12

Based on some of the comments here I went and looked at the FAQ again. We've always, as far as I can remember, closed policy subversion questions as Off Topic.

The question that brought this up is this one and it apparently got people interested in it because it's about trying to gain access to servers from within Iran, which by all accounts is a Bad Government which does Bad Things. I don't know, I don't live there, and it's not really topical to the discussion, in my opinion.

However, there was enough interest in it that I went and asked the folks over at Security.SX whether it was a better fit there. I was led to believe it was and so flagged for migration. Whether it's a better fit there may or may not be topical to this discussion, and may need a meta over on Security's side to hash that out.

TL;DR

We've always closed policy subversion as Off Topic, we should explicitly state so in the FAQ.

5
  • BTW Holocryptic - finding a better location for the question and asking them about migration is really cool.
    – dunxd
    Commented Jan 4, 2012 at 17:22
  • @dunxd Thank you. I generally don't like migrating crap and try to avoid it where possible. I'm willing to try to find a home for things that may not belong here, but a lot of times it is also just easier to close things outright.
    – Holocryptic
    Commented Jan 4, 2012 at 17:49
  • 3
    I had to read almost to the bottom before I realised you weren't talking about SVN!
    – Mark Henderson Mod
    Commented Jan 4, 2012 at 20:04
  • @MarkHenderson LOL. I'd say read the TL;DR but that wouldn't help either :)
    – Holocryptic
    Commented Jan 4, 2012 at 20:06
  • 1
    For some reason, my mind kept skipping the word "policy:
    – Mark Henderson Mod
    Commented Jan 4, 2012 at 20:12

7 Answers 7

Reset to default
13

Just my $3.50, indexed for inflation:

Any questions explicitly or implicitly asking about circumventing/violating an institutional or government policy are off topic for Server Fault. Period. Do not pass Go. Do not collect unemployment when fired for cause.

I don't think we need to adjust the FAQ to clarify this -- It is implied in the first line: Server Fault is for system administrators and desktop support professionals, people who manage or maintain computers in a professional capacity…

As a community for PROFESSIONAL system administrators is is not our place to help others break local policy. We may think the policy is stupid. We may suggest that people work with their institution/government/whatever to change the policy, and we may even discuss circumvention techniques in chat/on twitter/on our own blogs, but as professionals addressing other professionals on the main site it is not appropriate for us to advise breaking local policy at someone else's organization, or to assist people asking questions in such activities.

When questions are in a gray area we often ask for clarification in comments. If clarification isn't forthcoming within a few hours (or it becomes obvious the question is about circumvention with no legitimate technical/SA goals) the question gets zotted.

What kind of "policy circumvention" questions might be allowed? I like Shane's example:

"My firewall blocks all outbound HTTP requests due to a policy requirement; how do I get WSUS/package manager to work?"

This question is not "how do I break my company's policy", it is "We have this policy (no HTTP outbound). We also have a business need for this piece of software (WSUS). Can I make WSUS work in the context of this policy, or do we need to craft exceptions?"

What kind of "policy circumvention" questions should not be allowed?

My employer only allows outbound SSH to corporate-controlled sites - What techniques can I use to bypass this block and SSH into my remote machines?
No -- the policy says "No SSH", and you're asking us how to do something your employer forbids. Quite probably for good (legal) reasons.

My employer blocks Facebook. How can I get on Facebook?
No -- C'mon, be serious. What's the business case for Facebook? MAYBE for the marketing department, in which case they can have IT craft a firewall/proxy/blacklist exception for the people who need it.

9
  • 1
    I think there's quite a few people who would disagree that Professionals must abstain from aiding and abetting policy circumvention.
    – Chris S
    Commented Jan 4, 2012 at 19:07
  • I agree that they should be closed, but there seemed to be enough ambiguity that I had to bring this up. If I had to bring it up here, and yet we agree that they should be closed, then a simple one-liner in the FAQ saying "No subversion" is warranted, I think.
    – Holocryptic
    Commented Jan 4, 2012 at 19:30
  • @ChrisS that's why it's just my $3.50 -- When I'm acting in a professional capacity (and as informal as I am on SF I consider it to be an extension of my professional sphere) that's a line I won't cross: I don't want people trying to circumvent the controls in my environment, so I won't help them do it in someone else's.
    – voretaq7
    Commented Jan 4, 2012 at 19:30
  • Your ssh example is a legitimate question (just edit “my employer only allows” to “there is a firewall setting that I can't change”). The second question is not an administrator question but a user question, it belongs on Super User.
    – Gilles 'SO- stop being evil'
    Commented Jan 4, 2012 at 21:37
  • @Gilles I disagree. They both need to be closed. The first is a policy question, and the second is a crap question anywhere.
    – Holocryptic
    Commented Jan 4, 2012 at 21:48
  • 1
    @Gilles - What Holocryptic said. The key difference IMHO is an allowable question immediately reduces to a business reason ("We need WSUS to keep the Windows machines up to date"), where a bad question doesn't (Why do you need Facebook? Why do you need to SSH into things that aren't company systems? -- The question may be OK based on the answer to those clarifying questions).
    – voretaq7
    Commented Jan 4, 2012 at 21:58
  • 1
    @voretaq7 Real life example: a team is spread over several towns, and central IT takes 3 months to open a port. When the answer to these “clarifying” questions is irrelevant to answering the original question, the original question should be answered as is.
    – Gilles 'SO- stop being evil'
    Commented Jan 4, 2012 at 22:02
  • @Gilles Real life example: Company circumvents policy because it causes a "now" problem, auditors come in, discover circumvention, and bust the company in the next audit cycle, leaving them with a much larger problem and a bunch of people who need to be disciplined/fired because of what happened. If you can be fired for doing it odds are you shouldn't be doing it (or you should change the policy), and that should be the answer any professional gives you. Feel free to disagree, but you aren't going to change my mind.
    – voretaq7
    Commented Jan 4, 2012 at 22:49
  • 1
    For the record: I think the SSH question should probably have been allowed to stay. It is not however an exemplar of the larger class of "policy circumvention" questions. It's a special-case exception (and I have no problem with those, but it doesn't change my feeling on the general rule).
    – voretaq7
    Commented Jan 4, 2012 at 22:50
5

Policy "subversion", yeah. Policy "avoidance"? I can imagine some legitimate questions.

"My firewall blocks all outbound HTTP requests due to a policy requirement; how do I get WSUS/package manager to work?"

"Our VPN solution and security policy don't allow split tunneling, but we have an application that won't work. How can I get its traffic to avoid the VPN tunnel and go straight to the internet?"

I guess we should make it clear that we're not here to help end users circumvent policy.. but the FAQ already covers that ("people who manage or maintain computers in a professional capacity").

Is an added FAQ statement likely to avoid some of the "Help me duck my work's internet filters" questions? Unfortunately, I suspect it would not.

8
  • 1
    While people will, of course, continue to post such questions, we can then point to the FAQ and say, "Um, that line right there says you're doing a no-no" and then close it for great justice.
    – Holocryptic
    Commented Jan 4, 2012 at 16:02
  • And the two questions you cite would remain open, as they are legitimate, professional questions.
    – Holocryptic
    Commented Jan 4, 2012 at 16:03
  • My thinking is though, that "people who manage or maintain computers in a professional capacity" may be a bit broad and leave enough wiggle room for just this kind of debate. We should squash it now and be done with it.
    – Holocryptic
    Commented Jan 4, 2012 at 16:04
  • I'm trying to find a legitimate example of "avoidance", but the examples you've provided explicitly break the policy in question, and I'd VTC. Now if your firewall block HTTP, but there's no corporate policy to back that up, then I can see getting around it, as it's a technical problem, not a policy issue.
    – Chris S
    Commented Jan 4, 2012 at 16:19
  • 4
    One can argue that the answer to policy avoidance type questions for a professional sysadmin is "Work with your organization to craft policy exceptions as necessary to support the business" -- If there's no official workaround that's what we seem to suggest (based on a wholly unscientific survey of instances of this sort of question that I've seen personally).
    – voretaq7
    Commented Jan 4, 2012 at 16:20
  • Looking at it again, I think I was wrong in my earlier assertion and agree with @voretaq7 on this.
    – Holocryptic
    Commented Jan 4, 2012 at 17:09
  • 2
    @ChrisS Yeah, that's true - I was looking at it from the perspective of workarounds to technical issues. I can get behind voretaq's assessment, too.
    – Shane Madden
    Commented Jan 4, 2012 at 17:43
  • I'm all for workarounds (that come down to a viable business case) - of course they should be codified as policy exceptions so the auditors don't inflict pain and suffering...
    – voretaq7
    Commented Jan 4, 2012 at 21:24
5

Yes

4

I suggest sticking here to technical issues, as @shane suggests, and note that finding a good written FAQ policy for that may be tricky.

I also think the Security Stack Exchange site is suitable for some of the security-related discussions where there are conflicts between legitimate policy goals, as I've tried to lay out at Conflicting policies, and discussing technical issues involving privacy vs control - IT Security Meta - Stack Exchange

3

Two things spring to mind:

  1. It's adequately covered already because policy subversion is unprofessional (as per Shane's answer).
  2. The people who tend to post those questions show no signs of having read the FAQ anyhow, making it pretty pointless.

Policy subversion/violation questions will continue to be posted, regardless of what's in the FAQ. Leave them to those with voting rights and/or mods to deal with, just as it has always been.

The FAQ should really be a place for concise answers to fairly specific questions (even if they haven't really been asked). The larger it grows the less useful it is. Even the name should be reconsidered, as it's not really an FAQ at all. It's more like a bunch of rules but nobody has the balls to call them that.

1
  • Just because people don't read them, doesn't mean that we shouldn't specify it in the FAQ (or rules, or whatever you want to call them; it's the same thing). It's not like this would be a huge expansive change, and it adds a lot of clarification on what seems to be a contentious point.
    – Holocryptic
    Commented Jan 4, 2012 at 21:52
2

As someone defending the original question here's my tuppence worth:

It doesn't seem to matter what is in the FAQ, as there are enough people with close voting rights that will do what they want anyway, and get their way. Maybe this is fair enough, or maybe 5 close votes is not enough. Who am I to say. Or maybe 10 points should be deducted for each close vote (although 10k+ folk don't care about that).

I've been told I took all this too hard. But it isn't without context. When I originally asked What might prevent IKE handshake success in building an IPSEC tunnel? I got close votes that were explained with the "violates policy arguement" based on the assumption about what I was trying to do that people seem to have made about our friend in Iran - is it relevant that I didn't know if the ISP/country were deliberately trying to block IPSEC? I had to close the question myself and write it again extremely carefully before I got a response that addressed the question, and not the FAQ!

It felt like there were more people on Server Fault willing to explain the rules to me and close my question than there were people who wanted to help or apply technical thinking to the question.

In the end it turned out that the ISP had a misconfigured switch not that they were specifically trying to block IPSEC. I've subsequently discovered exactly the same issue in 4 other ISPs in different countries.

Personally I think the FAQ is fine as it is. Interpreting what is and isn't "policy violation" is not always clear cut, and beyond our own workplaces, not our jobs. I'd prefer to simply choose not to answer a question I disagree with, vote it down, or flag it for moderator attention. Or better yet, as suggested in the FAQ, edit the question to improve it.

3
  • 6
    The fact that you were able to rewrite the question sans policy ambiguities means your question had technical merit in a professional setting. Server Fault is for professional administrators only and there are boundaries to what we should answer based on that professional requirement. It is the community's duty to maintain the community while building a knowledge-base. Suspicious situations will be raised in Questions and for the sake of the professional community it is necessary to question the implications of policy.
    – Chris S
    Commented Jan 4, 2012 at 18:19
  • 5
    Upon further review I seems you're getting pretty frustrated with at least a handful of the community members, and they with you. Perhaps it would be a good idea for everyone to take a breather before someone says something they'll regret. =]
    – Chris S
    Commented Jan 4, 2012 at 18:38
  • 2
    @ChrisS's point is excellent. It's all in how a problem is presented. Tell us what you need to find / do rather than why. The more "whys" that are known, the more likely a post is to be picked apart (regardless of who posts it). Remember, SysAdmin tend to be a "how to think" bunch, and not a "what to think" bunch.
    – Wesley
    Commented Jan 4, 2012 at 22:03
1

I don't see any need to modify the FAQ. Furthermore, the proposed policy change would be detrimental to the site. There are already people who vote to close any question that implies that the asker is not in complete control of policy. This is short-sighted, snobbish, and more than a little silly. It is rather common for a professional system administrator to need to circumvent a restriction put in place by another system administrator (sometimes by policy, sometimes by ignorance). Furthermore, it is nearly impossible for readers to know who is legitimately in charge of setting the policy. Questions should be evaluated on their technical merit alone.

8
  • 4
    If you need to get around something set up by another admin either through policy or ignorance, then the fix is to disable the the restriction, not find a way around it. That's a policy question, not a technical one.
    – Holocryptic
    Commented Jan 4, 2012 at 21:45
  • 2
    @Holocryptic If you've done any system administration in your life, you very well know that sometimes the other administrator doesn't reply, or doesn't know how, or can't be bothered, or is on an extended tour of Antarctica while your users have a customer on their heels with his lawyers on speed dial.
    – Gilles 'SO- stop being evil'
    Commented Jan 4, 2012 at 21:49
  • @Gilles The scenarios that you refer to are extremely few and far between, at least as topics on ServerFault. Secondly, those questions can be rephrased to avoid any explicit mention of subverting existing controls. The Iran/SSH question could have simply been "How can I tunnel SSH out of nonstandard ports?" and in that case it would have been allowable.
    – Wesley
    Commented Jan 4, 2012 at 21:59
  • 3
    "It is rather common for a professional system administrator to need to circumvent a restriction put in place by another system administrator ... by policy" <- No way; I do not, in my professional role as an administrator, deliberately circumvent corporate or legal policy. Circumventing a technical restriction that does not conflict with policy is completely normal, but that is explicitly not what this Question is in regards to.
    – Chris S
    Commented Jan 4, 2012 at 21:59
  • 1
    @WesleyDavid In other words, to get a good answer on Server Fault, you need to lie. Right, that's really professional.
    – Gilles 'SO- stop being evil'
    Commented Jan 4, 2012 at 22:03
  • @Gilles No, in other words, to get a good answer on ServerFault, we don't need the backstory. Just the facts.
    – Wesley
    Commented Jan 4, 2012 at 22:05
  • 1
    @WesleyDavid Hold on, I was the one arguing that “Questions should be evaluated on their technical merit alone”.
    – Gilles 'SO- stop being evil'
    Commented Jan 4, 2012 at 22:16
  • 3
    @Gilles You've got that part right. However, we can't ignore when people reveal more than just the facts. If someone asks a question that's technically okay, but then reveals that it's to do unlawful things, then we can't ever come under the shadow of suspicion concerning helping people break laws or rules. Even if those laws are made by entities that we may completely disagree with. =/
    – Wesley
    Commented Jan 4, 2012 at 22:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .