Ethical Questions About Hackers, Cheaters, and Lusers

Question

Sometimes the questions asked here are related to the following three categories ...

Hackers

Yes, yes, I understand there's a fine line between a competent (grey hat) hacker and a sysadmin. But I can't help the feeling that sometimes people come here looking for malicious advice ...

Cheaters

While this is not as prevalent on serverfault as it is on stackoverflow, I've seen a few questions that are obviously homework questions. Students looking to crowd-source their homework.

Lusers

Those few users who feel the need to purposefully circumvent configuration and security controls("Because I need to be more productive!"). And then blame their broken systems on their sysadmins. I've been noticing many questions about proxies, tunneling, and dual-homing systems, where the questioner has no idea about the network equipment being used.

How do you decide to answer suspicious questions?

What ethical responsibilities do we have as a community?

Are there questions that shouldn't be answered?

Answer 1

Here's my 2 cents (maybe less depending on if you agree with me)... ;-)

Hackers -- I'd rather see the "malicious advice" posted here in the open for ALL sysadmins to see than one some deep dark secret haxor board that only a handful of troublemakers know about.

Cheaters -- My mommy told me cheaters never win. Boy was she wrong. ;-) That being said, I can't say I personally care TOO much about someone trying to crowd-source their homework. They can't crowd-source their exams... so... if the crowd gave them answers to help them better understand the subject, so be it. If they didn't understand, then look on the bright side... at least their learned the basic steps of OUTSOURCING... let's make those people MANAGERS. wicked grin

Lusers -- This kinda goes back to the whole "Hackers" thing. I too have seen questions about getting around proxy servers, etc. On the same note, I've also seen questions from sysadmins who have REALIZED the system is being circumvented and are asking for ways to lock it down harder/better. I think its a win-win personally. I'm not a big fan of "pretending" a vulnerability doesn't exist.

How do you decide to answer suspicious questions? -- I answer the ones I feel are worth answering... which is most of them that I feel I can contribute a good answer to. REMEMBER, the answer isn't just for the poster... its for the community as a whole and for future sysadmins that may stumble upon the question weeks or even months from now.

What ethical responsibilities do we have as a community? -- Well I wouldn't post something that is completely damaging, such as a zero day exploit. Other than that, knowledge is knowledge. Most of the answers here can be found elsewhere on the internet... its just easier and more convenient to have them all in one place. That place is ServerFault, StackOverflow, etc.

Are there questions that shouldn't be answered? -- Within reason, no. I personally wouldn't respond to a question like, "I'm trying to hack www.example.com, can someone out there give me tips?" or "How do I attack www.example.com?" or something clearly malicious.

Answer 2

Adrian has a point ... perhaps meta is a better fit. This has certainly been discussed there, and on stackoverflow. But it's here and so am I!

My take ..

1- I answered the homework issue on meta. I am not concerned about whether a question is homework, work-work, hobby work, or curiosity. I am more concerned that the question displays some thought and effort. I don't want to do anyone's work for them, whatever kind of work it is. I want to help them get past issues so they can do their own work.

2- I generally presume the best about people until they demonstrate otherwise. If I can contribute to a question, I do. Many questions can have bad intent .. for instance there have been questions here about scripting robocopy or rsync. Those could certainly be used to steal corporate data. But we presume good intent.

3- I suspect the real answer to the "ethical question" conundrum is the Potter Stewart formulation .. I can't explain what makes an unethical question, but I know it when I see it!

Answer 3

As long as specific information (like passwords) aren't being handed out, we should give good answers for all the NON-hackers/cheaters/lusers.

Answer 4

Meta is a better place, but to answer this question: This is why we have the up and downvote buttons. If you think the question asker is a cheater, hacker, etc - then downvote the question.

If someone has a homework question - as long as they are looking to get an explanation of the problem, I am totally OK with leading them through the answer. If they just want the answer or number, then I will ignore or downvote them, as this question is not useful to the community.

Answer 5

I have received alot of help here and I try to give out good advice. Sometimes I will point the questioner in the right direction instead of directly answering their question if I feel like the question isnt exactly legit.

Answer 6

If the question is interesting and I have an answer, I answer it.

I do not see the value of reading tea leaves and passing judgement on the moral/ethical motivation of someone based on a few lines here.

Answer 7

The kinds of questions you mention are good news for me, as an overburdened smalltime sysadmin.

• It's great to get this kind of insight into what my users may try to do.
• Posted answers give me additional insight by pointing me toward vulnerabilities and workarounds I need to double-check and/or close up.

It can't be said often enough. Security through obscurity is garbage. If we think our networks are secure because our users are too stupid to cause damage, we're in for a world of hurt. Censorship (even self-censorship) is not the answer.

I like to think there's a reason this issue isn't addressed in the SF rules or FAQ. Can of worms, if nothing else.

Scenario: if one person decides a question is malicious in intent, and he feels he's responsible for keeping the information in that helpful answer out of our cracker's hands, how far would/should he go to remedy that problem? Delete answers? That's 12 kinds of terrible to my way of thinking.

Answer 8

It's not the gun that kills, it's the person who pulls the trigger.

Where I can provide a meaningful answer, I will provide it, sometimes with attached warnings (if it is obvious that somebody is trying to do something they shouldn't be doing) or pointers to more documentation (if it is obvious that the poster hasn't got a clue). In any case the information given can always be obtained by anybody with enough curiosity, and as such I am not causing any harm.

If that information is abused, then it is the abuser who is to blame. If somebody gets his homework done here, well (s)he will fail in the real world very soon.

Answer 9

• For me it depends on the question. The funny thing is that answers existed and have been available by doing a search before serverfault and friends existed on the web :)

• As a "community"....none. We are large group of people gathering in the same virtual space. We have no responsibility "as a group". Each is responsible for their own actions etc. (At least that's what I think my lawyer would like me to say) - Before we have someone suing "the users of an online community" wholesale as a group.

• Yes. But when you know the answer it's hard not to blurt it out. That's why someone once said "with knowledge comes responsibility" - [ and if someone knows who that was, add it as a comment]

Answer 10

I don't think you should give it much thought, but rather, go with your gut. You can always chose to:

• If you sure this malicious, down vote it. If you have the power to cast a vote to close, do so. It will take 4 others to agree with you.
• If you are unsure, just ignore the question if it makes you uneasy.