What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

Do not report security issues on meta; contact Stack Exchange directly instead. For more information, see "How do I report a possible security vulnerability?" in the Help Center.


If I found a serious security issue (e.g. which makes it possible to use spam bots, sign in with fake OpenIDs etc...), what should I do?

  • Add a bug report on meta (which makes it possible for everyone to abuse it if they know the issue exists :-) )
  • Contact the Stack Overflow team (Jeff Atwood etc...)
  • Something different?

Oh, I don't say I found one, but, well, just in case...

share|improve this question
1  
You should use it to give me more rep then Jon Skeet! –  Dexter Sep 15 '09 at 20:42

4 Answers 4

E-mail team@stackoverflow.com

share|improve this answer
29  
...and put in your bid for the Hacker badge. –  Bill the Lizard Sep 15 '09 at 19:52

We encourage all security reports to be sent to team@stackoverflow.com and they are all followed up on.

That said I currently don't see any in the mailbox..

share|improve this answer
2  
Maybe he's just asking a hypothetical? Just in case though: everybody look for the hole! –  TM. Sep 15 '09 at 21:47
6  
Falls into a hole. –  Ólafur Waage Sep 15 '09 at 21:48
3  
Ólafur, look out for the hole. –  Bill the Lizard Sep 16 '09 at 2:02
2  
In addition to the hypothetical angle, I have a feeling this is a "Future Reference" kind of question... –  Margaret Sep 16 '09 at 11:50

After contacting the developers and giving them some time to fix the problem, if there is still no solution, I believe that it is appropriate to go public with it. As long as the developer is genuinely working with you to solve the problem and isn't simply invoking delaying tactics, I would hold off on going public. If they have had enough time and still haven't addressed it, then going public is a last resort to getting them to address a security issue. I wouldn't go so far as to give an implementation, but you should be able to give enough information that the problem is obvious to others.

share|improve this answer
3  
How does "going public" with a security hole help anybody? Maybe I'm misunderstanding, but that sounds more like a bullying tactic than an action performed by someone who genuinely cares about Stack Exchange and its users. –  jmort253 Sep 26 '13 at 18:35
4  
@jmort253 I was only suggesting it in the event that the concern wasn't being addressed. The fact that a security hole exists and isn't being addressed is sufficient reason to warn others who might be negatively impacted. E.g, say your bank has been warned about a security issue that would allow access to an arbitrary account. The bank is no more secure if it's never disclosed publicly; another, less scrupulous person could just as easily find it and exploit it. Going public, as a last resort, gives the bank's customers the ability to effect their own security by closing their account. –  tvanfosson Sep 26 '13 at 19:32
    
I guess I can see your logic, but there's so many layman-types out there, maybe not on Stack Exchange but definitely banking customers, that wouldn't really understand the impact of the bug; therefore, going public would just help nefarious individuals take advantage of those folks. To me, it feels like putting a sign up in your neighbor's front-yard announcing that he doesn't lock his doors, except your neighbor stores stuff for folks in the neighborhood, so the sign puts them at risk too if they don't have other options. –  jmort253 Sep 26 '13 at 21:52

If you contact them and nothing is done, then you should bring the information public. This is in line with the classic Full Disclosure Policy (RFPolicy), which seems very reasonable, at least in my opinion.

This doesn't mean that the team must fix it right away, but it does mean that they must get back to you right away, and you should be satisfied that they are actively working to fix the problem.

share|improve this answer
2  
Your link to that unofficial looking site you referenced is broken. How does bringing information like this public help the situation? That doesn't seem like something to do if you truly want to protect Stack Exchange and its users. –  jmort253 Sep 26 '13 at 18:36
2  
I just fixed the link. Bringing the information to the public (after the vendor (Stack Exchange, in this hypothetical example) has passed on a chance to work with your privately to try to fix the problem) at least makes them aware of the risk. They can then decide if they want to use the software, given the risk. At the point that you decide to make the information public, the vendor has given you no indication that they intend to fix the problem, you would be doing the community a disservice to keep the problem a secret. –  pkaeding Sep 29 '13 at 5:28
    
But suppose there's no other alternatives? Now you have folks who you've put at risk who have to keep using the software anyway. Or in many cases, you have the layperson who doesn't understand the impact. They're put at risk because you did the work for the lesser hackers who weren't smart enough to find the security holes on their own. The fact is that most things have security holes, and the most secure computer is one that's unplugged from the Internet, powered off, and unplugged. We all take risks everyday just using the Internet. –  jmort253 Sep 29 '13 at 6:24
    
It sounds like you are advocating security through obscurity. The users are at risk already. They just don't know it. Not knowing it doesn't make them any safer, and it arguably puts them in more danger because they can't take precautions to protect themselves. If they don't understand the impact, they won't do anything either way. –  pkaeding Sep 30 '13 at 22:34
    
Yeh, that is security through obscurity. I think you make a good point, and that point is valid. I just wish there was a way to protect people between making something public and that issue actually being fixed. That risk you talk about is greater once the issue is made public. I picture a risk graph that sits in medium, then goes to high once the announcement is made, then drops to low once it's fixed. It doesn't seem like there's a good answer there, but I can definitely see and respect your point. –  jmort253 Sep 30 '13 at 22:52
    
Maybe a better question is what counts as a "reasonable amount of time" and should one work with the organization to define a timeline to identify when that target date should be? –  jmort253 Sep 30 '13 at 22:52
    
Yeah, 'reasonable amount of time' is subjective. RFPolicy suggests 5 days (7 days has also been suggested) for an acknowledgement and for the communication channels to open up. This allows time for weekends, holidays, varying timezones/work schedules, etc. The problem doesn't need to be solved in 5-7 days, the idea is that the security researcher and the vendor will begin to communicate, and work together to solve the problem, over as much time as it takes. The important thing is that the vendor remains in communication with the researcher to assure him or her that they intend to solve it. –  pkaeding Oct 1 '13 at 0:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .