Technically valid answers that raise questions of morality

Question

Similar to Questions with nefarious intent?, but different, and more about voting than “Is it possible?”, versus “Is it a good idea to try?”.

If someone posts an answer to a perfectly normal question, and their answer is technically valid but raises moral issues/discussion, what should be the correct attitude to take?

EG: customer wont provide ssh access - ftp only

The answer was technically valid but it's been downvoted to oblivion because what he's suggesting is just plain wrong from our point of view as system admins.

I don't want to labour a point (I studied ethics and morality at Uni) but what's wrong to me isn't always wrong to someone else. Maybe the above was a bad case-in-point (I don't think that falls into any grey areas), but:

TL;DR version: Should technically valid answers be downvoted just because we don't agree with the answerers idea of morality?

Answer 1

There are a few different situations here.

Not enough information to determine ethics

In the example, we do not have any information regarding the business relationship this person has with the hosting provider. We cannot infer, then that this breaks the TOS, contract, or in any way is unethical. Some might claim that since SSH access isn't provided, then we can assume that shell access of any kind is prohibited, but I know many webhosts that allow you to put any PHP on the system you like, but will never provide SSH due to the constant support issues inexperienced people bring to the host. They would be happy to have such a script on their system.

Therefore this example exists in a possibly gray area, depending on your point of view, but ONLY if you assume quite a bit based on a small amount of information.

So in this situation, where not enough information is provided to determine the ethics, go ahead and post the answer, or upvote the answer that, under some circumstances may be ethically dubious, but cannot be assumed to be bad due to lack of information. A nice disclaimer is good, but not necessary.

Enough information to determine ethics

If you absolutely know that the answer is ethically wrong under any and all circumstances (all nations, countres, states, districts, municipalites, companies, religions, etc) given the question, then yes, downvote it, and PLEASE comment on why.

However, keep in mind that even if the answer is ethically wrong for the given question, future google searches may land on that page (no SSH access) and the answer, though ethically wrong for the question itself, may be ethically ok for someone searching on those terms that falls into this question.

So even when you know it's ethically wrong to implement a given solution under a particular set of circumstances, it is not ethically wrong to teach someone about possible solutions that may actually have benefit, either as teaching examples, or usable under other situations.

So, largely, I'm not in favor of downvoting because your system of ethics and surrounding assumptions prohibits it.

But the downvote is yours to do with as you please.

If you truly find it objectionable under all circumstances, though, flag it for moderator attention so it can be deleted.

Answer 2

I like to think of it this way:

It's my vote, and I'll downvote you if I want to.

So yes, if there's anything I don't like about the answer, I might vote it down, whether it is incorrect or merely displeasing to my personal sense of aesthetics.

After all, that's the very nature of the sites: I've accumulated a certain amount of reputation by demonstrating responsibility, and in so doing have been conferred the ability to downvote. The site is trusting me to make these decisions, so I shall do so.

More waxing poetical: I don't actually do this very often; more usually I will just leave a comment "tsk, you shouldn't do it this way!" and leave it at that, because I don't like those little red marks in my rep history. Or, when faced with a series of "correct" answers, I will only upvote the answer that both answered the questions and doesn't do anything evil. My point is that we all have the ability to downvote and we should feel free to use that ability with discretion.

Answer 3

I see nothing wrong with the Script, sorry. It's the sysadmins job that the user can only do what they are entitled do. This script does not do any magic, it just does what any other PHP application could do.

If the user uses this to gain access to stuff they shouldn't have access to, it's the admins fault for not having secured that content properly.

If the user uses this to cause too much load, it's the admins fault because there was no limiting in place.

if the user uses this to shoot himself in the foot - it's the users fault, and you can bill him for support - unless legal screwed up and did not put a proper contract in place.

If the user wants support for it, you're free to handle this using the normal support policies.

Always keep in mind: If something is possible, someone else will know about it. If that person is a black hat, you have a problem. So it's the admins duty to know about stuff that's going on. That answer might actually do admins a favor, because now they know about the existence of this script and can make a security audit: Could it cause you any harm? If yes, how can you properly prevent it? Might be a good ServerFault question by the way.

In my opinion, the border is exploiting security vulnerabilities, that is: "The admin has blocked this script, can I circumvent that?" The answer to that is usually a quick close, downvote, delete, so I think we're fine on that front. (Related: We allow Jailbreak Questions about the iPhone on SU)

Edit: I think this came across a bit harsh, because it was specifically targeted at PHP Shell. PHP Shell is completely harmless in my opinion. It does not give any additional access and does not break the system. If you upload a file that contains the desired System() call, it would work equally well. Unlike stuff like Jailbreaking, PHP Shell is not hacking the system. So in my opinion the correct solution is not to disallow such questions, but rather add a comment or something to let admins know that they can just disable stuff like that in the PHP.ini. Disallow calls to system(), exec() and some other functions and the script stops working - In my opinion, this is the real solution for the problem, rather than trying to pretend it doesn't exist.

Answer 4

I downvote such answers, unless the poster provides a disclaimer, such as "This is the correct answer to your question, but you shouldn't do it because it's evil." Or, "This works, but it will kill kittens, so don't try this at home," or something to that effect.

Here is an example:

Copy on delete of browser history

Note that I didn't downvote the question, although I did post a comment expressing how evil I thought the question was. I also didn't downvote the accepted answer, as it contained a "this is evil" statement.

I did post my own answer explaining my ethical position. It got six upvotes, even though it didn't answer the OP's question, so I guess some people agreed with the ethical position.

Answer 5

I hesitate downvoting "technically valid" answers for the question regardless of morality, lack of warnings about blowing up your system unless the "warning" is a core part of the issue. For example, I would downvote a blatant SQL injection flaw in a question about security. If you don't like an answer, simply don't upvote it, and upvote other answers if they better suit your taste. Downvoting "correct" answers doesn't look fair to me. It's not ethical!

Answer 6

Absolutely! In fact, I relish the opportunity to down-vote answers that suggest things that, while perhaps technically feasible, introduce behaviors that I don't ever want to encounter (as a user or as a developer).

You get one vote, so vote according to your conscience. If you're alone, it won't matter; if you vote with the moral majority then you've helped the community indicate to future readers that this option is unlikely to be acceptable.

Answer 7

I downvoted that particular question but I don't make a habit of doing so to every question that I believe is so wrong it should never have been posted.

With such questions I don't try to impose my personal morality, although it may certainly appear so at times. I look at the question and ask myself, as a professional system administrator, "how would I react if someone did that on my network?".

No it's not a question of morality or ethics, which are at best extremely fluid concepts, it really is a question of professionalism. System administrators who help, and at times even encourage, others to circumvent systems put in place by our fellow system administrators do not deserve a job but do deserve to have the same thing done to them.

Farseeker's reply to my comment was quite frankly way over the top, as it completely ignored context. Context is everything. The question may well be considered perfectly acceptable and receive effective answers elsewhere but it should not have been asked on a site intended for professional system administrators. Even more importantly, it should not have received that first answer.