Why is there a separate forum for IT security questions?

Question

It seems to me that the new IT Security site and Serverfault are very thinly sliced and might create confusion in its shared users about what kind of questions go where. For example, the question "How do I secure my $OS webserver?" is clearly a question about security, but it is also a question and a topic which systems administrators are likely to ask about and likely to have experience with - and thus belongs on both the IT Security site and on Serverfault.

Is there a way to more clearly clarify which questions should go where? Do you think that the two sites should be merged together, and/or one absorb the other?

Answer 1

IT security is about more than even a broadly defined System Administrator would get into. Yes, there is a lot of overlap. Unlike 'Webmasters' where they've drawn a line enough down the middle to carve out a goodly hunk of non-SA webmaster space, the 'Security' site hasn't quite gone that far yet.

IT Security has a very significant business process component that's generally off topic here. Yes, System Administrators generally get tasked with the "make it happen" projects, but may not be included in the "what should we do" project. Building an Acceptable Use Policy for a company is not one most SA's would get involved in, but is decidedly topical for security.se.

There is enough divergence in topic area that they do deserve separate areas. Assuming security.se takes off, managing the overlap is something that'll cause us a lot of meta-debate.

Answer 2

For one thing, there is an entire profession of security specialists, just like there is an entire profession of system administrators.

Would you also argue that skiiers and snowboarders should share the same site, because they both go downhill really fast on snow?

Different professions, different cultures, different areas of expertise.

Answer 3

There is no question that topics overlap. Further, many of us wear more than one hat, sometimes very many more. For those of us who are also involved in the management side of things a question such as this one may well be relevant to our jobs but it's not a system administration issue.

Let's take things just a little further. As part of my job as a sysadmin (I'm the entire IT "department") I also write code, so should I post code questions to SF? No, they belong on SO. I also change the paper towels in the gents (because everyone else is just too lazy to do it). Should a question about a jammed towel dispenser be posted to SF? I suspect not.

Equally, I doubt those on the security site really want questions about how to best create a set of firewall rules to implement the policies formulated by management.

If you are one of those who's job takes in more than one of the fields covered by the different sites you simply have to get involved in each of them.