DIscussion of Security Bugs?

Question

A (I believe) well intentioned developer is asking for the details of a Magento security exploit. Should these sorts of questions be allowed? Is there a general policy for this on Stack Exchange sites?

[insert standard security through obscurity bad vs. reducing surface area of exploit discovery discussion]

I know it was Magento Inc.'s policy to not discuss the details of security vulnerabilities publicly, even after they'd been fixed. Once eBay bought Magento Inc. the policy stayed in place, mainly to protect the segment of Magento's user population that never upgrades versions due to the IT costs involved.

Answer 1

There is no Stack Exchange policy for handling this content. It's really up to each community to establish the norms of what is acceptable when it comes to issues like discussing security vulnerability, non-disclosure issues, etc. As long as the content doesn't run afoul of legal issues, feel free to self-moderate however you see fit.

Answer 2

My 2 cents:

Discussions of exploits and security vulnerabilities of the current release should not be done publicly and be disclosed to Magento so that they can fix it.

Public discussion of vulnerabilities of past issues in my view helps the community more than the bad guys.

Benefits in my view are:

1. It makes it easier for developers to access and share this information, helping in actually closing the loopholes
2. While merchants usually understand it is better to be on the latest and greatest release creating additional resources like this could help grow this understanding
3. By ignoring security issues (or keeping them very quiet) they rarely get the attention they need to get fixed

Answer 3

This is a good question Alan. I really believe that disallowing security questions will not break any SE rules.

Also the link to Magento policies disallowing security questions will make sense.