19

I composed a set of SQL queries (searched from internet)

EXEC xp_dirtree 'C:\Program Files',1, 1
SELECT SERVERPROPERTY('ComputerNamePhysicalNetBIOS') As Host
EXEC master..xp_fixeddrives
select net_address from sysprocesses where spid = @@SPID
SELECT HOST_NAME() AS HostName, SUSER_NAME() LoggedInUser

Is this acceptable to the Stack Exchange team on the Stack Exchange Data Explorer?

Is there any norm which I should follow while querying this dumped data?

Improve this question

1 Answer 1

Reset to default
23

The only potential thing we want to keep secret here is xp_dirtree (we very much want the rest to be explorable - we're very public). The reason xp_dirtree was allowed was the result of a server move for our Denver data center setup (it's on a VM in New York right now). The extra security strip did not apply correctly, which has been corrected.

Thanks for the heads up! I'll make doubly sure the security changes get applied when we setup Denver's Data Explorer instance.

Improve this answer
2
  • 4
    Isn't, or wasn't, there a special Hacker badge that could be given to people who found legit security holes in the SE network?
    – user1228
    Jul 10, 2015 at 15:21
  • 1
    @Won't I'll never tell. There is a place we recognize those who point out severe security exploits here: stackexchange.com/about/security
    – Nick Craver
    Jul 10, 2015 at 22:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .