We recently had the following question: [Timing vulnerability of byte array equality test?](https://crypto.stackexchange.com/q/51433/12164)

quote:

> Would the following code to test MAC equality leak timing information ? 

>     bool equal(unsigned char *a, unsigned char *b, int len) {
        unsigned char c = 0;
        for (int i = 0; i < len; i++) {
            c |= a[i] ^ b[i];
        }
        return c == 0;
    }

> More precisely, does the last expression `c == 0`leak timing
information ? 

> I don't think so, because it doesn't allow to know where would be the mismatch.

> Why are then some crypto libraries using complex expression to convert c into a 1 or 0 value than later simply compare that value with a simple == with 1 (or 0) ?

> Would a timing difference between MAC mismatch and identical MAC condition be relevant ?

Stripping the fluff, this contains 3 questions:

1. > More precisely, does the last expression 'c == 0' leak timing information ?
2. > Why are then some crypto libraries using complex expression to convert c into a 1 or 0 value than later simply compare that value with a simple == with 1 (or 0) ?
3. > Would a timing difference between MAC mismatch and identical MAC condition be relevant ?

The resulting answers all dive into things with coding examples and explanations about how compilers may (but are not guaranteed to) compile the code in a timing-attack safe way. Weirdly enough, none of the answers seems to answer number 3 which would have been the easiest and most crypt-related question contained.

Anyway, the question was close-voted with

> "Programming questions are off-topic even if you are writing or debugging cryptographic code. Unless your question is specifically about how the cryptographic algorithm or protocol works, you should look into asking on Stack Overflow instead." 

Several Crypto.SE seem to object and say that "some coding related questions" should be handled as on-topic.

Now… **I'm open to this**, but something tells me we should potentially adapt our close-reasons and help center texts accordingly, because two of 3 contained questions clash into what the system says.

1. > More precisely, does the last expression 'c == 0' leak timing information ?

 Is clearly about C coding. Compiler-related talk in all answers underline this fact.

 So, it contradicts our on-hold reason stating

 > "Programming questions are off-topic even if you are writing or debugging cryptographic code. Unless your question is specifically about how the cryptographic algorithm or protocol works, you should look into asking on Stack Overflow instead." 

 **How can/should we modify this on-hold reason so that is shows questions like the above are OK?*

 **And where exactly do we draw the clear line so that new users don't disrupt our system by pointing to such questions and claiming their question is alike?**

2. > Why are then some crypto libraries using complex expression to convert c into a 1 or 0 value than later simply compare that value with a simple == with 1 (or 0) ?

 Ignoring the fact "some crypto libraries" is rather broad and unclear since we don't know which ones OP is thinking about, this at its core again is a coding-related question, because it asks why "some crypto libraries" adher to a specific coding practice.

 If not already covered by the on-hold reason mentioned in the previous point, this also somewhat contradicts [our help center text](https://crypto.stackexchange.com/help/on-topic) going

 > If your question is about using a cryptographic library (e.g. Crypto++, OpenSSL etc) and using it in your application, you probably need Stack Overflow. (A good indicator is the existence of source code in your question or most good answers).

 Actually, this is exactly what happened in the Q&A. So the help center describes a situation we now have, but users obviously prefer to handle the Q&A on-topic. So we should think about clearing up the contradiction which arises by modifying/adapting this text to make clear when Crypto.SE is a valid target for crypto-coding questions and when it should be asked at SO (using the `crypto` tag at SO).

 **How can/should we modify this help center text so that is shows questions like the above are OK?**

 **And where exactly do we draw the clear line so that new users don't disrupt our system by pointing to such questions and claiming their question is alike?**