I wrote How long should I wait to publicize a vulnerability in a free/open source project? .

In short, how do I understand why my question was closed (while the other related but not similar questions were not)? Why is my question not programming related, when it's something only a programmer doing a code review could have come across, and only a programmer could fix?

In long, I did a code review of portions of an open source project and found that the code contained security holes which would allow read and potentially even write access to the entire disk through its web server process.

I did my research, including links to three related but not relevant SO questions. They were people who did security probing of remote sites, without permission, whereas I downloaded the source for review, and did my testing on a server running on my local machine. Their questions contained no programming material, and likely describe illegal activities, but are not marked a "[closed] not programming related."

I also linked to two documents on security reporting, which are more directed to companies and not small open source projects. I asked specific questions: I wanted to know if these documents were relevant, if I had been doing the right approach, and if I should give special leeway to the projects for being small and open-source.

Those circumstances are based on a code review, which requires understanding programming. I could not give details of those problems, including even what the project is, because that would be inappropriate given the context of the topic.

Five people considered the question as not programming related. I read the FAQ on "how to challenge the closing of one of my questions", which suggests looking for comments on why it was closed. I found nothing. I've read "What is a "closed" question in SO?" and again I can't figure out what I did wrong.

Can someone here please explain what's going on?

  • 2
    Your question suffered from a few issues: 1) TL;DR. 2) Formatted and contained rant-esque words, and it's a discussion question - it can't really be 'answered' in any definitive sense. That said, if you could edit your question to make it palatable, I'd consider voting to re-open. Jan 13, 2010 at 13:57
  • For what it's worth, if I had answered that question, I would say: "Fix it yourself, it's an open source project." Not snarkily, but seriously. If you can see the source code, and you see the problems, why not fix them? Jan 13, 2010 at 15:56
  • Because I don't know how to program in Java and don't want to learn it without being paid for my time. I read it as C++ with a strange accent I can understand but not speak. Why then that code base? The main author suggested I consider it as a basis for an example of methodological development flaws which can occur in real code, rather than the small/toy programs I had been using in my examples. Jan 13, 2010 at 16:16
  • IMHO it's perfectly reasonable to want to report an issue with an open sourced project but not want to have to make those fixes personally (for whatever reason).
    – Ether
    Jan 13, 2010 at 23:24
  • I just read the original version of that question and didn't find it at all too long.
    – TRiG
    Mar 30, 2013 at 5:15

5 Answers 5


Your question suffered from a few issues:

  1. Too Long; Didn't Read (TL;DR)
  2. Its formatting was skewed (hard to follow your question) and it contained rant-esque words,
  3. It's a discussion question - it can't really be 'answered' in any definitive sense. That said, if you could edit your question to make it palatable, I'd consider voting to re-open.

My "Rule of Thumb" for editing:

Remove everything you can and still have the question make sense. Barring that, format it so that people will actually be able to follow it, despite its length.

As an example, your original post looked like this:

Original Post

I edited it to look like this:

New Revision

Moved original comment to answer to allow for linking.

  • 1
    Although I agree with your Rule of Thumb, TL;DR per se isn't a valid closing reason.
    – balpha StaffMod
    Jan 13, 2010 at 15:09
  • 2
    @balpha No, it isn't; but it is a red-flag for seeing other issues in the question, especially if the question is poorly formatted. Jan 13, 2010 at 15:10
  • Rant-esque words? Which are those? Don't code reviews always lead to rants, measured in WTFs/minute: osnews.com/story/19266/WTFs_m ? ;) Jan 13, 2010 at 15:20
  • 1
    The other thing is, I got answers which I thought were good, and which addressed the questions I asked. That you found it TL;DR would be more address the question "why didn't anyone answer my question?" Jan 13, 2010 at 15:23
  • 1
    @Andrew: the problem with tl;dr is that it can make it hard for readers to determine what, if anything, you are actually asking! This can lead to "not a real question" close votes. I've edited your question in an attempt to combat this, first by stating the core question in the title, and second by using headings to separate the background information from the questions themselves. Note that on my laptop screen, the questions don't even appear on the first page - before the title change, I had to scroll past the long background narrative in order to find out what the question was...
    – Shog9
    Jan 13, 2010 at 15:36
  • Ah, and now George has edited it down to a svelte 623 characters. Note how the core sections are all still there: background, actions taken, questions as to what is desired... But it can now be easily read and understood in less time than it takes to consume a cup of coffee.
    – Shog9
    Jan 13, 2010 at 15:43
  • And the commentary is gone, as are the potential 'answers' (that really ought to be made answers to be voted on by the community); but the essence is still there. @Shog9: Loved your title, by the way. Chose to keep it. Jan 13, 2010 at 15:44
  • I added back in the links in a very short form; if people want to read what they say they can follow the links. Jan 13, 2010 at 16:07
  • Ah-ha! So the missing clue is that those qualifiers I put in should have been in answers to my own question? I look at the svelte version and wonder how severe the problems really are, how big an impact it would be to publish now vs. waiting, if the development people are still on holiday, and so on. All things I mentioned. I think your suggestion is that rather than bring those up first, I should wait until someone else asks them, after which I then clarify. Jan 13, 2010 at 16:28
  • 1
    @Andrew: that's one option. Another is to move them down below the question proper... But regardless, the shorter you can make the post, the easier it'll be for readers to get through it and decide on a course of action (answer|ignore|close). Your feelings on Strunk & White aside, "omit needless words" is a good plan unless you're just trying to entertain bored readers...
    – Shog9
    Jan 13, 2010 at 16:49
  • BTW, let me say that the question as it's now written is a better question. It's just not my question and it describes a different circumstance than I'm in. How do I mark it a "community"? As for how needless words only at best entertain bored readers; we have very different views of literature and the written word. Jan 13, 2010 at 17:43
  • Ah, figured out the "how to mark it as 'community'" question. Now done. Jan 13, 2010 at 17:49
  • 1
    @Andrew Dalke Not at all! I love literature, and to an even greater degree, I love to write. Writing is about communicating your idea effectively to your audience. In this case, your audience are programmers on a question and answer site; not someone curling up on their couch with their favorite mint tea. Your post would have made sense for a blog, but not for this specific audience and this specific 'forum'. Jan 13, 2010 at 17:52
  • For reference, I think most blogs are too short. My blog site is actually labeled "writings" and tend more towards articles or essays. I considered what I posted on SO to be short. Regarding S&W: chronicle.com/article/50-Years-of-Stupid-Grammar/25497 or see the various disparaging references to it in "Language Log." Jan 13, 2010 at 19:20
  • @Andrew Dalke: I applaud your efforts to 'stick it to the grammatical man', but Stack Overflow is still not the appropriate forum for pages of prose. Jan 13, 2010 at 19:27

A programming question is something like, "How do I move the turtle in logo"?

A non-programming question is something like, "How do I responsibly disclose security issues with the turtle in logo?"

Stack Overflow is for programming and software design questions. It's not about the processes that surround programming and software design, morality, project management, people management, Batman, lasers or donuts.

Your question was closed because it's not a programming question; it's a morality/responsibility/management question of some kind.

What I'd really like is for you to link to these other questions you've found that lead you to believe that questions of this sort are allowed to exist unclosed so that I can vote to close them with immediate ruthless rage.


Stack Overflow is designed to find definitive, correct answers to questions. Your question was fundamentally about ethics. Even though you can make a case that you were asking about programming-related ethics, your question can not have a correct answer and requires extended discussion.

From the faq:

What kind of questions should I not ask here?

Avoid asking questions that are subjective, argumentative, or require extended discussion. This is not a discussion board, this is a place for questions that can be answered!

  • I asked specific questions, and I put them in bold to make them easy to spot. They are "How long should I wait until I followup by private mail?" and "how long should I wait until I post it to the general mailing list?", with values which I thought were reasonable but which I wanted feedback on. I got specific answers, which said that my plans are well within the bounds of good practice. There were two good, short answers, which I up-voted, and I accepted one of them. Jan 13, 2010 at 14:28
  • @Andrew - Jeff's answer is spot on. Your question came across as a rant due to language and length. A short, opinion-free question about best practices would be just fine.
    – user27414
    Jan 13, 2010 at 14:46
  • I linked to and quoted a best practices document which explicitly said "However there may be mitigating factors that demand the deadline be shortened or extended." I wanted to know if details about this project (small, F/OSS, no dedicated development team, no security@project email) constituted an appropriate mitigating factor. How do I ask that question without details, and still get something meaningful? The answers I did get, btw, all agreed that these were not mitigating factors. I'm actually quite content with the three of them. Jan 13, 2010 at 15:42

I kind of agree with George Stocker's comment.

This is actually an OK mostly-programming-related question, but there's way too much exposition. You could cut it down by 50% without even breaking a sweat, and concentrate on the key points:

  • I found a security vulnerability in some code that's internet facing
  • I mailed the project leads but have gotten no response
  • How long should I wait for a response, until I post this security vulnerability on a public mailing list so we can ensure that it gets fixed for all the poor souls using this code one way or the other?

When in doubt, always write less. Omit needless words, etc, etc, etc.

  • Moved comment to answer to allow for linking. Forgot this is meta, and that 'comments' sometimes really belong as answers. Except this one. Jan 13, 2010 at 14:48
  • 1
    The FAQ starts "As long as your question is detailed and specific". The reason for closure is "not a programming question" not "too lengthy." I don't know which details are important and which aren't. Your summary isn't right. 1) DoS vulnerabilities are often ignorable, so severity and depth of impact are important considerations. 2) I did get a minimal response, but see no code changes. I also showed how similar SO questions weren't relevant, and how other references seemed meant for companies not F/OSS projects. (Way off topic: I consider Strunk&White a poor guide, despite its popularity.) Jan 13, 2010 at 15:15
  • it's a good post, but it comes across as a bit .. rant-y. The topic, although programming related, is somewhat subjective, so the overall length does not work in its favor. Heck, posting the actual (partial) code snippets of some of the vulnerabilities would have been better than a lot more extra words. Jan 13, 2010 at 15:46
  • 1
    @Andrew: If people don't read the FAQ before posting questions, why would you expect that they would read it before closing questions. As with most programs, people develop a "theory of operation" that may have nothing at all to do with the actual implementation or documentation. I suspect that when faced with a desire to close the question and no exact choice in the list, the FAQ goes out the window anyway.
    – tvanfosson
    Jan 13, 2010 at 15:58
  • @tvanfosson: Because (as I've been told many times), I'm "special." I'm a person who reads the FAQ and does the research and dots the ö's and circles the å's. I dislike questions which don't do the same. I forget that others aren't like that. This is also why I don't start community sites. ;) Jan 13, 2010 at 16:31
  • "posting the actual (partial) code snippets of some of the vulnerabilities". But, ummm, I just about did. I said "GET/POST to file=../../whereever_I_want" and the full exploit for reading the password file in a standard install is localhost:8080/files/../passwords.txt . Next, reverse a weak hash function to generate valid credentials, which gives write access to the server. With write access, an attacker can POST to localhost:8080/files.." with a content-disposition of "passwords.txt". There's no way these details are relevant to the question. Jan 13, 2010 at 19:32

In matters like this, the community decides. This is democracy (of a sort - one that only allows certain people - those with a sufficiently high reputation - to vote).

For what it's worth, it seems like a reasonable question to me, so I've voted to re-open it, by posting here on Meta, you may find other people do similarly (and others may think the question's totally inappropriate for SO and vote to close it, if it ever gets re-opened).

That said, no one here, aside from those who voted to close, can reasonably speak as to why the most common reason for voting to close the question was that it wasn't programming related (note that the fact it was closed as "Not Programming Related" doesn't mean all 5 closers chose that as their reason for closing).

  • In a democracy, all people have equal rights and equal access to power. This is more a meritocracy, where additional rights are gained through a measure called reputation. And closing seems to only require a majority of 5 people, which is more a procedural point or post-legislative function (eg, a senator placing a hold on legislation, or a court overturning a law based on constitutional grounds) than a classic vote. In any case, thanks for the re-open. So far that hasn't done anything. I'll see what happens. If all else fails, I can take it to the god of SO: Jeff Atwood. :) Jan 13, 2010 at 14:18
  • 2
    @Andrew Dalke: Actually, in a democracy, only the majority have rights and power. The minorities have no protection. That's why the USA is a constitutional republic and not a direct democracy. Jan 13, 2010 at 16:07
  • @george Stocker: I actually researched that before posting my previous comment. ;) "Democracy is a political government either carried out directly by the people (direct democracy) or by means of elected representatives of the people (Representative democracy)." - Wikipedia. A more nuanced position than I care to get into would need to consider how Kentucky and Virginia have life-long disenfranchisement for felons, or how the Republic of South Africa maintained minority rule under a parliamentary democracy. Jan 13, 2010 at 16:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .