How should we treat questions that are, or have seeds of, evil or malicious purposes and actions, such as writing spambots and malware?

Should they be answered like regular "everybody keeps their pants on" questions? Or should there be some other type of response to this bad behaviour lot?

  • 10
    I think we should lift this to FAQ-Status together with a brush up, but I have no idea if that's a good idea or how to do that. Commented Sep 16, 2011 at 6:38

7 Answers 7


I've seen a few of these, though they are usually couched in the terms that Jonathan mentions in his answer.

The other ones have usually had comments/answers along the lines of "why do you do this?", "this sounds like spamming", etc. and often the asker responds with what seem to be perfectly plausible reasons.

I think that there are five levels of action that you can take:

  1. Just answer the question without comment. Who are we to pry into other people's business, which may be confidential?
  2. Do nothing. The original poster won't get an answer and will have to try somewhere else.
  3. Leave a comment indicating that you think this is "evil" and asking for more information as to why the asker wants to do this. Then you can choose whether or not to answer the question based on their response.
  4. Down-vote the post, and preferably leaving a comment that explains why to the poster.
  5. (The nuclear option:) Flag the post as spam, offensive, or just in need of moderator attention.

Basically, what I'm saying is that you have to treat each post on its own merits. The other thing you could do is check out the poster's profile and see what other questions/answers they have posted. If everything else points to them being legitimate, then just answer the post; if not, flag it and explain your concerns to a moderator.

  • 7
    Asking for clarification can only tell you if the OP knows how to hide their intentions better than you can guess them. You might even help that OP learn how to better hide for the next time. I'd suggest asking for more information only if you need it to answer the question. (It'll waste less of your time if you think they're truly being nefarious.)
    – Gnome
    Commented Jun 2, 2010 at 23:39
  • 10
    I happened to see "I try to spam users but it fails, why?" question, with the word spam explicit in it's title. After a comment it was edited to look more innocent, but anyway. In theory if I answered, I could get fined (law in my country would make it assisting in illegal activities). Sometimes 1. is simply not an option.
    – Mołot
    Commented Jul 19, 2013 at 9:19

As mentioned, there is a problem with characterizing a question as "evil". I saw a question about "Monitoring Internet Usage in my small office". The asker was downvoted to oblivion, as were the answers (myself included). Over time the votes have been removed/canceled out by upvotes, but this person's technical question was downvoted because of the community being angry about being "spied on".

Later I read a second question by a different person about "monitoring internet traffic through a particular router" and, because this person phrased the question differently, they got HUGE upvotes, even though the question was essentially the same.

We, therefore, have to split questions into two aspects:

  1. How technically can X be done?
  2. What ethical implication are there?

Stack Overflow is fundamentally about the first question. It is a technical "question and answer" site. If the hackers get better (and they will) then the security teams will also get better. If the "way to hack" is published on SO, then the security guys will use that to learn "ways to protect". As Bruce Schneier says on his blog all the time, "Secrecy is not security".

If a question bothers you, don't answer it. But if I can, I still will, because it's not my job to go visiting their intentions. And if it is a technically interesting question, I'll upvote it too.

  • 14
    So, you'd answer, "What's a good design for an ethnicity database to be used for ethnic cleansing purposes?" (Hah - Godwin'd ya!)
    – Shog9
    Commented Jul 24, 2009 at 17:40
  • 5
    @Shog, I'd not answer that question. But it seems to me like those people aren't going to give up their ethnic cleansing because they had a database error, lol.
    – devinb
    Commented Jul 24, 2009 at 18:10
  • 15
    @Shog and anyway, IBM already came up with a solution to this problem.
    – user3788
    Commented Dec 21, 2009 at 16:09
  • 1
    @Shog It's not his style to answer questions with questions, maybe? Commented Jun 11, 2012 at 23:25
  • I think, the real reason of the downvotes was that a significant proportion of the SE users wouldn't really happily show their bosses their browser history.
    – peterh
    Commented Mar 30, 2017 at 21:16

It is going to be tough to know who's evil and who isn't. After all, nobody in their right mind will say

I need to spam 900 email accounts 3 times a day with Viagra ads.

Instead, they'd ask

I've got 500-1000 employees that need to receive product stats three times a day. What's the best way to do this?

If they're slick enough, we'll all take the bait.

  • 29
    You're overestimating your fellow man, there. This is something which has actually occurred in the past and was pretty hilarious how badly they tried to cover up their intentions.
    – TheTXI
    Commented Jul 8, 2009 at 11:30
  • 25
    +1 If deciding between good and evil software was algorithmic, Windows would already block evil software and we wouldn't be having this conversation. Instead, the world is full of installations of Symantec (which does more harm by wasting CPU than most malware!) demonstrating how tricky this is.
    – Earwicker
    Commented Jul 8, 2009 at 12:38
  • 15
    @Earwicker - The Windows opening with a timely Symantec-side castling - well played indeed! Commented Jan 8, 2010 at 20:42
  • 11
    If deciding between good and evil was algorithmic, Windows wouldn't get there Commented May 29, 2013 at 6:52

Unless it's totally 100% obvious that the code/act described in the question is illegal in the majority of countries, leave politics and legal issues out of Stack Overflow. There might be questions that give corporate folks a legal headache, but if that happens, I assume they will take action directly. That's the exception to the rule. The general rule is:

Assume good faith for all users on the site. Making different topics in our field taboo is something that will not pay off in the long run. A likely scenario could be a question regarding the DeCSS code for breaking encrypted DVD movies. DeCSS is legal in a lot of countries (Norway to name one), but violates the DMCA in the US. Depending on your beliefs and/or location, you should feel free to refrain from answering, but don't downvote or flag the question.

See also: What to do when I suspect a person is asking questions to become a cracker?

  • Don't to mention, that on the other side there are people who think every form of copyright protection to be against human rights (right to information, culture, entertainment and education) Commented May 29, 2013 at 6:54

I find that most of these questions can be dealt with by essentially a single answer:

Don't do that. Even if you have a legitimate reason, your program would be detected as malware by (antivirus/antispam/antispyware) software and you will lose all your customers.

There isn't any neat dichotomy between technical and ethical issues, because having the appearance of evil becomes a technical issue (AV stopped your installer from uncompressing your file / AV stopped your program from executing / AV deleted your DLL / AV deleted your data file).

  • I love how you have shown the link between technical and ethical ty
    – user310756
    Commented May 26, 2013 at 14:06

In my opinion, spambots should be open source and all necessary knowledge to build them should be public. I wouldn't mind answering a question that would enable some people to spam me the next day because this type of information serves both sides: the good and the bad guys. In the long term, all you are doing is accelerating technological evolution by spreading information.

To explain myself better, I'll exemplify: There are the antivirus makers, and the virus makers. If you post in a public forum how to make a virus, the virus developers will use it to fortify themselves, while the antivirus makers will use it to prevent this. After some time, the net effect is almost zero.


You could probably vote these as spam using the flag function.

I would say use the Google motto of "Do No Evil". If you have moral qualms against answering a question, then don't answer it and comment as so. More than likely questions like this will get closed very quickly anyway.

  • 4
    Google's motto is "Don't be evil". (Or rather, it was.) Commented Mar 15, 2016 at 10:45
  • @ThomasEding According to ivan's linked article, Google folks included these words "because they felt that other companies were exploiting users". It's good to know that Google cares about us.
    – Conrado
    Commented Sep 29, 2020 at 12:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .