19

I composed a set of SQL queries (searched from internet)

EXEC xp_dirtree 'C:\Program Files',1, 1
SELECT SERVERPROPERTY('ComputerNamePhysicalNetBIOS') As Host
EXEC master..xp_fixeddrives
select net_address from sysprocesses where spid = @@SPID
SELECT HOST_NAME() AS HostName, SUSER_NAME() LoggedInUser

Is this acceptable to the Stack Exchange team on the Stack Exchange Data Explorer?

Is there any norm which I should follow while querying this dumped data?

21

The only potential thing we want to keep secret here is xp_dirtree (we very much want the rest to be explorable - we're very public). The reason xp_dirtree was allowed was the result of a server move for our Denver data center setup (it's on a VM in New York right now). The extra security strip did not apply correctly, which has been corrected.

Thanks for the heads up! I'll make doubly sure the security changes get applied when we setup Denver's Data Explorer instance.

| improve this answer | |
  • 4
    Isn't, or wasn't, there a special Hacker badge that could be given to people who found legit security holes in the SE network? – user1228 Jul 10 '15 at 15:21
  • 1
    @Won't I'll never tell. There is a place we recognize those who point out severe security exploits here: stackexchange.com/about/security – Nick Craver Jul 10 '15 at 22:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .