How should questions be handled involving code?

Question

(Full disclosure: This is a Q&A that was requested from me to document our current policies on handling questions involving code.)

So the question:
Assume I am looking at a question that involves concrete program code, when should I flag for migration, when vote to close and when leave it be and potentially even upvote it?

Answer 1

Here are our current policies:

• We keep a question (i.e. as a user upvote it if it's good) when there's a reasonable interpretation of it that uses a minimal amount of code only to illustrate a point, e.g. to describe a reasonably simple cryptographic scheme. Alternatively we keep a question if it is about side channel attacks or their countermeasures, as they are explicitly on-topic for us. A third tangentially related type of question to keep is a request for test vectors for standardized cryptographic schemes.
• We close a question (i.e. as a user flag requesting closure / vote to close as programming question) when it asks for an implementation of some functionality without providing prior attempts. In particular this covers nontrivial code / implementation / conversion requests. StackExchange is not a service for getting arbitrary functionality implemented, professionals should be hired for that.
• We may also migrate a question (i.e. as a user flag for moderator attention and request migration if anything matches) to one of the following sites if it looks appropriate, here's the guidance for each:
• Stackoverflow: When it has really small code requests (e.g. "how to use GCM in BouncyCastle") or when it asks us to debug a specific piece of code, that is the code seems to be close to working and only a (probably) small bug is in the way to it working as intended. A minimal complete verifiable example is required for this. Additionally questions for Stackoverflow may ask for ways to generalize a piece of code, e.g. so it can be ported more easily to other libraries.
  • Superuser: when it asks how to use a (cryptographic) piece of software. Potential exceptions are dedicated cryptographic analysis tools and their specification languages, e.g. for cryptographic protocol analysis.
  • CodeReview StackExchange: When it provides a full listing of working-as-intended code and asks for optimizations or security review, unless it has a specific question about side-channels. If the review request is reasonably simple and mainly about the theoretical scheme, our usual policies for restricting scheme review apply and we may instead keep it.
  • Software Recommendations StackExchange: If it asks for a recommendation for a cryptographic software or library.
  • Information Security StackExchange: If a question asks about non-cryptographic aspects of security (illustrated by code) or about non-side-channel code weaknesses where more theoretical knowledge is desired than is expected from CodeReview.SE. This may also include aspects like key management.

Note: This list may not be exhaustive and may be extended over time when new types of cases pop up. Also note that questions should not be migrated if it is easily derivable that they are off-topic on the target site through their help center.

Answer 2

I will try to write a shorter version of SEJPM's answer.

• How the algorithm works is Cryptography
• How the algorithm is used is Information Security
• How the algorithm is implemented and contains errors is StackOverflow
• How to improve a working algorithm implementation is CodeReview
• How to use a Cryptographic library/software is SuperUser
• How to find a cryptographic library/software is Software Recommendations