17

I've come across a few questions recently where I've been torn between two moral decisions.

The first of which is to answer the question as per the standard best-practices (e.g. You should not circumvent the sudo password prompt just because it's easier).

The second is to actually answer the question, but with a "this is the wrong way" caveat - e.g. Yes you can circumvent the sudo password prompt, and here's how, but you really shouldn't."

I guess it all comes down to how highly we value the "correct" answer. When we answer a question, are we duty-bound to enforce the "right" answer, or just provide a solution to a problem?

  • 10
    I've struggled with the same decision in the past, and have drawn my own line as to which situations I believe are acceptable to do the "wrong" thing. I believe people should do the same for the most part. There's no universally recognized delimiter. – Chris S Mar 2 '14 at 14:39
  • 4
    The basic line is to not insult the person who ask the question because this is not a thing you would do. People ask for advice, not judmental posturing. The best way to promote your best practices is to explain why it should not be done and / or the correct workable alternative. – Olivier S Mar 4 '14 at 19:56
  • 1
    @Olivier: In all honesty, I've never had anyone react as badly to an answer as you have. I still don't see anything wrong with the original answer that you took offence to. The question was asked, and I posed a valid, reasoned answer. Whether it was "posturing" as you described it is your subjective opinion. If you think that it's inappropriate, please do feel free to use the tools at your disposal (namely the flag button) to raise it for moderation. The community (thankfully) does not take the word of one person to be gospel - that's why we vote, and you're entitled to your opinion. – Craig Watson Mar 4 '14 at 23:17
19

IMO, I think the solution is to do both (having just looked at the... question in question.)

It is possible to both give the technically correct answer and advise against it either in the comments or in the answer itself. Sharing experience with others is one of the great benefits of this site and the StackExchange format.

Furthermore, this is a community of all skill levels and some that are newer to the profession may not fully understand the risks of some decisions, and we can use this as an opportunity to teach without being condescending.

  • 7
    On one occasion (since migrated to SuperUser), someone was trying to expose /root/.ssh on a local VM to another system. After cringing at the thought of the question getting a serious actual answer, I decided to answer it so that I could control the environment in which the information was introduced. You know, sorta like introducing your teenager to beer or cigarettes before their friends do. – Andrew B Mar 5 '14 at 4:07
  • 1
    I agree. I feel that the 'why' of the answer is as important as the answer itself. This is true for both right (why it is right) and wrong (why it is wrong) answers. This pattern tends towards longer answers, but that doesn't seem to be a problem here. – Slartibartfast Mar 13 '14 at 5:31
8

For me, it depends on the question and how strongly I feel about it. Which is, obviously, subjective.

  • No big deal, but technically not the most AWESOME approach: only mention it in passing, if at all.
  • Wince-worthy: Here's how, but you shouldn't.
  • OMG NO: Either don't answer, or say, "You shouldn't," and explain why not.

Or, for things that are not really subjective:

  • Illegal/circumventing employer/etc.: Vote to close, with or without comment.
7

The thing about Best practice is that whilst there should by (reasonable) definition be only one for any $practice , in reality everyone has their own. What you consider best practice I may not and vise versa.

If, in your example it truly was 'Best Practice' to not use the NOPASSWD: then surely the 'best' thing to do is not provide it ? It has been provided, it can be (ab)used so why not just tell someone how to use it and let them decide?

If (as you did) you feel strongly about it then sure tell them it goes against good practice.

When all is said and done they're an IT Professional and should be able to assess the risks themselves.

  • 4
    In general, if I'm asking something, it's because I know what I want to do, and why I want to do it. – Tom O'Connor Mar 3 '14 at 12:26
  • @TomO'Connor Depends. Many people are facing a/the XY problem... – glglgl Mar 14 '14 at 14:03
  • 1
    Oh, possibly, but I'm experienced enough to know what I want to do, and why. – Tom O'Connor Mar 14 '14 at 20:01
1

TL;DR:

Do whatever you think is best. Try to inform people, especially if that means diving into non-standard areas of knowledge. Social entropy will eventually succeed in eroding any value we hope to contribute to the community, as its all a self-digesting engine of egocentric altruism anyway. So do whatever you think is right, because haters are gonna hate anyway, especially in a rate-rank place like this.

Long version:

As SO sites mature eventually the topic police evolve to the point where your question becomes irrelevant. That is to say, any answer (or question) not congruent with a few folks' opinion of un-opinionated, on-topic, standardish answers will be beaten as flat as the surrounding terrain.

Now that there are a million SO sites which nearly all experience at least some topical overlap it is virtually guaranteed that any non-standard discussion will eventually get wiped.

(Even if this is far in the future, like this classic, community-rallying answer which has been closed and is now considered off-topic, only retained because it is a significant traffic booster for the site: https://stackoverflow.com/questions/1732348/regex-match-open-tags-except-xhtml-self-contained-tags/1732454#1732454)

Please understand there is nothing in the above that should be taken as bitter or spiteful -- this is just part of the ongoing, roiling, broiling, unsettled, hilariously misguided nature of our community.

0

I personally would answer the question suggesting they read the best practice first; then link to a best practice reference.

Note: I wouldn't answer any question that I believed was aimed at breaking the law or harming people

For example I would use the sans institute password policy ( http://www.sans.org/security-resources/policies/Password_Policy.pdf ) in reference to setting a null password.

However if I can't find a best practice reference (from a decent authority) then I might be the one that is wrong and I need to read up before I answer that question.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .