-12

This question already has an answer here:

As a specimen consider the following genuine question:

I have a list of hashs (md5), around 50K. I'm looking for the best solution to write a script that compare my hashlist to a huge (many GB txt file) dictionary. I used Python to generate that dictionary, should I use the same language to compare hash match ? or do you advise me to use a better/faster solution ? Note : the program will be used in a dedicated server (Good CPU/Memory ressources).

[I have already asked for its deletion]

The only practical purpose of this question is hacking passwords. The large file is a rainbow table and the small file a purloined list of password hashes. The poster was asked and flat declined to say what they are doing.

So the only practical purpose is malicious hacking and the poster has refused to provide a legitimate purpose. Malicious hacking of that kind is illegal in all civilised countries.

I can't find an explicit statement of policy that such topics are forbidden. I've seen a couple of questions discussing how to handle these questions but no clear statement of site policy. I believe there should be such a policy and a clear statement to that effect in the Help Center.

I realise there's a hacking tag and I think there's such a thing as non-malicious hacking. For example, trying to modify your player file in Minecraft can be called hacking but is non-malicious. I'm asking about questions the only practical reason for is to further obviously criminal and most likely harmful activity.

I'll log my reply to some of the responses I get:

Response: How do we know it's for a malicious purpose?

Reply: It's obvious. Even the file sizes ring true with a rainbow table attack. If you can email asking you your PIN for research purposes who you give them the benefit of the doubt? OK. That question is about hacking to the same degree of certainty. There are 'dual use' questions and a grey area. Sure. That post is about hacking.

Reponse: Maybe asking is OK.

Reply: Learning about rainbow table attacks is valuable education and should be core syllabus for every Computer Science student in the world. Detailed techniques for efficient implementation have crossed the line. If this person is in an academic institution their professor will explain it to them and they don't need an answer to that simplistic question.

marked as duplicate by Rory Alsop, Martijn Pieters support Nov 21 '14 at 21:50

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    slightly related: meta.stackoverflow.com/questions/276845/… and maybe asking is OK, the users that answers are suspect. They obviously are very familiar with that kind of techniques, aren't they? – rene Nov 19 '14 at 19:29
  • 3
  • 9
    The question you refer to (based on some of the comments as well as the question you quote) doesn't really seem to ask "How do I do this (presumably illegal) thing" but rather "I'm doing this thing and it's slow, how can I make it faster?". So that (if it weren't far too broad) might already make it more fair game for the site. And besides, who's to say it isn't simply a user trying to understand and test the mechanisms for personal learning? Why should he have to justify that to you? I don't personally see the need to disallow such questions and certainly don't think it's obviously criminal. – Bart Nov 19 '14 at 19:37
  • Thanks. I can see it crops up as a question from time to time. I want to make two points. First, the post I've flagged is a black and white black hat post about malicious hacking. So it can't be buried under uncertainties as some of the replies on other Questions seek to do. Second, it's not acceptable for a responsible site to deny all responsibility and say it's not their place. The world isn't that simple and there should be a clear policy and it should bar that question. – Persixty Nov 19 '14 at 19:39
  • Bart, I'm not buying that. They could have asked a generic question about algorithms and got under my radar but they didn't. They want to match MD5 hashes in volumes that are exactly what a rainbow table attack might use. There is no practical purpose for that question that isn't hacking and it's unconvincing to pretend there is when the poster refused to even try and give one. No sale. It's malicious hacking. Plain as the Mo' on ma face. – Persixty Nov 19 '14 at 19:42
  • 3
    I think it's fine to question their motives, but I wouldn't take this as grounds to close a question unless they explicitly admit malicious intent. I'd be interested in doing something like this myself as a fun exercise, like I've done crypto exercises in the past, and would expect Stack Overflow to help me deal with technical issues I encounter. – Jeremy Banks Nov 19 '14 at 22:40
  • Jeremy, I don't think a requirement that people admit malicious intent shows sufficient responsibility for a respectable web-site. – Persixty Nov 19 '14 at 23:06
  • 3
    By the way, is your meta discussion about Stack Overflow policy, or about Stack Exchange policy in general? You posted on meta SE but used the stackoverflow tag, which is confusing. As it happens, SO doesn't have any specific policy in that regard anyway. – Gilles Nov 20 '14 at 1:25
  • Also, in such cases, please link to the post(s) that you're discussing in your meta question, and please post a link to the meta thread as a comment under the post(s) that you're discussing. – Gilles Nov 20 '14 at 1:26
16

I think an explicit statement to bar malicious or illegal hacking questions would be wrong for several reasons:

  • it puts a technical requirement on moderators and high rep users, to recognize that a technical question like hashing things or looking things up is actually in support of "bad" activity. If you flag such a question, how is the moderator who handles your flag able to evaluate whether this question is in support of such activity or not? That makes it hard to implement
  • there is some history that sites attempting to keep illegal material off the site take on a legal liability and can suffer more punishment if illegal material gets on the site than sites that don't try and just issue disclaimers. That makes it legally risky
  • if questions that are obvious about their relationship to bad behaviour can be closed, deleted, or otherwise barred, then askers will leave those details out. Either they will now successfully get the help they wanted, or they will have created a bad question, which this site does not need any more of. That makes it counterproductive

I think your best bet is to comment on such questions saying that it's obvious to you this is a nefarious deed in progress, and urging people not to answer. You can then use your downvote powers to punish not only the asker but any answers that try to help. That's already within your powers. You also have the power to close questions, using Other, and filling in a free form reason. If 4 other people agree with you then no answers can be added, though comments may be left and it's possible 5 other people would re-open the question.

  • I recognise your 40k reputation but accept none of those points. 1. Hard to implement? Allow posters with sufficient reputation to make the call. There is a vast population of users on this site who are competent to identify black and white cases. 2. Really? Please identify such cases. In my jurisdiction doing something is usually a better tack than flagrant disregard. We've past the point where sites can pretend they have no responsibility. 3. That's the pushing it underground argument. My poster was incapable of such dressing up and would be unable to do that. – Persixty Nov 19 '14 at 22:10
  • I don't know why you think users with high rep would know. I have a high rep and I don't know. Different people know different things – Kate Gregory Nov 19 '14 at 22:37
  • I think enough of them would know. There are enough well informed posts about salting password hashes on this site for me to know that a lot posters know when someone is trying to use a rainbow table. I assure you that the poster in question is with little doubt up to no good. There's a lot to be said for crowd sourcing. If enough people flagged the same concern the real problem is the failure of this site to implement a demonstrably responsible policy. – Persixty Nov 19 '14 at 22:46
  • 1
    @DanAllen Are you asking about a specific site? Because, re point 1, at least on larger sites, there is no association between high reputation and a users' knowledge of a specific subject (e.g. on SO I could not be trusted to address an issue related to, say, ASP). There is plenty of evidence of this if you read between the lines in various site metas (esp. topics regarding moderators/users requesting additional information in flags and review queues). Close / flag reason handling is far less than ideal, in reality; there is not much argument there. – Jason C Nov 19 '14 at 23:21
  • 1
    Re: point 2, I know this doesn't help, but I've certainly heard the "partial regulation = legal liability" reasoning in other contexts before. I do not know if there is truth to it, though. But I do know, correct or not, it's not the first time I've heard it. – Jason C Nov 19 '14 at 23:22
  • 1. I accept people have specialties but what is clear is that people with reputation know their competences. So creating a way for reliable people to be listened to when they know something is dodgy would throw out far more bad than good. I think I'm failing to get over how screamingly obvious it is that post is about malicious hacking. Does anyone know any undetectable poisons that I can buy or manufacture in my kitchen? I'm not planning anything. Just interested. It's that obvious. Seriously. – Persixty Nov 19 '14 at 23:32
  • RE: RE: Point 2, I've never heard or seen that fly. It sounds like an argument invented by people who don't want to get involved. It sounds like the old myth that you shouldn't sweep snow of your drive because if you do you could be liable if someone falls over but if you leave it you're not to blame. – Persixty Nov 19 '14 at 23:34
  • 1
    Free-form close reasons are only meant for things that should be closed according to community norms, typically documented in meta threads. Using a free-form close reason to close something “because hacking” would be inappropriate on a Stack Exchange site such as Stack Overflow or Information Security that doesn't have a ban against black hat questions. @DanAllen – Gilles Nov 20 '14 at 0:07
  • Gilles. My point is that it's not acceptable to not have a ban on black hat questions. – Persixty Nov 20 '14 at 0:09
  • 7
    Dan - there is almost no such thing as Apure black hat question. Almost everything black hats do, white hats do. There are exceptions but basically the tools and knowledge requirements are the same. I have run large white hat security teams across multiple countries and can categorically state that your premise is wrong! – Rory Alsop Nov 20 '14 at 9:40
  • 1
    I find it interesting that Dan thinks that not "knowing this is malicious" is a sign of insufficient experience. Quite the opposite, I think that Dan's claim that it can only have malicious uses is a sign of insufficient experience and/or imagination to think of legitimate uses. List vs list hash matching could be used for data deduplication commonly done in mass backup services (I don't know whether it is the most effective method; it certainly is a reasonable approach to take). Or if you wanted to determine whether a computer contained any of a large set of sensitive files. – Ben Voigt Feb 1 '15 at 6:36
11

The explicit statement is in the terms of service. The closest relevant statements are:

Any fraudulent, abusive, or otherwise illegal activity or any use of the Services or Content in violation of this Agreement may be grounds for termination of Subscriber’s right to Services or to access the Network. Subscriber may not post or transmit, or cause to be posted or transmitted, any communication or solicitation designed or intended to obtain password, account, or private information from any Network or Service user.

Use of the Network or Services to violate the security of any computer network, crack passwords or security encryption codes, transfer or store illegal material including that are deemed threatening or obscene, or engage in any kind of illegal activity is expressly prohibited. Under no circumstances will Subscriber use the Network or the Service to (a) send unsolicited e-mails, bulk mail, spam or other materials to users of the Network or any other individual, (b) harass, threaten, stalk or abuse any person or party, including other users of the Network, (c) create a false identity or to impersonate another person, or (d) knowingly post any false, inaccurate or incomplete material.

Engaging in “hacking” (i.e. computer-assisted fraud) activity is against the terms of service. Discussing techniques that can be used in computer-assisted fraud, such as brute-forcing hashes, experimenting with cross-site scripting, looking for bugs in programs, installing programs in virtual machines, etc. is perfectly legal and authorized on Stack Exchange.

Some sites may have community rules that ban certain content. For example, Super User has a ban on Hackintosh questions on the grounds that Apple has stated that running Hackintosh systems is against the software license. Other communities may or may not follow suit, for example Hackintosh questions are explicitly permitted on Ask different.

Any site that's useful for security professionals has to allow black hat questions, because white hat knowledge and black hat knowledge is pretty much the same thing. Knowing how to break a system and knowing how to protect it from being broken involves largely the same competence and skills. I invite you to read discussions on Meta Security.

There is no way to know whether a question is asked with malicious intent. For example, cracking passwords is routinely done by system administrators (or by automated systems set up by system administrators, if you want to nitpick) to educate users who choose weak password. Another application of inverting hashes is generating Bitcoins, which is legal in most jurisdictions and ethical in most cultures. On a site about programming or security, it is perfectly normal to have questions about efficiently generated rainbow tables.

In summary, the reason you can't find any statement that what you dislike is forbidden is that what you dislike is squarely within the norms of the community you're participating in, and for good reason.

  • I don't quite agree. I certainly wouldn't want a ban on discussing security and some black hat questions have white hat value. I think it should be on every CompSci syllabus what a rainbow table is. However some questions have no such value and ought to be barred. Everything of any value in the world has a grey area. It's just an excuse to then say 'therefore we will can never draw the line'. Some stuff is black and white. Draw the lines you can, people. – Persixty Nov 20 '14 at 0:51
  • 4
    @DanAllen The problem with your approach is that the example that you state has no value is a perfectly reasonable question — probably not a great one, but neither obviously bad nor obviously malicious. If there's a line to be drawn, it's definitely not where you put it. – Gilles Nov 20 '14 at 1:22
  • Where do we put it? Definitely with that question in the black. It has no practical purpose except hacking. So if you say that having a conceivable intellectual purpose legitimises questions then, OK, all questions are legitimate. That isn't true. Right thinking civilised people aren't happy to share techniques that only have malicious uses with people with a malicious intent. – Persixty Nov 20 '14 at 1:29
  • 4
    @DanAllen “It has no practical purpose except hacking.” Well, no, that's just wrong. And I'll thank you for not telling me how to think “right” (meaning, like you). – Gilles Nov 20 '14 at 1:33
  • No really. There's no other practical purpose for matching those numbers of MD5 hashes and the poster couldn't come up with one. Again there can be grey area. That post is not in it. And if you don't think right thinking civilised people resist others trying to commit criminal acts, then fine we disagree. If find such an attitude worrying if widespread. – Persixty Nov 20 '14 at 1:36
  • 4
    Dan - you should realise that you are misguided. It may be that you cannot conceive of a white hat reason, but that is perhaps down to the experience you have had so far. I agree with Gilles - not a great question, but definitely not black or white – Rory Alsop Nov 20 '14 at 9:42
11

TL;DR:

Part 1 - "Black hat" questions are often exploiting very specific systems or security functions. If a user doesn't bother trying to cover up their intentions, the question usually ends up invalid because it's too narrow of a case to be useful or solvable by an Internet-based audience anyway. If they try too hard to cover up, the question becomes too broad or undefined and again is close-worthy without needing to be labeled as "black hat". Then there's the ones who hit it just right. For those, the question is a clearly defined good fit for the StackExchange format and you probably can't even tell - or at the very least can't definitively prove - that it's even a "black hat" question. So, in many ways, the perceived problem is mostly self-fixing.

Part 2 - The perceived problem isn't even one StackExchange is designed to care about. The criteria by which one could judge a question as "black hat" or "white hat" are entirely irrelevant to determining a solution for it. Any other such immaterial details are considered noise in the question or comment threads on StackExchange and are generally unwelcome for precisely that reason - this should be no different.

enter image description here

Part 3 - From our position, definitively and accurately assessing someone's "hat color" is impossible. We do not have the authority to require a user to provide us the required information or documentation to prove authorization or intent, nor are we able or empowered to reliably authenticate such information if it is provided.


I'm pretty sure a global SE policy doesn't exist particularly for or against malicious hacking. When questions are abstracted enough to fit general SE guidelines in the first place (seeking to have useful Q&A which is valuable to a wide audience), the specific nature of the asker's intent is quite easily obscured even if they don't mean for it to be. Add in intentional obfuscation by the asker to avoid the stigma of being called out as a "black hat", and you quickly end up with a question that demonstrates a very useful problem of interest without being very clear as to what its final goal is.

So, a majority of "black hat" questions will often naturally fall into one of a few categories which are typically not welcome on StackExchange regardless of any malicious intent on part of the asker:

Too narrow: This used to actually be a standard close reason. These questions are too situation-specific to be very useful to a wide audience, and in some cases even so obscure as to be unanswerable by anyone not actually directly in front of the problem.

Too broad: The asker has generalized the question so far that to answer it would require coverage of way too much subject matter to fit the StackExchange format.

Unclear: Again, this can easily happen when a question is abstracted from its actual intent. Here, it's done to the point where nobody really has a solid idea of what a useful answer would look like to the asker.

The issue of accepting "black hat" questions has been hashed over and re-addressed a few times on the IT Security site, (I'll try to toss in some Meta links later) where it is very much expected and in many ways accepted that we will be discussing "black hat" topics from time to time. The majority consensus there, over and over again, is that there are many useful "black hat" questions - perhaps even more so for the IT Security site than others, but that's more due to the specific nature of the site than it is the nature of the questions.

However, StackExchange question quality policies still very much apply. Aside from the aforementioned intent to generate questions that are valuable to a wide audience, these policies also are meant to result in questions that are of interest to people who would have specific expertise in the field targeted by each site. Leveraging that intent, the IT Security site has adopted the following custom off-topic closure option:

Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem.

While I'm not saying this should be globally applied to all StackExchange communities, it does represent the culmination of a lot of debate and consensus among the one community which by its very nature is expected to include the foremost experts on "black hat"/"white hat" issues within StackExchange. So, it seems that it should stand to reason that the logic applied there should carry some amount of weight.

So, let's measure the supposed "rainbow table" question up against this and see where we land. Do pay close attention though, because absolutely none of this actually has to do with whether or not the question is "black hat" or even whether or not it's related to rainbow tables.

  1. Is the user asking us to break the security of a specific system for them?

No.

The only details we know for certain are that he has a somewhat large list of MD5 hashes, and another extremely large list of MD5 hashes, and he wants to do a comparison of the two. Further, he's not even asking how to do it. He's just asking if there's any particular language which is better-suited to the task than others. This is a very far cry from asking to be handed "Rainbow Tables for Dummies" by any objective measure.

  1. Do they demonstrate an understanding of the concepts involved?

Reasonably Enough, IMHO.

If we accept that the problem being presented is simply one of language choice for a specified task, without needing any regard for what that task is or what it is useful for, I think realizing that such a question should be asked in the first place is enough to demonstrate understanding of the fact that certain languages have natural benefits in terms of features and performance over others. He might not have gone into a whole lot of depth on the topic, perhaps leaving him to appear a bit of a newbie, but newbie questions aren't unwelcome just because they're newbie questions either.

  1. Does the question identify a specific problem?

Yes and No.

And here is where it fails just enough to be close-worthy. Yes, he tells us he's got a big file of hashes and a really big file of hashes and he wants to compare them. Yes, he's identified that the issue he wants addressed in answers is one of language choice with the primary goal being processing speed. He's even gone so far as to specify a language that he thinks might be a good candidate, and provide some justification (albeit perhaps a bit weak) as to why.

What has not been done here, however, is to give a sufficiently defined objective measure by which an answer might be judged acceptable for his case or generally superior. Sure, we have "fastest" to go by. But fastest on what platform? How much more speed above another choice is important for your use case? Are you asking because you're writing it yourself, or because you're trying to choose among programs written by others? If writing it yourself, what languages are you comfortable with? How well-versed are you in writing performance-optimized code in those languages?

There are a large number of variables which could affect software performance in general, and may affect the performance of different software languages attempting the same task. Beyond that, there's a number of other variables which are needed to determine what is right for you and your environment even when the use case is known. None of this is very well-defined in the question, so it's hard to objectively weigh what value an answer might have for the asker unless the answer is written so broadly as to be a marketable book!


Further, in order to disqualify "malicious" or "black hat" questions from this site, we need to first establish what qualifies a question as such.

For the sake of argument, let's accept the claim that "There's no practical purpose for matching large quantities of MD5 hashes except for hacking". It's a reasonable enough assumption to make for this discussion but it still leaves the issue moot. As @Gilles touched on in his answer, not all hacking is malicious. System Administrators routinely, some by company policy or legal requirement, have to hack their own users' passwords as part of security assessments. And there's an entire profession dedicated to authorized hacking of systems to identify and report weaknesses.

The most widely-accepted measure by which anyone can really delineate "black hat" from "white hat" is the intent and outcome of their actions. Both hats need to do password cracking, and in nearly every other way need to do the all of exact same things to accomplish their goals. There's only one other criteria that's ever used by any reputable member of the security community to distinguish the two, and that's authorization.

  1. Was their activity authorized?

Unauthorized activity is often enough alone for most people to say that something is "black hat". However, some may argue that unauthorized activity resulting in a better security posture for the target system falls into a gray area. In any case, the second criteria is by far the most widely accepted (although in certain respects still debatable) demonstration of someone's nature and intent.

  1. What did they do with the access/knowledge gained?

Even authorized hacking can be turned against the authorizing party, and unauthorized hacking can still be leveraged for good.

Disclosing a vulnerability to affected parties will usually push you towards the "white hat" line, although it is very much a subject of wide debate as to how that disclosure should properly be handled. Using a vulnerability to exploit systems in unauthorized attacks for your own gain, or selling the fruits of your labor to third parties who intend to use it for purposes other than protecting their own systems will most squarely land you under a "black hat".

However, neither of these are criteria which are at all relevant to solving a given problem. To judge a question based on either of these criteria would require inclusion of details, or additional requests for such detail, that have absolutely no value in determining what sort of solution is required to fulfill the need represented by any question. In every other case, we would call such details or discussion noise. Therefore it it is against the intent and nature of StackExchange communities for us to attempt to establish policies regarding matters which require such information in order to be judged.


Lastly, we are ultimately not in any position to accurately judge the color of someone's hat in the first place. As established above, there are only two criteria which are useful to distinguish "white hats" from "black hats":

  1. Authorization
  2. Intent

As we have no association beyond StackExchange with, nor any outside authority over, the person asking the question we cannot mandate that the asker provide us the information required to properly judge their color of hat. Many times, disclosure of such information is forbidden by legal agreement with a client or discouraged (even for those who might ultimately be judged as "white hats") by its potential to affect future legal proceedings. Even given such information, we have no reliable means or authority by which to verify its authenticity.

With rare exception (if any), that is just the nature of Internet-based public communities. To change that would put extraordinary and undue burden upon the organization and individuals who create, manage, and maintain StackExchange.

  • Point 1. Not in this case. It's a general question at a specific point in their effort to hack a specific (unknown) system. But is still a very clear give away what they're doing. Point 2: That's the point of debate. The apparent fact that Stack Exchange and its owners has decided to be derelict in their social responsibility to resist criminality doesn't legitimise the position. No one engaged in professional white hat hacking would ask that question. It's obvious clumsy and naive but answering it will provide the hacker with information that may help them. – Persixty Nov 20 '14 at 7:42
  • 6
    @DanAllen I'm afraid I'll have to disagree with you there. There are several people I know who are "What hats" who may ask questions around how to optimise password/dictionary lookups. There's quite a bit of research into password quality which bases it's work on dumps that have been leaked. Also security testers will commonly try to crack passwords gained during an engagement to gain additional access, and this is commonly in-scope for the testing undertaken – Rоry McCune Nov 20 '14 at 9:07
  • For all I know, we know the same people. No professional would be asking such a naive question. This is like saying a Maths professor might go to a random site and ask how to calculate a GCD. Nope. This guy is not a white-hat pro. – Persixty Nov 20 '14 at 9:10
  • 4
    Or perhaps you have a higher opinion of all the people who do pentesting :) I hang out on Security.SE quite a bit and I've seen people ask questions which strongly imply they are asking with authorisation but are not very experienced at what they're doing... – Rоry McCune Nov 20 '14 at 13:52
  • @DanAllen You don't have to be a professional to be a white hat. For all you know, the guy could have downloaded publicly-available databases and is teaching himself at home. – Iszi Nov 20 '14 at 22:50
  • @DanAllen Ultimately, I fully expect that there is not any kind of proof he could give to you to convince you that he's not a "black hat" - even if he actually is currently involved in a professional pentesting engagement and just looking to explore alternative tools. However, on the same token there is no way - based on information currently provided, or which the user would be willing/able to provide to the global audience of the Internet - that you can undenaibly prove he is. See Part 3 now. – Iszi Nov 20 '14 at 22:52
  • Regarding StackExchange's "responsibility" - there cannot logically be any responsibility assigned to individuals or organizations who have neither the information needed to determine where action is required, nor the ability or authority to obtain such information or verify its provenance and accuracy. – Iszi Nov 20 '14 at 22:55
  • Iszi, You have no basis to believe I'm closed minded. He could explain what he is doing. He could prove he's a InfoSec professional with a legitimate purpose. He tried neither. But to be honest it's unlikely researcher would be looking on Stack Overflow for such basic knowledge so he would find me difficult to convince. Of course there can be a logical responsibility. Create the policy and when people who are qualified notice allow them to remove the material. Stack Overflow is packed with people who are qualified to identify such cases. It's not just me. – Persixty Nov 21 '14 at 7:55
  • One option is to flag an expert panel and open a review queue where such experts can moderate content only or very likely only of use to malicious hackers. All the infrastructure is there. The owners decline to deploy. Leave genuine white hat hackers to obtain help in other forums where they will more closely scrutinized. – Persixty Nov 21 '14 at 7:58
  • 2
    @DanAllen You're still completely missing the point. The user shouldn't be bothered to prove to you, or anyone here, what his "hat color" is. As established above and re-iterated to you numerous times in this thread by several "such experts", there is no objective criteria by which one can declare anything is "only or very likely only of use to malicious hackers". Malicious and non-malicious hackers alike all require and use exactly the same technical skills, tools, and methods. There is not a single area of non-overlap in this! – Iszi Nov 21 '14 at 15:47
  • 2
    The only criteria by which we can determine a user is malicious or not in these situations, are things which many "white hats" are explicitly prohibited or strongly discouraged from disclosing and which we ultimately cannot validate ourselves. So, if we can't ever confirm that "white hats" are really "white hats" then there's no point to having the policy. That is, unless your true motivation is to completely do without any sort of "hacking" questions at all. That would be an extremely naive and counter-productive approach, and I wouldn't hold my breath to see it done here. – Iszi Nov 21 '14 at 15:50
  • @Iszi, You're missing the fact that. There are few things in life for which there are 'objective criteria'. It's an argument people tend to pop up when they're ducking this issue. People with legitimate purposes should go to Information Security forums and be scrutinized by their peer group. Removing it from Stackoverflow.com will do far far more good than harm. We can normally over ever write policies based on net outcomes rather than absolute guarantees. This issue is in the real world. I accept that. That's no excuse for doing nothing. – Persixty Nov 21 '14 at 16:31
  • 1
    Dan - you're entirely missing @Iszi's point. Why do you think you can identify someone's motives across the internet and deny them a research route? I know many of the Security Stack Exchange folks - and they range across professional pen testers, undergraduates in ethical hacking, forensics guys, risk and control folks, enthusiastic amateurs, managers of large security teams in global enterprises etc. Sure, there may be a couple I'd have my personal doubts about, but there is no way to prove either way. So let's not deny the fact that people use the SE sites as an awesome research tool! – Rory Alsop Nov 21 '14 at 21:30
4

I agree that malicious hacking is a terrible practice. Posting this type of content is explicitly lined out in the terms of service (see @Gilles answer).

However, if the code for that terrible hack is placed in a simple straightforward complete contained example it is going to be really, really, hard to recognize.

In the off chance that it may be recognizable as potentially malicious code, the community here cannot do anything about it. We are not a judicial entity.

We can vote, and I do believe that malicious hacking is not useful, so I would think a downvote is appropriate there. If the question doesn't contain any code and is open ended, it will be closed as a too broad (which is exactly what happened in your example: https://stackoverflow.com/q/27007949/1026459 )

If the question contains all of its code, and has some easy answer, in all honesty someone will probably point it out and that will be the end of it. Did that one person contribute to maliciously hacking? I don't think so, but that is a legal decision and again we are not a judicial entity.

Keep in mind though, that retroactively if a judicial entity does find that the post or poster broke a law, certain information can be legally demanded. There is still a level of innocent until proven guilty here, but once guilty (for example, DPR) actions are definitely taken.


Terms of Service - Legal
Section 3. Subscriber content, paragraph 1

Subscriber represents, warrants and agrees that it will not contribute any Subscriber Content that (a) infringes, violates or otherwise interferes with any copyright or trademark of another party, (b) reveals any trade secret, unless Subscriber owns the trade secret or has the owner’s permission to post it, (c) infringes any intellectual property right of another or the privacy or publicity rights of another, (d) is libelous, defamatory, abusive, threatening, harassing, hateful, offensive or otherwise violates any law or right of any third party, (e) contains a virus, trojan horse, worm, time bomb or other computer programming routine or engine that is intended to damage, detrimentally interfere with, surreptitiously intercept or expropriate any system, data or information

This sentiment can be found explicitly and implicitly all over the Terms of Service, FAQ, Help Center, and meta. It is pretty obvious that Stack Exchange does not support nor condone black hat attackers, and representing them to do so is flat out egregious.

  • If I read Gilles right, they are saying that hacking is barred but talking about hacking and exchanging information about hacking isn't barred. So I think I'm right. Stack Overflow doesn't bar questions even when the only purpose of them is black hat. I think that's poor, intellectually lazy and even cowardly. I was angry when the new head of GCHQ slagged off the corporates for not doing their bit. But Stack Overflow sadly pushes me his way. – Persixty Nov 20 '14 at 0:56
  • @DanAllen - It says "Use" to mean, in no uncertain terms, if your interaction anywhere on Stack Exchange leads to hacking, then you are violating the terms of service. "Use of Services to violate the security of any computer network, crack passwords or security encryption codes, transfer or store illegal material including that are deemed threatening or obscene, or engage in any kind of illegal activity is expressly prohibited" – Travis J Nov 20 '14 at 1:01
  • Read the first para. of Gilles answer following the terms of service. Gilles understands 'using the service to hack' as quite different from 'using the service to discuss hacking'. Those terms are there to bar you from (say) trying to crack Stack Overflow passwords or cross site scripting on Stack Overflow. But you can discuss and exchange tips for cross site scripting to your hearts content. Apparently. It's a wrong and irresponsible for Stack Overflow and its community to behave. But it appears (by the down vote count) how they like it. Sad. – Persixty Nov 20 '14 at 1:07
  • 1
    @DanAllen The terms of service is written this way for a reason. It doesn't ban black hat questions and answers because they are not wrong. – Gilles Nov 20 '14 at 1:29
  • Gilles, I understand. I think Travis was suggesting it did. As I point out the operators of Stack Overflow are irresponsible in their dereliction of their social duty. Shame. – Persixty Nov 20 '14 at 1:30
  • 2
    @DanAllen - See edits. I would point out that you are out of line with your accusations. – Travis J Nov 20 '14 at 2:22
  • Travis, Do you not think the operators of Stack Overflow have a responsibility to resist crime? I do. You might disagree but that doesn't put me out of line. The anti-hacking clause is about protecting the sites interests - not acting with social responsibility. The downvotes and most of the replies to my post are all quite disappointing. – Persixty Nov 20 '14 at 7:47
  • 6
    Dan - there are many questions on security stack exchange which by your interpretation would be black hat. They aren't. They help protect individuals and companies. The downvotes are because you are so very wrong in your understanding of how security needs to work. What is disappointing is that you don't yet realise that you should pay attention to all these folks. – Rory Alsop Nov 20 '14 at 9:47

Not the answer you're looking for? Browse other questions tagged .