Recently, this question appeared asking how to bypass a firewall using Ubuntu. What should we do about questions which seek out how to use Ubuntu to bypass security implementations?
-
Can this be rephrased to 'Questions about how security works' instead? If you intend to help circumvent a rule, that's no good. If you are just explaining how things work, that's probably better. What someone does with the info later is on them.– Tom BrossmanCommented Dec 19, 2011 at 22:00
-
How do serverfault, superuser, unix, and other SEs handle this? Surely we can't be the first ones to deal with this.– Jorge CastroCommented Dec 19, 2011 at 23:06
-
1@JorgeCastro Security.SE mods say this is on-topic as the methods can be used just as much for educational purposes as it could malicious. Identify weak points in security, for whatever reason, is still a valid question.– Marco Ceppi ModCommented Dec 19, 2011 at 23:14
3 Answers
On-topic
I believe these questions are on-topic, nevermind the motive behind the question, as long as the question doesn't break or interfere with any laws these questions should remain open.
-
This answer seems a bit dismissive, especially since there very well may not be enough information in the question to determine that what is being attempted is legal. Never mind that questions of legality are tied to jurisdiction. The legality of the question could change from location to location and organization to organization (think government security measures vs. home security measures). So your condition of "as long as [it] doesn't break ... laws" isn't a very good measuring stick for determining whether or not a question should remain open.– b_laoshiCommented Jun 15, 2017 at 9:07
There is no correlation between who has the firewall or bypasses it, and who has the high moral ground. Sometimes the firewall is protecting a private network from intrusion, sometimes the firewall is enforcing censorship, and sometimes it's just a dumb IT choice that prevents you from doing your job. I'll reiterate what I wrote on a related topic on a related site: concentrate on the technical merits of posts, don't try to guess what the legal or ethical situation may be (the next person with the same question may be in the opposite camp anyway).
How it's done on other sites:
- Super User: Handling questions that are clearly trying to break some kind of policy, TOS, etc?, Legal basis for restriction of discussions? If the request is evidently highly likely to be illegal and immoral, then the question is up for deletion. But merely violating some policy does not make one immoral.
- Server Fault: Handling illegal/immoral questions and answers On Server Fault, if you don't make IT policy, you're not one of “us”. This attitude is not friendly even on a site for system administrators (sometimes you're the local administrator and you have to dodge around central IT), and it does not make any sense on a site for everyone like Ask Ubuntu.
- Unix & Linux: It doesn't seem to have come up, but I can assure you that if it does, one vocal user will strongly defend judging questions on their technical merits alone.
- IT Security: How do we provide value to white and grey hats?, where it's widely noted that much of the information that's useful to black hats is also useful to white hats and vice versa.
Regarding the particular question you cite, I'm not against it on moral grounds; how to bypass a firewall is a perfectly legitimate question. But the question itself is vague, we don't know what kind of firewall is being used (we do need to have some idea of what it blocks to provide a useful answer). This isn't a good question, but for technical reasons, not for moral reasons, and it can improve if the asker provides more details.
Off-topic
This question is about bypassing web-filtering (a type of firewall) on the questioner's network (possibly a university campus, but could be anywhere).
This would then allow him/her to reach objectionable content, download pirated content (movies, music), and/or carry out communications otherwise blocked or monitored for this location.
This is breaking the law, although it may be only a minor criminal act in some jurisdictions. We should NOT be encouraging, endorsing, or discussing such functionality.
This type of action is problematic, because the institution or business is legally (and criminally) responsible for the actions of persons using its network. They therefore have the right to mitigate or limit their exposure. This is NOT censorship, but more like self preservation.
This is NOT about Ubuntu. The chosen methodology (some method of proxy bypass) may involve the installation of software, but would more likely involve identifying and/or connecting to an external 'facilitating service'.
-
2This is not illegal in any US laws, if I've missed one please provide the link.– Marco Ceppi ModCommented Dec 19, 2011 at 23:14
-
'illegal' in bullet point 3, refers to actions in bullet point 2 ..– david6Commented Dec 20, 2011 at 0:57
-
4You should not forget about the fact that people may want to know ways how to penetrate a security system in order to harden it or to learn what to pay attention on in case of successful penetration of their system. Commented Dec 20, 2011 at 13:11
-
1@OctavianDamiean if someone were asking to gain pentesting knowledge, that would make it off-topic. Let's face it, if you're studying penetration testing, Kali trumps Ubuntu. To say that pentesting questions are on-topic in a forum dedicated to Ubuntu is a bit of a stretch unless those questions are directly related to hardening Ubuntu.– b_laoshiCommented Jun 15, 2017 at 9:01