even if the site definitely belongs to OP, and we have written "consent" in the form of a Stack Overflow post, is it possible that someone could still get in trouble with the law for attempting to "hack" the site if OP decided to be a bastard about it?

It's probably safe to assume that these questions are always worthless and will get closed, but should these posts be flagged with extreme prejudice? I don't know what the law is, and I don't think it's worth even getting into. If this was my show, the user would get one friendly warning email and then a permanent ban.

What do the mods/community think about this?

share|improve this question
These questions are not a good fit for SO. Mod note The question in question (why do I love saying that?) has been deleted. – Tim Post Jul 9 '11 at 19:00
Once in a while people will ask this. I feel that it is indeed off topic. You should always flag questionable things appropriately .. but that advice goes for every post on SO. Let us know, and we'll deal with it. Sometimes people ask unanswerable questions, we're kind of used to that, you know :) – Tim Post Jul 9 '11 at 19:09
The hardest part here is figuring out which of the 5 close reasons to use. They all apply! – Cody Gray Jul 10 '11 at 7:52
up vote 20 down vote accepted

Please try to penetrate [this link]! .. How useful is that in two years? Put the site on 4chan and claim it is unhaxorable, you'll get better results. I've deleted the link in question, which was previously closed.

SO isn't for penetration testing, it's for when you didn't get THROUGH penetration testing and have a specific, technically answerable question to ask.

That goes for web apps, CLI programs, and the OS you wrote controlling the robot you built that is now inexplicably cheating on you - within the guidelines of the FAQ.

share|improve this answer
My view is that it goes beyond any of the current close reasons, into the realm of "absolutely not appropriate", so I'm wondering if my opinion is shared throughout the community. From your perspective as a moderator, is this type of question always an auto-delete? – Wesley Murch Jul 9 '11 at 19:16
@Wesley - But not flag reasons. Post -> Flag -> Other OMG WTF? :) Let us [moderators] help you :) This is something we really need to handle, if the community doesn't. In this case, the community handled it. – Tim Post Jul 9 '11 at 19:17
Do you have anything to share regarding the legal side of this? I know this is not the appropriate place for legal questions, but I would think someone here would know since it's so closely related to The Web. Aside, are you in agreement with me on my harsh attitude towards it, or do you think it's not a big deal? Am I getting too upset about it? – Wesley Murch Jul 9 '11 at 19:29
@Wesley - Legal side from the vantage point of what country? That's kind of, you know, why it is way too broad for SO. – Tim Post Jul 9 '11 at 19:31
Is that rhetorical? How about in the U.S.? I'm really not sure, that's why I'm asking. I appreciate the feedback very much, hopefully it's understandable if I leave this open for a couple days in case someone drops in who has something else to say about it. Thanks again,. – Wesley Murch Jul 9 '11 at 19:31
@Wesley - IANAL. Let's confine this to what is and is not appropriate for SO? – Tim Post Jul 9 '11 at 19:34
In that context, then can you confirm, this is or is not strictly against the rules of SO (to request a site be hacked)? I mean beyond the guidelines and close reasons. Or are there no "rules" beyond the FAQ and whatever the community deems appropriate? – Wesley Murch Jul 9 '11 at 19:36
@Wesley - I can confirm that any SO moderator will remove any question that can't reasonably be answered. I've expressed my opinion in this answer, which is my own, while citing the FAQ of SO. What, precisely would you like me to state? – Tim Post Jul 9 '11 at 19:41
I guess if there was one thing I'd like you to confirm, it would be this: Does requesting a website be hacked warrant any action against the user beyond closing/deleting the question, or is it "just another worthless post"? What if the post is answerable, about something specific, well-written, on-topic, but still involves this request (but is not limited to it)? (I know - not likely, but an answer to this would pretty much answer my question). – Wesley Murch Jul 9 '11 at 20:14
+1 for "Put the site on 4chan and claim it is unhaxorable..." That's going to get you a lot further than begging professional programmers on Stack Overflow to do anything. – uɐɯsO uɐɥʇɐN Jul 9 '11 at 20:44
@Wesley: If that's the case (as you mention, unlikely), then edit out the objectionable portions and leave in the actual, answerable question. Then let people answer that question. – Cody Gray Jul 10 '11 at 7:51
@Wesley - There is no topic that makes us act any differently than we would otherwise. We enforce the rules of the site -- nothing less, nothing more. The context of the post is incidental. – Tim Post Jul 11 '11 at 9:51
Makes sense to me now that I've had time to think about it, it wouldn't be treated any differently than any other junk/spam/offensive/worthless post. Thanks a lot for the feedback Tim. – Wesley Murch Jul 11 '11 at 13:41

Such "Please hack my website" questions are not even questions; they are requests for testing a site, for which, as you said, we cannot know who is the owner, and if the OP is really associated with the site for which the link is provided.

It would be a question if it asked what to do to make a site more secure, but even in this case it would probably not suit Stack Overflow.

share|improve this answer

Ethical considerations aside, we've already discussed questions like "why don't the square and the circle line up on my website, please follow this link to look at my html and css" which are useless once the person fixes the problem and updates the site. This is just another case of the same thing, seasoned with danger. Close as too localized, I would say.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .