-4

I asked the question:

Is it fundamentally possible to validate that an unmodified version of your client connects to your server?

Which to me, looks like a very specific question to which the answer is either "Yes" or "No" and then: "Here's why."

Below the question, I added detail to explain my question:

I was just thinking about the idea of having my client-side app hash it's own source code and send that as a key to the server with any requests as proof that it's unmodified, but that's silly because anyone could just have the client send a hash of the unmodified version via a modified version.

I was wondering if there might be a secure way to do this though, via some sort of proof that the client was unmodified

But I thought my question remained very clear, and that this text would only serve explain my curiosity.


The community here just seems to have reacted badly to the question.

Information Security SE seems to be a place where people were intelligent enough to understand the question and answer it without nit-picking and moaning about some minor discrepancy.

No one said it was too broad. Everyone provided helpful insightful answers. The question was up-voted.

This community is clearly trending towards a less positive demeanor.

  • 1
    The question has now been put on hold for being to broad, even though I edited it to only include the basis fundamental yes/no question. It is no longer too broad, should be re-opened. – Viziionary Oct 31 '14 at 20:14
  • 6
    yes/no: "You really want a yes/no answer. If this is the case, and you don't need anything else to answer your question then it means the answers will be inherently low quality. An answer that only says "Yes" or "No" (in addition to not meeting the minimum length) would be of very low quality. SO answers expect more." – gnat Oct 31 '14 at 20:27
  • 2
    @gnat As stated above, the proper answer would be: "Yes" or "No" and then: "Here's why." – Viziionary Oct 31 '14 at 20:45
  • 2
    You guys make it really difficult to ask a simple question. – Viziionary Oct 31 '14 at 20:45
  • Did you check meta discussion referred in prior comment? – gnat Oct 31 '14 at 21:07
  • 7
    FWIW, it's really bad form to post a meta question and then proceed to tell everyone that they're wrong. – Robert Harvey Oct 31 '14 at 21:46
  • @RobertHarvey I know. Chose to because I'm tired of the ridiculous experience I get every time come here. Btw note I mentioned that it's a niche not necessarily everyone. – Viziionary Oct 31 '14 at 21:47
  • 1
    If you ask a yes or no question, expect the community to interpret it as "explain your answer." There's really no other viable outcome. – Robert Harvey Oct 31 '14 at 21:49
  • 2
    @RobertHarvey yeah but others did answer it and explain the reasoning very well. – Viziionary Oct 31 '14 at 21:55
-1

No.

The OP edited his question to leave a simple yes/no in a response to comments that it was too broad. The extra material on the Information Security one was in the Programmers.SE question, but he was asked to remove it so he did.

Don't punish him with a new argument for closure. That is whack-a-mole reasoning.

Secondly, any person with rep enough to know better should not be answering the question while arguing for closure. (Now that answer has been deleted after it was downvoted to -3). That is a conflict of interest and amounts to rep farming.

The question was answerable. Answers had already been submitted.

What's worse, Information-Security handled his question appropriately, worded identically as the original here, without all of the nitpicking. Perhaps they have better things to do with their time.

  • 2
    Don't worry about the downvote. The user you offended in the post (who down-voted you) has three down-votes on his stated answer which is based on invalid logic it would seem. +1 and thank you. I was starting to lose faith in this site. – Viziionary Oct 31 '14 at 20:47
  • Thanks, the downvotes don't bother me. I downvoted his answer as well. It is a community site. – codenheim Oct 31 '14 at 20:50
  • 8
    Wait, where do you click to see who downvoted your answer? – Ampt Oct 31 '14 at 20:52
  • 4
    A simple yes/no answer is not useful to anyone. – Robert Harvey Oct 31 '14 at 21:35
  • 3
    Yes, I agree. Which is why I didn't answer with a yes/no and tried to give a quality answer, and I upvoted your comment just now, despite your probable downvote to my answer. That said, I think a more little tolerance and leeway is past due here on Programmers, in place of the stifling pedantry here. Some folks here waste so much energy arguing about whether the question is appropriate, I start to feel that I'm on a debate forum. The InformationSecurity.SE guys handled the question appropriately. Seems a bit arbitrary to me. – codenheim Nov 1 '14 at 3:05
  • 3
    Frankly, I posted here to support the poor guy because I felt bad about how he was treated. When it is all said, I am most dismayed by the lack of friendliness here. – codenheim Nov 1 '14 at 3:23
  • Care to chime in?meta.stackexchange.com/questions/242963/… @codenheim – Viziionary Nov 2 '14 at 22:07
13

First off, realize that each community on Stack Exchange is different. You can ask the same question on two different sites and have it closed on one and open on the other. That said, please don't crosspost questions. Really, pick the best one and post there first. Posting the essentially same question unless it is specifically tailored to the community of the site fragments the information and questions across the network making it harder to find the answer. Getting more attention to the question by cross posting is not a good thing.

Now, lets look at the question posted to Programmers.SE:

Is it fundamentally possible to validate that an unmodified version of your client connects to your server?

And compare it to the one posted to Security.SE (without the leading meta bit):

This seems like a programming question but it's really a fundamental security question.

Is it fundamentally possible to validate that an unmodified version of your client connects to your server?

I was just thinking about the idea of having my client-side app hash it's own source code and send that as a key to the server with any requests as proof that it's unmodified, but that's silly because anyone could just have the client send a hash of the unmodified version via a modified version.

I was wondering if there might be a secure way to do this though, via some sort of proof that the client was unmodified.

If you think that this was a security problem, you should have asked it there. Additionally, there is quite a bit more material on the Security.SE one than the P.SE one. You are complaining that the one here got closed for too broad? I will also note there is absolutely no effort at tailoring the question you asked for Programmers.SE community.

I will remind you of the post on Meta.SE: Is a question that specifically asks for a summary of a broad topic valuable to Stack Exchange? and the points that I made there:

Programers.SE generally has the approach that you should at least have done a search on google and possibly read the corresponding Wikipedia page. This is especially true of questions that are likely to be broad. The scrum Wikipedia page is 43k and waterfall is 18k.

The biggest issue with asking such broad questions that are 'condense this other text that I don't want to read into a few paragraphs' is that, for the most part its lazy. Its asking someone else to try to fit a huge body of knowledge into a text box where there are pages of material out there that covers this.

The post here shows no effort at all. It shows no level of comprehension of the nature of the problem. It asks a very broad question to a relatively well known problem. That of the trusted client. The answer you got here is a summary of that wikipedia page (no offense to Justin, it is in his own words and he likely didn't reference the wikipedia page, but it is covering much of the same information).

While I acknowledge it that's my own work, I'd strongly suggest reading the guidance in meta.programmers.SE: Why is research important? - we don't want to repeat what you already know, nor answer at the wrong level for the reader... and if you really don't know, explain what is confusing you.

I again point you to Why is research important? and urge you to read it and consider the lessons contained within it.

Setting aside all of that, Programmers.SE really doesn't like yes/no questions. The appropriate guidance from Meta.SE can be found at: Question closed because yes/no answer. The question asked in this format is exactly the too broad nature. There are far too many possible answers and good answers are far too long. Go search Google a bit. Show us that you have thought about the problem and what it means rather than tossing whatever you think about into a text box and hitting 'Post Your Question'.

Ideally, the person asking the question has spent at least as much effort in thinking of the question, the problem, and how to ask a good question as the person answering it. This is how we get good answers.

  • 1
    The extra material on the Information Security one was here too but I was asked to remove it so I did. I was told the problem was the extra part added. Next, cross posting IS OK if the question is valuable to both communities. They are NOT the same sites nor communities, and while posting the question on both to gain attention is bad in the wrong context, in this case, it's perfectly valid and valuable on both sites – Viziionary Nov 1 '14 at 1:12
  • 1
    The raw cut was tailored there was no change to be made, period. It was what it was, written as perfectly and it could be written for both sites. – Viziionary Nov 1 '14 at 1:18
  • 3
    I have had great experiences on every other site except for this one and SuperUser. Maybe it's because programmers are difficult people to deal with. I don't know. But I know when I go to The Workplace SE or English SE or Blender SE or Phsics SE or Biology SE I get great answers, people are helpful and understanding, etc. Here I always find myself dealing with negative people, mainly gnat and an array of others that make coming here a horrible time – Viziionary Nov 1 '14 at 1:21
  • 2
    It doesn't matter!! They are DIFFERENT sites with DIFFERENT communities, they can both have the same question. I'm not arguing with you about this. I've seen and participated in the Meta Se discussions on this, the answers are extremely conflicted. This site along with SuperUser are statistically the two most negative sites on the network in terms of down-votes. Enough said, it sucks to come here – Viziionary Nov 1 '14 at 1:23
  • 2
    @jt0dd workplace, english bio, blender, physics, and bio are all younger sites than programmers.SE and are less encumbered with our shift from "Not Programming Related" to "Programmers" and thus can handle different degrees of allowances for slightly less well thought out questions. Super User and Programmers are both older sites and have different expectations. Bio is half the age and 1/4 the questions. – user40980 Nov 1 '14 at 1:30
  • 1
    @MichaelT surely you aren't saying that the rules are subjectively interpreted and applied from site to site? – codenheim Nov 1 '14 at 3:38
  • 5
    @codenheim they absolutely are. The hint answers on math.SE would be deleted on P.SE. Big list soft questions on Theoretical CS would get closed on SO. AskDifferent has hidden features posts. Software recommendations allows questions that would be closed on all other sites. World building is interesting and strange. Gaming has titles that no other site gets away with (Codegolf tries). The rules form a framework, but the implementation is different on each site. – user40980 Nov 1 '14 at 3:52
  • 2
    Just consider memorable CS paper titles and consider if any other site would allow or encourage such questions. It works there. Why not here? Because people ask about who should be the saint of programmers or what to name their cats. And no, I'm not joking - those were real P.SE questions. – user40980 Nov 1 '14 at 3:56
  • 1
    Yes, its apparent not only in the allowed questions, but in other aspects of the community. The top answer in the question posted on Information-Security.SE got +12, saying the same thing Justin Cave and I said in ours here, yet ours were briefly upvoted, and then downvoted back to 0. – codenheim Nov 1 '14 at 4:22
  • 2
    Then it would appear that Security.SE is the appropriate community for the question, and programmers is not. – Ampt Nov 1 '14 at 15:41
  • 2
    The OP was well aware of where this post would be best received and even stated so "This seems like a programming question but it's really a fundamental security question." - it should not be surprising that as written, the question was not well received on a programming site. As noted the exact duplication is considered abusive and disrespectful to the communities involved. Instead of addressing the 'make this a good P.SE question' the action the OP took to "resolve" the issues brought up was to gut the question into a very poor one that was closed after the changes were made. – user40980 Nov 1 '14 at 22:52
  • 2
    He is also well aware that P.SE takes a dim view of people cross posting identical material on multiple sites. One such meta question can be found at meta.programmers.stackexchange.com/q/6663 . A previous conversation in chat can be found here. That this continues to be a problem, is, well, problematic. That he isn't fitting in with the norms of the community is something that he has railed against several times before. – user40980 Nov 1 '14 at 23:08
  • 1
    If he should choose to ask questions that have been thought out more, properly tailored to the community here (rather than duplicating the question on multiple sites), confining his questions to something that isn't too broad or open ended, he might be able to ask better questions. Though, until he stops trying to be a rebel on the site and declaring himself a martyr (look at his profile), he might have difficulty doing so. Programmers.SE is not the worldbuilding.SE version of SO. – user40980 Nov 1 '14 at 23:13
  • 2
    I get it guys. Unfortunately, I've lost my will to debate, or contribute here anymore. The site is obviously the way you like it. I hesitate to say anything else, because you all have an answer to every argument. I feel that you would be better off focusing all this energy on technical threads, but its your free time, spend it how you like. I personally came here to answer questions, but I seem to get dragged under anytime I try to advocate for someone. – codenheim Nov 2 '14 at 5:14
  • 1
    @codenheim I believe the old saying is an ounce of prevention is worth a pound of cure. I'm sorry that you feel that way about P.SE and honestly value your input. The internet can always come across as a giant echo chamber, and it's good to hear the opposition from time to time. Unfortunately, this was a bad question by an argumentative OP and I'm sorry to see you get burnt out over it. I wish you smoother sailing in your future endeavors, wherever they may be. – Ampt Nov 3 '14 at 4:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .