4

This question got me thinking. There have been cases, very occasionally, where upon reading the question I get the sense that the asker is looking to do something evil: spam, black-hat hacking, mass email scraping, rootkits and so on.

Typical signs are a new user, asking about a precursor to a sketchy task (for example, Can I inject JavaScript code into an image?), without contextual details or further explanation.

Judging by the disparity in the ones I'm seeing and the ones I was able to find in search, usually these questions get closed and deleted or go unanswered. Some are answered, though.

I'm curious as to the community's thoughts -- is it our job to be judging askers on their perceived intent? Should we flag for this if we have sufficiently strong evidence the answer will clearly be used for evil purposes, if it's otherwise an on-topic Stack Overflow question?

(It's not as clear-cut as you might think -- as an security researcher I blur this line all the time, and thus have strong feelings about the ethical responsibilities of people who play with that particular fire. There have been times when I've written up a full, complete, multi-paragraph answer, read the question through a few more times, sighed, and deleted the whole thing because I didn't like what I might be helping someone do. I'm curious if anyone else has had this experience, and what they've done: sometimes I've left a comment, but mostly I just move on.)

Improve this question
2
  • I'd just downvote and move on. – Qantas 94 Heavy Oct 29 '13 at 2:29
  • This question does ask for a discussion of the ethics a bit more than the other, but that's not clear from the title. – Evan Oct 29 '13 at 2:39
5

It's totally up to you.

If the person seems genuinely interested in learning, maybe you decide to help him out. There is such a thing as pure research, after all. If it seems pretty clear it's just a script kiddie asking for something dodgy, maybe you don't. Ultimately, we can't control how the public uses the information they find here, and any powerful tool can be dangerous or destructive if it's placed in the wrong hands.

Sometimes it's easy; the OP makes it clear that their intended purpose is to hack a website. I don't help those folks; they are in violation of SE's Terms of Service. But if they get smart enough to ask the question without telling you why they specifically want it, they can still do evil with it later. For that reason, I don't ask people anymore; doing so means that I'm only helping the people smart enough to lie about their intention and keep their real reasons to themselves.

Improve this answer
4

I haven't been around for too long, and I've already seen a number of situations like this. My feeling is that getting the information out there is actually helpful. I do think that ethical responsibility exists in this situation, of course, and the responsibility is making sure that the information gets to relevant stakeholders. If you discover a security hole in a major browser, I think it'd probably be better (and potentially more lucrative) to report that to the folks running the show there before you post it on SO.

However, if there is something insecure that persists, I think there's a cautionary benefit to posting that information. For instance, since a number of people insist on sending passwords in plaintext when using FTP, I actually think that showing that it is trivially easy to do damage is in the public good. (Of course, showing by somewhat obscured code snippet is probably better than showing the complete implementation, which is definitely better than showing by actually stealing credentials.)

Not only is showing how (easily) an attack is conducted a good cautionary tale, it also allows programmers to put in precautions to avoid those attacks in the future. OWASP gives examples of attacks for that reason, and I don't think it's a problem here. I am not a security researcher, but my feeling when I'm trying to avoid being attacked (or on the mercifully rare situations where I've been attacked), I would like to understand how it's done. The more information there is out there about how it's done, the better.

Finally, you could always also add an addendum to readers on how to protect themselves with your answer, too!

Improve this answer
2
  • I've certainly helped people secure things before when I know that's what they want to do. See stackoverflow.com/questions/19627001/… (mentions OWASP Top 10 a lot, even!) – Christian Ternus Oct 29 '13 at 2:40
  • I don't doubt it! I was just saying that if you post about something you think is dangerous, you could also just add something about how to mitigate the danger. Also, that's a really great answer there, so remote +1! – Evan Oct 29 '13 at 2:42

Not the answer you're looking for? Browse other questions tagged .