2

https://networkengineering.stackexchange.com/questions/17323/domain-record-hijacking

I actually thought it was a pretty good question and could make for a good answer, but then I saw it already has 3 votes to close. The question is about DNS, and the answer involves talking through DNS and the various points in the DNS process that an attack vector exists. To me that puts it squarely in the "protocol theory/design" category, which is on topic.

I looked through the on/off topic guide and didn't really think it matches one of the 'off topic' categories.

What am I missing? How are people interpretting this as off topic?

  • I originally had this in the question, but then I thought it might derail things. But I do think its important to at least mention: Maybe it should be in another thread, but if this truly is deemed off topic, we might want to add to the on/off topic guide the stance on hacking/exploit related question. I like for them to be on topic, because I don't think you can be a 'good' Network Engineer without having an eye for Security, but I guess that should be up to the community to really decide. – Eddie Mar 17 '15 at 7:43
  • which of the "on-topic" topics in our help section do you feel this fits under (an existing topic where it currently fits, or an existing topic that might be tweaked a bit to make it clear this fits, or something else?) – Craig Constantine Mar 17 '15 at 14:43
  • @CraigConstantine I feel it fits under protocol theory/design. Sure, it could benefit from a little bit of editing, but even in its current form, I think it still is asking about how DNS can be used to domain hijack. – Eddie Mar 18 '15 at 7:39
  • 3
    @Eddie, if you think that question fits under protocol or design theory, then you clearly don't understand what those categories were intended for. Design theory talks about how to build network infrastructure, not how something could have been hacked. Protocol theory deals with how network infrastructure protocols work, not how someone could exploit protocols. Part of the problem is that the design theory description needs work. I will edit that and flag for someone to update the Help Center – Mike Pennington Mar 18 '15 at 13:51
  • @MikePennington -- Half of designing or understanding how a protocol works is understanding how that protocol protects itself from abuse or where it leaves itself open to attacks. I'm not sure it makes educational sense to separate those two (how it works vs how it can/can't be abused). – Eddie Mar 18 '15 at 15:23
  • 2
    That's fine if the user was asking for design assistance; however, the user was not asking for design assistance. There is a substantial difference between real constraints for designs, and a unbounded poll for ways to hack DNS. Please step away from your emotional attachment to the subject, and evaluate the question against our standards; specifically open-ended questions like this are not welcome. This ignores the reality that DNS is still a subject we discourage. – Mike Pennington Mar 18 '15 at 15:38
  • @MikePennington Where do we discourage DNS? Why would we discourage DNS? I guess in my interpretation of the question, I don't see it as unbounded. He linked an article of a specific instance of hijacking based on DNS, and wanted more information on how that could have happened. YLearn posted a list of vectors below, which (with a little more context and information) I think would have made a great answer for the question. – Eddie Mar 19 '15 at 2:42
  • 2
    Re: "I don't see it as unbounded", we disagree. All the OP did is hyperlink to one instance of a DNS attack and ask "How does the DNS record is hijacked?". Aside from the horrible grammar, the question isn't specific to lenovo. Re: Where and why do we discourage DNS. Have you tried searching meta.NE for DNS? I sense a strong desire in you to answer DNS questions. My advice: click this SF link, or this Security.SE link and enjoy answering the questions. – Mike Pennington Mar 19 '15 at 2:55
  • @MikePennington - I was more excited about seeing the answers than answering it, honestly. I wasn't sure what the answer was, I had a few theories, but nothing definitive. – Eddie Mar 20 '15 at 10:20
  • 2
    Nothing stops you from asking a similar question on Information Security – Mike Pennington Mar 20 '15 at 11:07
  • "Nothing stops…" is right↵But most probably this question would also be voted as off topic on Information Security. And the author would get a nice proposal to migrate it to Network Engineering :( – dan May 28 '15 at 8:54
2

Not being one of the community members that voted to close this question, I can only speak to why I would have cast that vote.

While it may be a good topic to form a question, I don't think it is a particularly good question for a Q/A site as it seems broad and open ended in it's current form.

It also really isn't about networking, the protocols that networks use, or the functions of a network in a professional setting. This question is more related to a service that passes over a network and could be compared to why a "when I send an email, why doesn't the recipient receive it" question would also be considered off topic.

This does not mean that it would be off topic on another stack, such as Super User, if posed as a professional related question at Server Fault, or it may fit on Information Security. Ultimately, it would be for those communities to decide if that was the case.

It also doesn't mean that security/exploit questions are off topic on this site, as long as they fit within the other on/off topic decisions made by the community. I could probably find a few examples of existing questions, but personally don't have the time presently.

  • Had the question been "How was Lenovo hacked", I would have agreed with you. But he referred to a specific article that mentioned DNS, then asked his question specifically around how to hijack DNS records. That sounds pretty specific to me. Maybe he wasn't asking for the specific method Lenovo was hacked, but if he was, that probably also wouldn't be on topic, as that is an investigative journalist question, not a Network Engineering question. But please, indulge me... How, do you think he should (could?) have worded that question for it to be considered on topic? – Eddie Mar 18 '15 at 7:44
  • 2
    The question "how does the DNS record get hijacked" is not very specific. Let's start a very brief overview of how DNS can get "hacked." The DNS server itself can be hacked. The DNS service on the server can be hacked. The resolving DNS server the client is using can be hacked. The DNS service on the resolving DNS server can be hacked. The client can be hacked. Any of a number of MitM attacks can be used. Each of the above could be accomplished in a number of different ways and each could easily be an answer unto itself making this a VERY broad question with no specific answer. – YLearn Mar 18 '15 at 17:18
  • 2
    Aside from that, it is not on topic on this site. How would I have worded that question for it to be considered on topic? I would have asked it on the appropriate stack in the network where it is considered on topic by the community. – YLearn Mar 18 '15 at 17:21
  • I see your point, but I don't think you would have needed to go into a graduate level understanding of each of those attack vectors. A simple bullet list (with a little more detail) would have been a great answer to their question. As for being on topic or not, frankly I had no idea DNS was not on topic... could you link me where that is defined? Because I would have imagined that DNS fell pretty squarely in the Network Engineering Stack Exchange. – Eddie Mar 19 '15 at 2:46
  • 2
    @Eddie, DNS is not a component of a network. It is a service, one that does make using a network easier, but a service for all that. In this way, it is no different from HTTP/HTTPS, SMTP, POP3, IMAP, FTP, etc. Should all of those be considered on topic as well? While many of us could probably answer any number of DNS/DHCP questions, there are more appropriate communities on the Stack Exchange network for the majoritty of these questions. – YLearn Mar 19 '15 at 14:49
  • OSPF is a service that shares routes. Yet, we consider that wholeheartedly on topic. I think the line would be drawn on what you mean to do with your answer. If your goal is to configure a HTTP/DNS/SMTP/etc server, then I would agree that is off topic. If your goal was to understand the traffic pattern, operation, maintenance and potential risks of those services, then I would look at that as a hosting/service provider question, which (at least in my opinion) falls within the "Network Engineering" realm. – Eddie Mar 20 '15 at 10:27
  • That said, I acknowledge that what the Network Engineering Stack Exchange considers on or off topic is / has been decided by the community, and two prominent leaders (yourself and @MikePennington) have sufficiently confirmed where the community lands. I'm not trying to argue needlessly, or simply make a fuss out of an "emotional attachment to the subject". I just felt, as a member of this community, and in a 'community run' environment, its better for members to share there opinions on potential future directions. That is all. – Eddie Mar 20 '15 at 10:31
  • 2
    Maybe this will help clarfify the distinction. HTTP/DNS/SMTP are largely services used by client devices accessing the service on a server. They are not typically used by network devices (except for management in some cases), typically not hosted by network devices, and almost never used between network devices. They were designed to make it easier for end users to share/get information. OSPF on the other hand is a service that typically runs on network devices and is used almost exclusively by network devices. It was created to allow network devices to share information about the network. – YLearn Mar 20 '15 at 14:21
  • If you eliminate HTTP/DNS/SMTP, what is a network working with? OSPF & BGP alone, just for the pleasure to exchanging nice routes? – dan May 28 '15 at 8:44
  • 1
    If you think OSPF & BGP are all there is to networking, you have a lot to learn. Based on your comment, your assertion is that our site should now find every service that uses the network should be on topic as well. Good luck with that as answering questions about every service under the sun is not where I want to spend my limited free time. – YLearn May 28 '15 at 15:07
  • I used HTTP, DNS, SMTP, OSPF, & BGP as just numbers among 65535 just as typical examples, and simply to remind the fact they are at the same position in the IP arena (IP is also a typical example :) ). – dan May 29 '15 at 11:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .