Should you answer against best practices just to answer the question?

Question

I've come across a few questions recently where I've been torn between two moral decisions.

The first of which is to answer the question as per the standard best-practices (e.g. You should not circumvent the sudo password prompt just because it's easier).

The second is to actually answer the question, but with a "this is the wrong way" caveat - e.g. Yes you can circumvent the sudo password prompt, and here's how, but you really shouldn't."

I guess it all comes down to how highly we value the "correct" answer. When we answer a question, are we duty-bound to enforce the "right" answer, or just provide a solution to a problem?

Answer 1

IMO, I think the solution is to do both (having just looked at the... question in question.)

It is possible to both give the technically correct answer and advise against it either in the comments or in the answer itself. Sharing experience with others is one of the great benefits of this site and the StackExchange format.

Furthermore, this is a community of all skill levels and some that are newer to the profession may not fully understand the risks of some decisions, and we can use this as an opportunity to teach without being condescending.

Answer 2

For me, it depends on the question and how strongly I feel about it. Which is, obviously, subjective.

• No big deal, but technically not the most AWESOME approach: only mention it in passing, if at all.
• Wince-worthy: Here's how, but you shouldn't.
• OMG NO: Either don't answer, or say, "You shouldn't," and explain why not.

Or, for things that are not really subjective:

• Illegal/circumventing employer/etc.: Vote to close, with or without comment.

Answer 3

The thing about Best practice is that whilst there should by (reasonable) definition be only one for any $practice , in reality everyone has their own. What you consider best practice I may not and vise versa.

If, in your example it truly was 'Best Practice' to not use the NOPASSWD: then surely the 'best' thing to do is not provide it ? It has been provided, it can be (ab)used so why not just tell someone how to use it and let them decide?

If (as you did) you feel strongly about it then sure tell them it goes against good practice.

When all is said and done they're an IT Professional and should be able to assess the risks themselves.

Answer 4

TL;DR:

Do whatever you think is best. Try to inform people, especially if that means diving into non-standard areas of knowledge. Social entropy will eventually succeed in eroding any value we hope to contribute to the community, as its all a self-digesting engine of egocentric altruism anyway. So do whatever you think is right, because haters are gonna hate anyway, especially in a rate-rank place like this.

Long version:

As SO sites mature eventually the topic police evolve to the point where your question becomes irrelevant. That is to say, any answer (or question) not congruent with a few folks' opinion of un-opinionated, on-topic, standardish answers will be beaten as flat as the surrounding terrain.

Now that there are a million SO sites which nearly all experience at least some topical overlap it is virtually guaranteed that any non-standard discussion will eventually get wiped.

(Even if this is far in the future, like this classic, community-rallying answer which has been closed and is now considered off-topic, only retained because it is a significant traffic booster for the site: https://stackoverflow.com/questions/1732348/regex-match-open-tags-except-xhtml-self-contained-tags/1732454#1732454)

Please understand there is nothing in the above that should be taken as bitter or spiteful -- this is just part of the ongoing, roiling, broiling, unsettled, hilariously misguided nature of our community.

Answer 5

I personally would answer the question suggesting they read the best practice first; then link to a best practice reference.

Note: I wouldn't answer any question that I believed was aimed at breaking the law or harming people

For example I would use the sans institute password policy ( http://www.sans.org/security-resources/policies/Password_Policy.pdf ) in reference to setting a null password.

However if I can't find a best practice reference (from a decent authority) then I might be the one that is wrong and I need to read up before I answer that question.