An ethical obligation to not answer questions seeking to circumvent IT policies?

Question

I've come across a few questions where the user asks something like, "How do I set up a server when the IT department won't let me?"

Usually the questions are asked by a relatively inexperienced user. They usually require more of a "how-to" than a detailed analysis of a security flaw.

In this discussion, some people felt that vulnerabilities should be openly discussed, and I agree. I don't think that there should be any censorship based on the idea of obfuscation.

However, I think that when it is clear that an inexperienced user is seeking to circumvent IT Policies in a way that may be harmful or dangerous to that person or that person's company we should close the question. I think that as a community of system administrators we owe it to each other to set a good example for IT Users.

Answer 1

We already do... mostly. The only thing I've seen linger are questions concerning "legitimate" hacking (like a user who forgot the password on their home computer or similar). Even those tend to get a response similar to "there's plenty of sites out there with directions on breaking into Windows, we don't need it here too".

If it's suspiciously or obviously against company policy, I do my best to shut them down immediately. The others I'm still against as it's rare for a SA who follows best practices to have to engage in any questionable behaviors.

On the topic of exploit analysis (white hat), that's a security professional's field, and the reason IT Security has it's own site.

Answer 2

Flag the question for moderator attention and they will be closed as off-topic

Answer 3

The very question "How do I set up a server when the IT department won't let me?" tells me that the person asking doesn't fit the intended SF user base, so is off topic on those grounds already. I vote accordingly unless there is some really strong redeeming quality in the question that makes it worth keeping.

On the topic of ethics, yours and mine might be the same, or they might differ markedly. That doesn't mean either is "right" or "wrong", other than for each individual. Ethics and morals are variable from place to place and person to person. We can judge according to our own but have to consider that others may well see things very differently. It therefore follows that this is an area we need to tread carefully.

Answer 4

We had a great example of this happen yesterday. We had a user come on and ask how to use a VPS to bypass a school firewall. The question got mod-flagged, and was earning close-votes, got closed, and while I was sleeping another mod deleted it. We're pretty good about the obvious, "how do I bypass security policy at [school|work]?" questions.

One change-up to discussing vulnerabilities etc. is the existence of security.stackexchange.com, where some of that stuff is decidedly topical. We do shovel the odd question that way.

Answer 5

It seems very rare to me that these questions getting asked are actual system admin questions. If the question is purely end-user I tend to vote to close.

In the few cases it system admin related, the questions seem to come from someone working for huge-mega-corp that has an IT so large, that they forget to pay attention to special situations that some departments or groups within the organization that need to get things done. In some ways this is the same debate as 'giving admin access to developer workstations', and 'giving developers access to production', but in this case the system administrator in question has been given the task of making something work, but policy prevents them from actually doing it.

If the question is very focused on the system administration side of things I almost certainly will answer it. I don't care to much about the policies of huge-mega-corp. The answer I provide that may break one organization's policy today, may be a perfectly valid answer to some other person's real non-policy breaking question tomorrow.