Can I get a sense-check here? security.stackexchange.com/questions/258736/…

I literally copied the flag from the question, pasted it into Google, saw the Suricata github repo as the 3rd hit, and the explanation with the Wireshark forum going into further detail was there under the rule in question. It took me less than 60 seconds. And no, I don't know nothing about Suricata (haven't touched an IDS in a decade).

I'm still working on the rule-of-thumb that if I can find an answer on Google in less than 2 minutes (and I time myself) using the keywords from the question itself, that it gets closed for "lack of research effort" (and that might be a euphemism for "lack of basic search skills" in some cases).

If the asker used the wrong terms, I provide them with the more helpful terms and check the search results to ensure there are rich hits and ask them if the search term put them on the right path. (and then close it on the basis that the question is too local for the asker, but they ultimately got what they needed)

I think that it's become an annual review for me that we check in on "basic search skills" as a factor for good questions here. If society is simply getting worse and worse at performing basic search, or if society has different expectations for Q&A sites, then we should eventually adjust in order to stay relevant, but gd dmn I'm getting weary of copy/pasting question titles into google and getting the answer in the top 5 hits ...

Not everyone can find the answer as fast as you, but I agree... It would be nice to have a category "not tried a basic search" for closing a question

The "lack of research" thing has been the subject of a lot of debate on other sites, particularly SO. Here's some stuff about it: meta.stackoverflow.com/q/261592 meta.stackoverflow.com/a/388594

It could be worth discussing on security meta

@ThoriumBR if I was using special Google-fu, or leveraged my knowledge of the topic to refine a search, that would be one thing. But I'm copy/pasting the question title into Google or using the very keyword/subject/error code/term/flag the Asker does. I'm using least-effort and finding authoritative answers in less time it takes someone to post a question here.

@schroeder some people don't even have the ^C ^V keyboard from SE...

@FireQuacker I bring it up once in a while

lol

yup, you are right... I saw a lot of questions that people could google and not even have to load any page because the snippet on the results would answer

Hypothetically, if one discovered a vulnerability in common devices, would it be unethical to scan the internet for vulnerable devices that had previous been marked by hackers, gather some private data from them as proof, and then post all the data publicly with a google map of estimated locations (based on geo-IP lookup)?

Related: ipvm.com/reports/hik-hack-map

This was all done to raise awareness, but it seems like it's going a little far to me. Possibly illegal.