7

I've come across a few questions where the user asks something like, "How do I set up a server when the IT department won't let me?"

Usually the questions are asked by a relatively inexperienced user. They usually require more of a "how-to" than a detailed analysis of a security flaw.

In this discussion, some people felt that vulnerabilities should be openly discussed, and I agree. I don't think that there should be any censorship based on the idea of obfuscation.

However, I think that when it is clear that an inexperienced user is seeking to circumvent IT Policies in a way that may be harmful or dangerous to that person or that person's company we should close the question. I think that as a community of system administrators we owe it to each other to set a good example for IT Users.

2
  • 3
    The quickest way to deal with these is to flag as off topic as they are circumventing security policy.
    – user9517
    Feb 8, 2011 at 22:03
  • 2
    @Iain, who's security policy? Your's? Mine? Where I currently work we don't even have any formal IT policies, so there are none to be circumvented. That however doesn't mean I condone such actions. Feb 9, 2011 at 11:33

5 Answers 5

5

We already do... mostly. The only thing I've seen linger are questions concerning "legitimate" hacking (like a user who forgot the password on their home computer or similar). Even those tend to get a response similar to "there's plenty of sites out there with directions on breaking into Windows, we don't need it here too".

If it's suspiciously or obviously against company policy, I do my best to shut them down immediately. The others I'm still against as it's rare for a SA who follows best practices to have to engage in any questionable behaviors.

On the topic of exploit analysis (white hat), that's a security professional's field, and the reason IT Security has it's own site.

1
  • 1
    And even on IT Security - if there isn't a white hat angle we tend to close.
    – Rory Alsop
    Jan 22, 2012 at 21:27
5

Flag the question for moderator attention and they will be closed as off-topic

4

The very question "How do I set up a server when the IT department won't let me?" tells me that the person asking doesn't fit the intended SF user base, so is off topic on those grounds already. I vote accordingly unless there is some really strong redeeming quality in the question that makes it worth keeping.

On the topic of ethics, yours and mine might be the same, or they might differ markedly. That doesn't mean either is "right" or "wrong", other than for each individual. Ethics and morals are variable from place to place and person to person. We can judge according to our own but have to consider that others may well see things very differently. It therefore follows that this is an area we need to tread carefully.

1
  • 1
    +1 - the question is not off topic because of its ethics, it's off topic because the person is not an IT professional, and thus this is not the place for them to be asking anyway. Feb 9, 2011 at 2:39
2

We had a great example of this happen yesterday. We had a user come on and ask how to use a VPS to bypass a school firewall. The question got mod-flagged, and was earning close-votes, got closed, and while I was sleeping another mod deleted it. We're pretty good about the obvious, "how do I bypass security policy at [school|work]?" questions.

One change-up to discussing vulnerabilities etc. is the existence of security.stackexchange.com, where some of that stuff is decidedly topical. We do shovel the odd question that way.

1

It seems very rare to me that these questions getting asked are actual system admin questions. If the question is purely end-user I tend to vote to close.

In the few cases it system admin related, the questions seem to come from someone working for huge-mega-corp that has an IT so large, that they forget to pay attention to special situations that some departments or groups within the organization that need to get things done. In some ways this is the same debate as 'giving admin access to developer workstations', and 'giving developers access to production', but in this case the system administrator in question has been given the task of making something work, but policy prevents them from actually doing it.

If the question is very focused on the system administration side of things I almost certainly will answer it. I don't care to much about the policies of huge-mega-corp. The answer I provide that may break one organization's policy today, may be a perfectly valid answer to some other person's real non-policy breaking question tomorrow.

2
  • I think the megacorp justification is a slippery slope. Who's to say that one IT Department's policies are not worth following? I do agree with the idea that if it's a sysadmin question it should be answered.
    – SLY
    Feb 8, 2011 at 23:12
  • @SLY, I am not saying they are not worth following, I am saying that if someone asks a good question directly related to system administration, a local policy is irrelevant from my point of view. I like solving technical problems, a poorly setup firewall or security system, sometimes may be a legitimate technical problem that you have to work around.
    – Zoredache
    Feb 9, 2011 at 0:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .