10

SF is for professionals and I think we'd all agree that part of being professional is to act within our various laws and also within a general moral code when doing our jobs.

Every now and then I see questions or answers on SF that are either outright illegal (copying software for profit) or morally dubious (I personally won't help people trying to 'pass off' as other sites for instance - https://serverfault.com/questions/279807/one-of-site-i-have-host-is-not-accessible#question).

How should we deal with this kind of thing? Obviously one man's immoral is another man's acceptable but I'm wondering if we could at least agree a list of things that we just won't accept and what action to take, what do you think?

2
  • 1
    fine, so long as it's based on "things that actually happened on Server Fault" and not "everything we might imagine could happen on Server Fault.. eventually.."
    – Jeff Atwood
    Commented Jun 13, 2011 at 10:22
  • 1
    I'm sure no one is suggesting that answers that could enable someone to break the law should be banned from the site. Would it perhaps be better to rewrite questions that directly seek info on how to do something illegal?
    – dunxd
    Commented Jun 24, 2011 at 9:03

5 Answers 5

Reset to default
5

There are times when I wish we had a close reason of, "That's illegal."

For questions where someone is being excessively cheap (piracy/licensing) or working around a clearly unreasonable IT department (ahem), a mod-hammer of Too Localized, followed by a Commment by the hammering mod explaining that such is not tolerated here, and then finish by locking the question. Some things are meant to be cut off at the knees, and in my opinion questions like these are on that list.

For questions surrounding more intentional misbehavior such as the linked click-jacking question, or the few gray-hat questions we get ("How do I MITM DNS?"), those get closed real fast and usually deleted and are already being handled correctly. True, even bot-herders need sysadminly skills, but that's not ServerFault's target-market.

Perhaps we need to modify our FAQ to make clearer that we're focused on ethical System Administrators, and then come up with something to define 'Ethics'.

6
  • 1
    I don't think we need to modify the FAQ those of us that vote all sing from the same sheet already.
    – user9517
    Commented Jun 14, 2011 at 8:55
  • If we're adding close reasons, I'd like to make it "Likely to be illegal, or dangerous". As well as questions I feel conflicted about from an ethical or legal viewpoint, I've also seen ones that I thing might be dangerous, e.g. the 'fridge as a rack' question - water and electricity don't mix!
    – Rob Moir
    Commented Jun 15, 2011 at 13:32
  • 2
    I'd like to see the a small addition to the FAQ under the kind of questions not to ask, bullet 6: "the answer involves circumventing licensing, corporate/network policy, or applicable laws".
    – Chris S
    Commented Jun 20, 2011 at 1:21
  • 2
    Why would you close gray hat questions? And no, you're not going to find a definition of ethics. @Robert fridge as a rack definitely deserves a safety warning, at least as a comment if not an edit; there's no reason why it should be deleted.
    – Gilles 'SO- stop being evil'
    Commented Jun 21, 2011 at 19:23
  • Illegal under what jurisdiction? What if X is illegal in country A but legal in Country B?
    – hlovdal
    Commented Aug 14, 2022 at 12:03
  • @hlovdal This is why we don't have that close reason, in spite of me occasionally desiring otherwise. US-centrisim is rife in the tech industry, we don't need to contribute to it.
    – sysadmin1138 Mod
    Commented Aug 16, 2022 at 22:53
4

It's obviously not possible to come up with a definitive list of immoral or illegal questions. I typically just implement a "sniff test" of sorts. If a question smells a bit fishy, I just trust my intuition and vote to close. I think most of us can get a good read on the motives of the OP from reading the question itself or by gauging the OPs responses in subsequent comments/discussion.

Here are a few general categories that I feel should be subject to the mod hammer:

  • licensing violations or piracy
  • questions on how to subvert IT policy of an organization
  • nefarious "hacking" type activities - brute force, DoS/DDoS, WiFi cracking, etc.
  • anything else that doesn't pass the sniff test
7
  • 3
    A “sniff test” is not a proper way to judge posts. Apply the mod hammer on licensing violations? Ok, if you're sure they're licensing violations: are you a lawyer? in the asker's juridiction? Did you review this particular license? If you didn't, you're not in a position to reject the question. (You're free not to answer, of course.) Subverting IT policy? That's a pretty common job requirement in my experience.
    – Gilles 'SO- stop being evil'
    Commented Jun 21, 2011 at 19:26
  • 1
    @Gilles, you're free to disagree, but you'll find that most of the mods and frequent contributors will agree with 100% of what I said. There are times when something about a post just doesn't seem right - perhaps when the OP doesn't appear to be giving the whole story. In an ideal world we'd be able to assume that everyone has good intentions, but unfortunately that's not the case. The mission of this site is to promote and encourage good systems and network practices - when something doesn't adhere to that, it needs to get closed.
    – EEAA
    Commented Jun 21, 2011 at 19:38
  • 2
    Yes, I do know I'm outvoted. But it would be unethical for me not to speak up when the majority is doing something that's wrong, both morally and practically.
    – Gilles 'SO- stop being evil'
    Commented Jun 21, 2011 at 19:44
  • 3
    @Gilles, I fail to see how keeping away from legally questionable topics is morally or practically "wrong". I don't 100% agree with Erik, but disagree that we should get lawyers involved to determine the legality of a question before closing it. Who's being impractical now?!
    – Chris S
    Commented Jun 21, 2011 at 19:59
  • 2
    @Gilles, you're forgetting that SF is essentially a community driven site and the community collectively makes decisions that affect the site. As most of us take the concept of professionalism pretty seriously we see only harm in allowing questions that conflict with that view. Sometimes it's not enough to just ignore those questions that we find offensive, we need to actively cull them to try and maintain a site that we feel comfortable using as part of our toolkit as professional admins.
    – John Gardeniers
    Commented Jun 22, 2011 at 2:19
  • 1
    What about system security???? I have definitely asked questions about subverting security to test my servers! I also could easily imagine IT themselves attempting to subvert IT. Should we make those cases explain themselves, who the hell are we other than sysadmin?
    – J. M. Becker
    Commented Sep 29, 2011 at 17:11
  • 1
    If something is 100% illegal if performed as stated, I can see the point. Things that "Might" be illegal if performed, should be given the benefit of the doubt. More importantly, I personally, believe if something is not illegal for serverfault to publish, it should slide. Knowledge itself is w/ exception not illegal, I assume I don't need to provide the legal interpretation of the first.
    – J. M. Becker
    Commented Sep 29, 2011 at 17:17
4

I really don't think we need a defined list of things to ban. I think if we simply continue along the road we've taken and we each use our own discretion things will be just fine.

When I first joined SF I got involved in some "discussions" where some members didn't think I, and we in general, had the right to judge what others should and should not post. I'm happy to say that it appears to me that the moral/professional standard is now significantly higher and unprofessional questions regularly get killed off through the normal voting process.

2
  • A couple of times now I'll run across a question with two flags and four close votes by the time it gets on my mod-radar. That's fast work.
    – sysadmin1138 Mod
    Commented Jun 14, 2011 at 1:46
  • @sysadmin1138, some of us don't stuff about when it comes to closing those ones. ;)
    – John Gardeniers
    Commented Jun 14, 2011 at 2:22
4

If you're absolutely sure that something in a question or answer is illegal, go ahead and refute or excise it. But always give people the benefit of doubt. And remember that different locales have different laws, software licenses sometimes contain unenforceable provisions, IT department policy isn't always the same as company policy, etc. And keep in mind that you can't design a secure system without constantly being thinking of how you might break it. And note that bad guys have security too; sometimes it's the good guys who escape prisons.

This is a technical site, not a site about law or ethics. Bringing them into the discussion is very likely to start sterile arguments. Keep it on-topic.

21
  • 5
    We're not the government, we don't have to assume innocence until proven guilty. If the questioner doesn't like it, they're free to find another website. This is a professional site before technicalities, process and procedure is at least as important as technical capability.
    – Chris S
    Commented Jun 21, 2011 at 20:01
  • 6
    While morals and ethics are fluid concepts at best, professionalism demands a degree of honesty and integrity that makes some questions and answers unacceptable. e.g. Asking how to break into someone else's system is unacceptable, no matter what the local laws and customs are.
    – John Gardeniers
    Commented Jun 22, 2011 at 0:57
  • Is there an example of when someone asked to break into someone else's system, or is all this theoretical?
    – dunxd
    Commented Jun 24, 2011 at 11:42
  • @dunxd, I can't find an example right now but that question most certainly has been asked more than once.
    – John Gardeniers
    Commented Jun 27, 2011 at 2:22
  • 1
    @John Gardenier, you forget that breaking in someone's else system sometimes is considered a profession.
    – J. M. Becker
    Commented Sep 29, 2011 at 17:23
  • @Chris S, we should be able to have those "process and procedures" defined. Even if I don't like the answer, I'd want it from serverfault.com or stack exchange. what is acceptable and what is not, and what to do about it, should be clearly defined. Personal opinions from the community, and self righteous moderators, are just opinions. I don't believe, because you have reputation for providing quality answers, you should get to decide "process and procedure". moderating in general is done for the benefit of site. the site needs to define what that benefit looks like.
    – J. M. Becker
    Commented Sep 29, 2011 at 17:32
  • I'd except any official answer, even if the answer is 100% the discretion of the moderating community. It seems it would serve everyone the best to have something explaining. I appologize for any misunderstanding, I might not understand how this whole stackexchange thing works. Which again could be served best by having something about it in the FAQ. (which I have read, and IMO is lacking on the flagging and bad answer section)
    – J. M. Becker
    Commented Sep 29, 2011 at 17:40
  • @TechZilla, we're not concerned with the technicality that someone might consider breaking into someone else's system a profession. The vast majority would agree that such activities are not ethical and material describing how to do so is therefore not welcome on SF. Each SE site has it's own administrative/moderator teams, there might be some overlap, but it's not really intentional. You seem a bit confused, you start with "Personal opinions from the community .. are just opinions" then go on to "the site needs to define [the] benefit". So do you want the community's opinion or not?
    – Chris S
    Commented Sep 29, 2011 at 18:13
  • Further, if you feel you have been victimized by a moderator you are free to e-mail contact the SE team (contact us link at the bottom of every page) for their review. I'll mention that some users have felt this site should be a free for all in the past; some of them have been blocked and the rest all left. Each SE site focuses on a specific group of people, not the public at large. The goal is not to be all inclusive...
    – Chris S
    Commented Sep 29, 2011 at 18:24
  • 1
    @Chris, regardless of anyone's opinion, systems security is not a "technicality". Systems People have been fired over break ins, and need to know the threats out there. In general you would hire a security auditor, but the fixes all fall on us.
    – J. M. Becker
    Commented Sep 29, 2011 at 18:39
  • 1
    @TechZilla I'm not sure I follow. Discussion security vulnerabilities is not the same as telling someone how to break into a system. The former is a welcome aspect of system administration. The latter is the gray/black area we don't deal with. A good example is the Apache Range vulnerability; it's good to know what versions are vulnerable, and workaround to patch them. It's not acceptable to post a script (or even to describe how it would work) to exploit a vulnerable server.
    – Chris S
    Commented Sep 29, 2011 at 18:42
  • and what I meant about "personal opinions"... I did not (and still don't) care about any given individual's feeling about this subject. It does not answer the question. Who decided to make this site called "serverfault", was it the community? Who decided it was for professionals? You really can't deny that certain security questions are related to our profession.
    – J. M. Becker
    Commented Sep 29, 2011 at 18:45
  • I'm not talking about the guy who states his illegal intention of subverting servers he doesn't administrate. I'm talking about the person who is trying to secure servers, and understand what is out there, to better protect themselves. One person's actions would be legal, one would not.
    – J. M. Becker
    Commented Sep 29, 2011 at 18:48
  • 2
    @Chris: In addition, who really has never been victimized by a self righteous mod before? mabey not here, but elsewhere. they exists, they always will exist, and we should at least try to protect discussions that are legal if put to action.
    – J. M. Becker
    Commented Sep 29, 2011 at 18:49
  • 2
    Just knowing what version of what software is vulnerable, does not address less common situations. Sometimes it is necessary to discus the how to. For example if you want to prevent exploits with mod-security rules, or .htaccess. Patches sometimes show up too late. Sometimes you can't upgrade software (I've been there, for a slew of reasons) I can understand not giving a tutorial for script kiddies, but we should be able to deal with them appropriately. If it seems fishy, it may be. I'm just saying we shouldn't be closing any topics about such subjects without context.
    – J. M. Becker
    Commented Sep 29, 2011 at 18:59
0

Most questions can be rephrased to sound innocent - for example, rather than asking "how do I copy software?" you could ask "how do I prevent copying software?". The answer to the second form of the question goes a good way to answering the first. There is no way of knowing the intent of the questioner with this kind of question.

Only answers which are likely to put the site in disrepute or in conflict with the authorities where it is hosted should be removed. Individuals are free to move on to questions they don't have a problem with, or vote down, or to close, questions they don't like the look of.

I just asked a question about troubleshooting IPSEC. An answer to that question could be used to find out why IPSEC isn't working. The same information would be useful in circumventing a block in countries that have that sort of regulation in place. If answers of that kind were to be banned, then this site would cease being useful.

2
  • I'm struggling to understand how you see an attempt to get around a block of IPSEC as anything but an attempt to get around a block of IPSEC, no matter how you word it.
    – John Gardeniers
    Commented Jun 23, 2011 at 0:35
  • 2
    @John dunxd's point is that an attempt to get around a block of IPSEC is not intrinsically unethical or unprofessional. It's an attempt to get around a block of IPSEC, no more. As such, it should not be censored.
    – Gilles 'SO- stop being evil'
    Commented Jun 23, 2011 at 19:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .