2

https://networkengineering.stackexchange.com/questions/17323/domain-record-hijacking

I actually thought it was a pretty good question and could make for a good answer, but then I saw it already has 3 votes to close. The question is about DNS, and the answer involves talking through DNS and the various points in the DNS process that an attack vector exists. To me that puts it squarely in the "protocol theory/design" category, which is on topic.

I looked through the on/off topic guide and didn't really think it matches one of the 'off topic' categories.

What am I missing? How are people interpretting this as off topic?

11
  • I originally had this in the question, but then I thought it might derail things. But I do think its important to at least mention: Maybe it should be in another thread, but if this truly is deemed off topic, we might want to add to the on/off topic guide the stance on hacking/exploit related question. I like for them to be on topic, because I don't think you can be a 'good' Network Engineer without having an eye for Security, but I guess that should be up to the community to really decide.
    – Eddie
    Commented Mar 17, 2015 at 7:43
  • which of the "on-topic" topics in our help section do you feel this fits under (an existing topic where it currently fits, or an existing topic that might be tweaked a bit to make it clear this fits, or something else?)
    – Craig Constantine Mod
    Commented Mar 17, 2015 at 14:43
  • @CraigConstantine I feel it fits under protocol theory/design. Sure, it could benefit from a little bit of editing, but even in its current form, I think it still is asking about how DNS can be used to domain hijack.
    – Eddie
    Commented Mar 18, 2015 at 7:39
  • 3
    @Eddie, if you think that question fits under protocol or design theory, then you clearly don't understand what those categories were intended for. Design theory talks about how to build network infrastructure, not how something could have been hacked. Protocol theory deals with how network infrastructure protocols work, not how someone could exploit protocols. Part of the problem is that the design theory description needs work. I will edit that and flag for someone to update the Help Center
    – Mike Pennington
    Commented Mar 18, 2015 at 13:51
  • @MikePennington -- Half of designing or understanding how a protocol works is understanding how that protocol protects itself from abuse or where it leaves itself open to attacks. I'm not sure it makes educational sense to separate those two (how it works vs how it can/can't be abused).
    – Eddie
    Commented Mar 18, 2015 at 15:23
  • 2
    That's fine if the user was asking for design assistance; however, the user was not asking for design assistance. There is a substantial difference between real constraints for designs, and a unbounded poll for ways to hack DNS. Please step away from your emotional attachment to the subject, and evaluate the question against our standards; specifically open-ended questions like this are not welcome. This ignores the reality that DNS is still a subject we discourage.
    – Mike Pennington
    Commented Mar 18, 2015 at 15:38
  • @MikePennington Where do we discourage DNS? Why would we discourage DNS? I guess in my interpretation of the question, I don't see it as unbounded. He linked an article of a specific instance of hijacking based on DNS, and wanted more information on how that could have happened. YLearn posted a list of vectors below, which (with a little more context and information) I think would have made a great answer for the question.
    – Eddie
    Commented Mar 19, 2015 at 2:42
  • 2
    Re: "I don't see it as unbounded", we disagree. All the OP did is hyperlink to one instance of a DNS attack and ask "How does the DNS record is hijacked?". Aside from the horrible grammar, the question isn't specific to lenovo. Re: Where and why do we discourage DNS. Have you tried searching meta.NE for DNS? I sense a strong desire in you to answer DNS questions. My advice: click this SF link, or this Security.SE link and enjoy answering the questions.
    – Mike Pennington
    Commented Mar 19, 2015 at 2:55
  • @MikePennington - I was more excited about seeing the answers than answering it, honestly. I wasn't sure what the answer was, I had a few theories, but nothing definitive.
    – Eddie
    Commented Mar 20, 2015 at 10:20
  • 2
    Nothing stops you from asking a similar question on Information Security
    – Mike Pennington
    Commented Mar 20, 2015 at 11:07
  • "Nothing stops…" is right↵But most probably this question would also be voted as off topic on Information Security. And the author would get a nice proposal to migrate it to Network Engineering :(
    – athena
    Commented May 28, 2015 at 8:54

1 Answer 1

Reset to default
2

Not being one of the community members that voted to close this question, I can only speak to why I would have cast that vote.

While it may be a good topic to form a question, I don't think it is a particularly good question for a Q/A site as it seems broad and open ended in it's current form.

It also really isn't about networking, the protocols that networks use, or the functions of a network in a professional setting. This question is more related to a service that passes over a network and could be compared to why a "when I send an email, why doesn't the recipient receive it" question would also be considered off topic.

This does not mean that it would be off topic on another stack, such as Super User, if posed as a professional related question at Server Fault, or it may fit on Information Security. Ultimately, it would be for those communities to decide if that was the case.

It also doesn't mean that security/exploit questions are off topic on this site, as long as they fit within the other on/off topic decisions made by the community. I could probably find a few examples of existing questions, but personally don't have the time presently.

11
  • Had the question been "How was Lenovo hacked", I would have agreed with you. But he referred to a specific article that mentioned DNS, then asked his question specifically around how to hijack DNS records. That sounds pretty specific to me. Maybe he wasn't asking for the specific method Lenovo was hacked, but if he was, that probably also wouldn't be on topic, as that is an investigative journalist question, not a Network Engineering question. But please, indulge me... How, do you think he should (could?) have worded that question for it to be considered on topic?
    – Eddie
    Commented Mar 18, 2015 at 7:44
  • 2
    The question "how does the DNS record get hijacked" is not very specific. Let's start a very brief overview of how DNS can get "hacked." The DNS server itself can be hacked. The DNS service on the server can be hacked. The resolving DNS server the client is using can be hacked. The DNS service on the resolving DNS server can be hacked. The client can be hacked. Any of a number of MitM attacks can be used. Each of the above could be accomplished in a number of different ways and each could easily be an answer unto itself making this a VERY broad question with no specific answer.
    – YLearn Mod
    Commented Mar 18, 2015 at 17:18
  • 2
    Aside from that, it is not on topic on this site. How would I have worded that question for it to be considered on topic? I would have asked it on the appropriate stack in the network where it is considered on topic by the community.
    – YLearn Mod
    Commented Mar 18, 2015 at 17:21
  • I see your point, but I don't think you would have needed to go into a graduate level understanding of each of those attack vectors. A simple bullet list (with a little more detail) would have been a great answer to their question. As for being on topic or not, frankly I had no idea DNS was not on topic... could you link me where that is defined? Because I would have imagined that DNS fell pretty squarely in the Network Engineering Stack Exchange.
    – Eddie
    Commented Mar 19, 2015 at 2:46
  • 2
    @Eddie, DNS is not a component of a network. It is a service, one that does make using a network easier, but a service for all that. In this way, it is no different from HTTP/HTTPS, SMTP, POP3, IMAP, FTP, etc. Should all of those be considered on topic as well? While many of us could probably answer any number of DNS/DHCP questions, there are more appropriate communities on the Stack Exchange network for the majoritty of these questions.
    – YLearn Mod
    Commented Mar 19, 2015 at 14:49
  • OSPF is a service that shares routes. Yet, we consider that wholeheartedly on topic. I think the line would be drawn on what you mean to do with your answer. If your goal is to configure a HTTP/DNS/SMTP/etc server, then I would agree that is off topic. If your goal was to understand the traffic pattern, operation, maintenance and potential risks of those services, then I would look at that as a hosting/service provider question, which (at least in my opinion) falls within the "Network Engineering" realm.
    – Eddie
    Commented Mar 20, 2015 at 10:27
  • That said, I acknowledge that what the Network Engineering Stack Exchange considers on or off topic is / has been decided by the community, and two prominent leaders (yourself and @MikePennington) have sufficiently confirmed where the community lands. I'm not trying to argue needlessly, or simply make a fuss out of an "emotional attachment to the subject". I just felt, as a member of this community, and in a 'community run' environment, its better for members to share there opinions on potential future directions. That is all.
    – Eddie
    Commented Mar 20, 2015 at 10:31
  • 2
    Maybe this will help clarfify the distinction. HTTP/DNS/SMTP are largely services used by client devices accessing the service on a server. They are not typically used by network devices (except for management in some cases), typically not hosted by network devices, and almost never used between network devices. They were designed to make it easier for end users to share/get information. OSPF on the other hand is a service that typically runs on network devices and is used almost exclusively by network devices. It was created to allow network devices to share information about the network.
    – YLearn Mod
    Commented Mar 20, 2015 at 14:21
  • If you eliminate HTTP/DNS/SMTP, what is a network working with? OSPF & BGP alone, just for the pleasure to exchanging nice routes?
    – athena
    Commented May 28, 2015 at 8:44
  • 1
    If you think OSPF & BGP are all there is to networking, you have a lot to learn. Based on your comment, your assertion is that our site should now find every service that uses the network should be on topic as well. Good luck with that as answering questions about every service under the sun is not where I want to spend my limited free time.
    – YLearn Mod
    Commented May 28, 2015 at 15:07
  • I used HTTP, DNS, SMTP, OSPF, & BGP as just numbers among 65535 just as typical examples, and simply to remind the fact they are at the same position in the IP arena (IP is also a typical example :) ).
    – athena
    Commented May 29, 2015 at 11:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .