5

Android security, like any computer systems security, is an exact science. If an app has a security issue, that is an objective fact, and someone with appropriate expertise can describe the risks involved with reference to facts about what the app does and how it fits into the workings of Android. So how could a question asking for the facts about what security issues exist in a specific app be too subjective?

I asked a question about what specific security issues exist in a controversial app that had been pulled from the Android market but which some people insist is safe.

Android.stackexchange has a community knowledgable about Android who like answering questions, app-specific questions are on topic here, security has its own tag, and questions of the form "Is X safe?" are common across the stack exchange family. Since I'm no Android security expert, and since after research, I can only get a very rough and incomplete outline of the facts of the issue, this site seemed the obvious place to ask about what the hard facts were.

I was very surprised to see the question closed for being "subjective". Here's the question. (note that I re-wrote it to state and restate explicitly what the focus of the question was. The question itself is the same and you can see the original in edits. I just trimmed background research, context and scene-setting and stated explicitly what kind of facts I was asking for).

Here's the explanation given for closing:

This question is not a good fit to our Q&A format. We expect answers to generally involve facts, references, or specific expertise; this question will likely solicit opinion, debate, arguments, polling, or extended discussion. See the FAQ for guidance on how to improve it.

How is asking about the facts behind a specific security concern not factual and not involving specific expertise?

I've never seen a question of the form "Is X safe?" closed for being subjective on any stack exchange site, ever. For being poorly written or unclear, sure, but never for being inherently subjective. Here are a few examples of such questions from 5 minutes searching, from stack overflow: 1, 2, 3 and from serverfault: 1, 2. Many of these are far more subjective than mine, not giving specific reasons for concern and just ask how secure something is in general. They all got good answers that show expertise and reference facts about the product, app or technique in question.

I don't understand why android.stackexchange should be the only site in the stack exchange family where discussing specific security concerns does not "...involve facts, references, or specific expertise" and "will likely solicit opinion, debate, arguments, polling...". Android security is no less of an exact science than security on any other platform.

| |
  • For the record, the question this is about was deleted with a total vote score of +4, three people having favourited it, over a thousand page views, and two people finding it through search through interest in the subject and commenting saying it shouldn't have been closed. The moderator's main reason given for closing it below is "how can your question be of any future use?" - clearly, many people disagree. – user56reinstatemonica8 Feb 25 '14 at 9:31
  • For any who might be interested, a discussion has been opened on the main Meta Stack Overflow site: Can a moderator delete a quite popular question to prevent discussion of a close decision? – ale Feb 25 '14 at 13:50
6

I've kept an eye on this question to see if the community (via voting, commenting, or answering) held any kind of meaningful opinion on this topic, but since the activity here has been relatively flat I'm going to go ahead and add my thoughts. Please understand that this is solely my opinion on the matter.

The one concern I have with questions of this nature is where factual data would be coming from. Since the app in question is closed-source any truly helpful answer is going to require either:

  1. That the answer reverse-engineers portions of the app, or otherwise attempts to analyze its runtime effects on the system, to determine how it works
  2. Some kind of already existing literature or research that did #1

Because of the nature of proprietary software, any answer that does not involve #1 or #2 is almost certainly going to be speculation or an educated guess. It could very well be an accurate educated guess, but there would be effectively no way for anyone to verify it as such, so the voting largely becomes a matter of "Yeah, that sounds reasonable" or "No, that sounds ridiculous".

On the other hand, I completely understand your motivation and I appreciate the amount of effort and pre-question research you've clearly put into your question. Also, please don't construe my thoughts above as an indication that I think only trivial questions are appropriate for this site - that is certainly not the case at all. Further complicating this is the fact that I do recognize that it is inherently difficult to determine if either points #1 or #2 that I've noted can be met on any given question.

So I suppose a related and slightly more general question could be: Is the answerability of question an acceptable metric for moderation, or no? If so, how do we make that determination? If not, at what point to we draw the line on questions that will attract and/or encourage speculative answers? From what I can tell (and correct me if I'm wrong, anyone) that seems to be the crux of the issue here.

| |
  • ...as for that "Too localized" question, I really think the way to see if a community can answer a question is to see if they can answer it. For ANY question, an answer that is speculative will be downvoted. It doesn't matter if it's "I reckon that app's insecure, dunno why" or "Best browser on Android is Firefox, I've never tried the others". People who could contribute useful information include: any developer with knowledge of what it means for an app to repackage another app, anyone who did (or didn't) receive the email mentioned in the post I linked to, any developer/root user who used it – user56reinstatemonica8 Jun 6 '12 at 16:36
  • ...and out of curiosity looked at the re-packaged apps to see what had changed, anyone who worked on the app, anyone who was or is in contact with the app developers, any developer who has looked into the area and knows what is and isn't possible. Don't forget that a) there was never any suggestion of malice from the app developers, b) lots of people who use this site do have very in-depth knowledge, c) badges like "necromancer" exist for a reason: it's fine for a question to go unanswered for a few months then get a great answer from someone googling the topic. – user56reinstatemonica8 Jun 6 '12 at 16:40
  • Put it another way. Suppose for some reason a person who does have specialist knowledge stumbles on the question in a google search one day. Is there a good reason to stand in their way and say "DON'T ANSWER THIS"? To physically prevent this person from answering by closing the question? If it was a duplicate, sure (and redirect them). If it's not about Android, sure. If it's not actually really a question, sure. If it's about a random problem one guy had once because he foolishly went at his phone with a soldering iron, sure. But because it's surprising that someone can answer it? – user56reinstatemonica8 Jun 6 '12 at 16:48
  • And to put it yet another way, look at this question: android.stackexchange.com/questions/23664/… Like my question, it's specialist, and while there is a closed box element (here, it's limited possible debug info), there are various types of relevant factual knowledge people could have (another cyanogen expert might have experienced similar). Should it be closed? Of course not, someone could answer it, and it causes no harm. So where's the difference? No 29k+ rep moderator had previously closed that question citing unrelated reasons. – user56reinstatemonica8 Jun 6 '12 at 17:18
  • That either #1 or #2 must be involved, is patently false. I can't access the question so I don't know what it was about, but packet sniffing could reveal that data has been leaked and the app is hence insecure. Or log files could be found. Or a myriad of other side-channels could provide information. Whoever deleted that question is, sorry to say, just another StackExchange power tripping a-hole moderator. – Dan Dascalescu Mar 7 '14 at 7:29
2

Firstly, you might want to check out the Security site. The context is Android, but the point of your question is security issues, so it might be a better fit there.

That said, you noted that the app has been removed from the Market and you can't find much information about it. It's likely, then, that any answer would be speculative. Possibly we have some users who studied the app previously but I would consider that unlikely. This also falls into the Too Localized close reason — the app is gone, no one can get it from the Market; how can your question be of any future use?

Also, and this is more of a personal reason since people regularly disagree with it, you didn't provide any rationale for your question. Why are you asking this about App Shield? What about it makes you think it's insecure? In the words of the FAQ, You should only ask practical, answerable questions based on actual problems that you face. Chatty, open-ended questions diminish the usefulness of our site. Without this rationale, a form of your question could be asked about every single app that exists, and I don't think that's useful. Rationale also helps answerers to provide focused and more useful answers.

That's why I closed it as Not Constructive (not quite the same as "subjective"; I was a bit loose with my wording in the comment).

Asides:

  • I would very much question the idea that security is an exact science. Everything is a potential security hole, or at least not provably not a security hole.

  • I would personally favor closing 3/5 of your examples from other sites. While we do share the broad SE guidelines, we're not bound by what specific questions other sites consider acceptable or unacceptable.

| |
  • 1) "IT Security - Stack Exchange is for Information Security professionals to discuss protecting assets from threats and vulnerabilities". What about my question makes you think I'm an IS Security professional? It would be like a student asking mathexchange.com for help with homework. They'd close it for being trivial, they'd point out that there's no reason to expect IS Security professionals to have specialist knowledge about an Android app, and they'd suggest I try "that Android stackexchange site" – user56reinstatemonica8 Jun 4 '12 at 12:21
  • 2) "It's likely, then, that any answer would be speculative. Possibly we have some users who studied the app previously but I would consider that unlikely". This is a comment about the community, not about the question. There's an easy way to find out if anyone can answer a question - and that's to see if anyone answers it. If no-one answers it, no harm is caused - unless you are trying to massage the sites % answered statistics? – user56reinstatemonica8 Jun 4 '12 at 12:23
  • 1
    3) "This also falls into the Too Localized close reason — the app is gone, no one can get it from the Market; how can your question be of any future use?" - Because, as I explained, the app is unique, and there are people who claim the app is safe advocate downloading the .apk and installing it off-market. No-one should do this without clear information about the risks involved. This is the very reason I am asking the question. Why would I ask the question without a reason? – user56reinstatemonica8 Jun 4 '12 at 12:25
  • 1
    4) "you didn't provide any rationale for your question" - This is either the confirmation that I needed that you gave the question nothing but a cursory glance before closing it, or you are trolling. I gave detailed rationale in my original post, and I removed it after you closed the question because it was the only part of the question that was in any way subjective. Look at the edit. I explained clearly why I was interested and removed the explanation - reluctatntly - after you closed the question. – user56reinstatemonica8 Jun 4 '12 at 12:27
  • 1
    5) "I would very much question the idea that security is an exact science" - Well yeah, nothing is an exact science in the simplistic way many people understand the term. Science is incremental, iterative, based on testing hypothesis to discover new questions and refine or replace paradigms. But I think a discussion of the philosophy of science would be off topic... it should be pretty obvious that by exact science, I meant that it involves facts that are falsifiable by evidence rather than interpretations that are subjective. – user56reinstatemonica8 Jun 4 '12 at 12:32
  • 6) "I would personally favor closing 3/5 of your examples from other sites". I hope it is obvious by my saying I spent only 5 minutes searching that those weren't intended as examples of great questions. And I hope you can see the reason I posted these: it's very odd, that a site that is supposed to include average Android users should make different demands to serverfault - a site for system administrators. Sites are supposed to be moderated based on clear, publicly stated rules - not the personal whims and feelings of one 20k+ rep guy who others take the lead from. – user56reinstatemonica8 Jun 4 '12 at 12:38
  • To conclude: the only reason you gave for closing it as not based on facts or expertise is a) nothing to do with it being not based on facts, b) a personal feeling of yours (off topic, one I actually agree with), c) not true of the original post and d) clearly something you thought of after reading my editted question, after you had already closed it. What was your real, original reason for thinking the original question was subjective? If you only gave the original question a cursory glance, please just admit it. Many modertors make this mistake. Most admit to it when they do. – user56reinstatemonica8 Jun 4 '12 at 12:48
  • (and as a personal aside, I find it particularly annoying and un-moderator-like that, as well as not reading my question properly the first time, you didn't read it the second time either. If you had, you would have seen my note, "My original wording of this question went into a bit more detail on why I was interested... Apparently that sort of thing is too subjective. But check the edit if you want more context.") – user56reinstatemonica8 Jun 4 '12 at 13:03
  • "the app is gone, no one can get it from the Market; how can your question be of any future use?" - what if it goes back on the market later, under claims of safety? Its sordid history should be available. – Dan Dascalescu Mar 7 '14 at 7:27
1

The problem is that no one can predict if an answer to those questions will every be backed by facts or references. Typical examples are "Why does Google not allow one to X?" and such. The probability is high that no one can give facts or references if he is not a Google employee. That's why those questions are often closed, because most answers can only be speculative. In fact, that is true for all questions which involve company policies and decisions.

Regarding the question from you I am not sure if this applies here too. There could be someone with a deep knowledge of Android who can answer this in an good way, so that it fits SX's QA policy. That is why I have voted to reopen the question.

I think overall we should wait before we close such questions. If the answers are only of speculative nature, then the question can be closed (and deleted) later on.

| |
  • Thanks for the answer and thanks for the re-open vote. This makes me wonder if what happened here is that people reading the earlier wording of my question saw that it mentioned (as background information) debates about Google policy, and they reflexively reached for the 'close' button without taking the time to see what the question was actually about. – user56reinstatemonica8 Jun 3 '12 at 14:18
  • I was a bit puzzled by your opening paragraph, and why it said "those questions" as if my question was a Google policy question. I've editing my question here to make sure it's absolutely clear that the question is about the facts of the security issue, and the fact that Google happened to pull the app is background, setting the scene, not the focus of the question. – user56reinstatemonica8 Jun 3 '12 at 14:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .