What is meta? ×

How should we treat questions that are, or have seeds of, evil or malicious purposes and actions, such as writing spambots and malware?

Should they be answered like regular "everybody keeps their pants on" questions? Or should there be some other type of response to this bad behaviour lot?

share|improve this question
I think we should lift this to FAQ-Status together with a brush up, but I have no idea if that's a good idea or how to do that. –  Time Traveling Bobby Sep 16 '11 at 6:38

7 Answers 7

up vote 47 down vote accepted

I've seen a few of these, though they are usually couched in the terms that Jonathan mentions in his answer.

The other ones have usually had comments/answers along the lines of "why do you do this?", "this sounds like spamming", etc. and often the asker responds with what seem to be perfectly plausible reasons.

I think that there are five levels of action that you can take:

  1. Just answer the question without comment. Who are we to pry into other people's business, which may be confidential?
  2. Do nothing. The original poster won't get an answer and will have to try somewhere else.
  3. Leave a comment indicating that you think this is "evil" and asking for more information as to why the asker wants to do this. Then you can choose whether or not to answer the question based on their response.
  4. Down-vote the post, and preferably leaving a comment that explains why to the poster.
  5. (The nuclear option:) Flag the post as spam, offensive, or just in need of moderator attention.

Basically, what I'm saying is that you have to treat each post on its own merits. The other thing you could do is check out the poster's profile and see what other questions/answers they have posted. If everything else points to them being legitimate, then just answer the post; if not, flag it and explain your concerns to a moderator.

share|improve this answer
Another level of action is to notify the police directly, if you're worried about a nefarious action rather than an off-topic question. –  Andrew Grimm Jun 2 '10 at 23:21
Asking for clarification can only tell you if the OP knows how to hide their intentions better than you can guess them. You might even help that OP learn how to better hide for the next time. I'd suggest asking for more information only if you need it to answer the question. (It'll waste less of your time if you think they're truly being nefarious.) –  Gnome Jun 2 '10 at 23:39
@Andrew Grimm: Which police where? This site is kind of international, y'know. –  Piskvor May 12 '11 at 8:03
Whichever jurisdiction the OP's in, or just let your local police know and let them notify the relevant jurisdiction? –  Andrew Grimm May 12 '11 at 10:36
I happened to see "I try to spam users but it fails, why?" question, with the word spam explicit in it's title. After a comment it was edited to look more innocent, but anyway. In theory if I answered, I could get fined (law in my country would make it assisting in illegal activities). Sometimes 1. is simply not an option. –  Mołot Jul 19 '13 at 9:19

As mentioned, there is a problem with characterizing a question as "evil". I saw a question about "Monitoring Internet Usage in my small office". The asker was downvoted to oblivion, as were the answers (myself included). Over time the votes have been removed/canceled out by upvotes, but this person's technical question was downvoted because of the community being angry about being "spied on".

Later I read a second question by a different person about "monitoring internet traffic through a particular router" and, because this person phrased the question differently, they got HUGE upvotes, even though the question was essentially the same.

We, therefore, have to split questions into two aspects:

  1. How technically can X be done?
  2. What ethical implication are there?

Stack Overflow is fundamentally about the first question. It is a technical "question and answer" site. If the hackers get better (and they will) then the security teams will also get better. If the "way to hack" is published on SO, then the security guys will use that to learn "ways to protect". As Bruce Schneier says on his blog all the time, "Secrecy is not security".

If a question bothers you, don't answer it. But if I can, I still will, because it's not my job to go visiting their intentions. And if it is a technically interesting question, I'll upvote it too.

share|improve this answer
So, you'd answer, "What's a good design for an ethnicity database to be used for ethnic cleansing purposes?" (Hah - Godwin'd ya!) –  Shogging through the snow Jul 24 '09 at 17:40
@Shog, I'd not answer that question. But it seems to me like those people aren't going to give up their ethnic cleansing because they had a database error, lol. –  devinb Jul 24 '09 at 18:10
@Shog and anyway, IBM already came up with a solution to this problem. –  user3788 Dec 21 '09 at 16:09
@Shog It's not his style to answer questions with questions, maybe? –  muntoo Jun 11 '12 at 23:25

It is going to be tough to know who's evil and who isn't. After all, nobody in their right mind will say

I need to spam 900 email accounts 3 times a day with Viagra ads.

Instead, they'd ask

I've got 500-1000 employees that need to receive product stats three times a day. What's the best way to do this?

If they're slick enough, we'll all take the bait.

share|improve this answer
You're overestimating your fellow man, there. This is something which has actually occurred in the past and was pretty hilarious how badly they tried to cover up their intentions. –  TheTXI Jul 8 '09 at 11:30
Liiiiiiiiiiiink! –  chaos Jul 8 '09 at 11:35
chaos: I don't think I'd ever be able to drag it back up again. For all I know it's been deleted for quite some time. –  TheTXI Jul 8 '09 at 11:36
+1 If deciding between good and evil software was algorithmic, Windows would already block evil software and we wouldn't be having this conversation. Instead, the world is full of installations of Symantec (which does more harm by wasting CPU than most malware!) demonstrating how tricky this is. –  Earwicker Jul 8 '09 at 12:38
@Earwicker - The Windows opening with a timely Symantec-side castling - well played indeed! –  micahwittman Jan 8 '10 at 20:42
If deciding between good and evil was algorithmic, Windows wouldn't get there –  РСТȢѸФХѾЦЧШЩЪЫЬѢѤЮѦѪѨѬѠѺѮѰѲѴ May 29 '13 at 6:52

Unless it's totally 100% obvious that the code/act described in the question is illegal in the majority of countries, leave politics and legal issues out of Stack Overflow. There might be questions that give corporate folks a legal headache, but if that happens, I assume they will take action directly. That's the exception to the rule. The general rule is:

Assume good faith for all users on the site. Making different topics in our field taboo is something that will not pay off in the long run. A likely scenario could be a question regarding the DeCSS code for breaking encrypted DVD movies. DeCSS is legal in a lot of countries (Norway to name one), but violates the DMCA in the US. Depending on your beliefs and/or location, you should feel free to refrain from answering, but don't downvote or flag the question.

See also: What to do when I suspect a person is asking questions to become a cracker?

share|improve this answer
Don't to mention, that on the other side there are people who think every form of copyright protection to be against human rights (right to information, culture, entertainment and education) –  РСТȢѸФХѾЦЧШЩЪЫЬѢѤЮѦѪѨѬѠѺѮѰѲѴ May 29 '13 at 6:54

I find that most of these questions can be dealt with by essentially a single answer:

Don't do that. Even if you have a legitimate reason, your program would be detected as malware by (antivirus/antispam/antispyware) software and you will lose all your customers.

There isn't any neat dichotomy between technical and ethical issues, because having the appearance of evil becomes a technical issue (AV stopped your installer from uncompressing your file / AV stopped your program from executing / AV deleted your DLL / AV deleted your data file).

share|improve this answer
I love how you have shown the link between technical and ethical ty –  user223277 May 26 '13 at 14:06

You could probably vote these as spam using the flag function.

I would say use the Google motto of "Do No Evil". If you have moral qualms against answering a question, then don't answer it and comment as so. More than likely questions like this will get closed very quickly anyway.

share|improve this answer
Google motto of "Do No Evil": LOLZ –  Thomas Eding Jun 12 '12 at 1:07

In my opinion, spambots should be open source and all necessary knowledge to build them should be public. I wouldn't mind answering a question that would enable some people to spam me the next day because this type of information serves both sides: the good and the bad guys. In the long term, all you are doing is accelerating technological evolution by spreading information.

To explain myself better, I'll exemplify: There are the antivirus makers, and the virus makers. If you post in a public forum how to make a virus, the virus developers will use it to fortify themselves, while the antivirus makers will use it to prevent this. After some time, the net effect is almost zero.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .