Should I answer a question if the information I am about to publish can be useful for others but also can and is very likely to be used for some dark business?

For instance - I was going to make a self-answered question on SO about how to automatically check if a email address exists on Gmail. This information could be useful for the community (I think) but it obviously can be used by spammers to make databases of existing emails.

So I am not sure if I should post it.

  • 2
    Maybe you should disclose it to Google and see if they want to close it as a security hole before you publish it more widely. – tripleee Mar 24 '17 at 11:40
  • Given that searching for "how to check if a email address exists" already gives many solutions (including this highly upvoted answer How to check if an email address exists without sending an email? already on SO) I would just go ahead if you think it would be useful. – DavidPostill Mar 24 '17 at 11:42
  • Related, meta.SO: meta.stackoverflow.com/questions/262656/… – M.A.R. Mar 24 '17 at 11:43
  • @tripleee Google already have a way to test. See support.google.com/accounts/answer/40560?hl=en – DavidPostill Mar 24 '17 at 11:45
  • It is not a security hole. This method is used in Gmail registration form to ensure you are going to register a new and unique email. I think users will not be pleased if they remove this feature :) @tripleee – Andrew Che Mar 24 '17 at 11:45
  • @DavidPostill I was talking about an automatic way to check an email for existence, this can be useful for spammers – Andrew Che Mar 24 '17 at 11:49
  • @АндрейЧереваткин An information leak is a security problem. One common way to prevent information leaks is to throttle down queries from a single IP address, for example, which makes it hard (though by no means impossible) to use it programmatically to find which addresses are valid. Another way to secure things against abuse is to return incorrect answers a lot of the time (saying something is taken when it isn't is basically harmless). – tripleee Mar 24 '17 at 12:32
  • @tripleee They do throttle down queries from a single IP address, so I think there is no need to warn them. – Andrew Che Mar 24 '17 at 12:37

Except rare cases, we don't have access to such secrets which could be dangerous in the short, concantrated format what the SE Q&A format requires.

In your example, if my boss would ask, how long would it be for me it implement a tool to check the existence of a mail address on google, I would say, 1 hour.

This question happens quite often on different SE sites (example). The answer is mostly the same: the real dangers are too little.

There are some exceptions, for example, on the security SE, questions about the offensive side of the security are offtopic.

I think, in the case of such rare exceptions, the site knows already the problem and tunes its policies to close them out as offtopic.

So, I don't think that your content would be really dangerous, but I think it would be surely useful, so you can post it. :-)


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .