We will be upgrading our OpenSSL usage this morning to remove the Heartbleed vulnerability. I'll update this post when the live load balancers have been compiled and deployed against 1.0.1g.
We have to test just a bit and I'm just returning from a trip, so it'll be a few hours before this gets rolled out.
Update: We have rolled out a fix for the active ...
Here's one way they could have done it.
I was able to link you to a GitHub account based on a Dropbox link you posted (with a quick Google to make the connection). From there, I cloned your repository and your email address was visible in the raw Git commit data.
I also found a MozillaZine account, but I couldn't find any Chromium bug tracker connections....
For context: I'm someone who (A) enjoys the heck out of the Stack Exchange network, (B) very much appreciates when others take (my) data security seriously, and (C) can program sorta well but nowhere near on the level needed to evaluate security vulnerabilities (viz., I will never earn one of these rewards myself).
I think this is a fantastic idea.
We will be purchasing certificates for the network this week (dev is already in place), but there's still a lot left to do on the move to SSL. If you're curious about the details, you can read a recent blog post I wrote about it here.
It's far from a trivial task, but we're moving towards making SSL available and then the default. I'll continue to blog ...
Kevin Montrose's concern is that ordinary users will be confused by an entropy meter. That does not justify blocking good passwords, which is what the current system does.
A simple way to satisfy both criteria:
Calculate entropy in the background. Any password with entropy over some threshold will get accepted.
Passwords with less entropy than that fall ...
This is a fantastic idea. As I mentioned in a comment above, it has been requested by the security community for a long time, and will undoubtedly contribute greatly to the overall security of the platform (and possibly the security research community at large, if any findings are written up and published).
I am sure you've received this advice already, ...
Our apologies, not super clear on what happened here honestly.
When we saw this post a team member went looking for your ticket, found it (reply should be forthcoming, I don't have access to that system personally) and sent the details my way. A fix has been deployed.
We're going through our old tickets to see if anything else fell through the cracks, and ...
According to this check, it is vulnerable: http://filippo.io/Heartbleed/#stackoverflow.com
Edit: Fixed now. It can still be seen in this list of top 10000 sites that, like many others, it was vulnerable.
We don't give clients keys to just upload whatever they want for two reasons, and this is one of them. The other reason is that we need to check every creative for not just security, but also relevancy.
So if something gets on to our CDN for Adzerk to put into rotation, it's because an employee put it there.
We have a small handful of trusted partners (...
The user that contacted you performed a search, found your question, then visited your user page. He had no other contact with any of your other content. That's all the information our logs show.
As others have said, it's possible the user has access to an MD5-to-email lookup. To mitigate the ease of obtaining gravatar hashes, we've already removed ...
For what it's worth, Jeff now appears to believe that "maybe encrypted connections should be the default for all web sites."
I know that Jeff is leaving Stack Overflow in March 2012, but this post of his may be one indication that full HTTPS support is not all that far off.
The situation mentioned by @D.W. is very true. A simple calculation below suggests that all emails with less than 11 characters must be cracked, and I will give a motivation to do so.
The data dump here already contains all the MD5 hashed emails and the corresponding userid. Hence, it would be possible to do a brute force matching and there are someone do ...
Fixed in build rev 2014.1.7.1823 on meta and 2014.1.7.1277 on sites.
The POSTed data now gets validated against the list of flag types available to you. Additionally, it's now impossible to GET the popup GUI with the additional options (by using show-invalid=true) if you're not a 10k user.
The mail address in your profile is private, only mods and SE employees can see it and they are not allowed to share it with third parties. Sharing PII like mail addresses is covered by the moderator agreement, and each access to that information is logged as well. SE doesn't sell mail addresses or something like that as far as I know.
The usual way someone ...
There are some technical aspects of the Stack Exchange platform that could, at least in principle, allow someone to deduce your email address. I somehow doubt that it's what happened to you, but I'll document it here for posterity, since I haven't seen it written down anywhere else.
In particular, the MD5 hash of your email address is made publicly visible ...
I'd agree that from a privacy standpoint, banning users hosting images on servers they control would be beneficial.
In the DMZ it's been a long standing acknowledgement that people's locations can be uncovered in this way (well apart obviously from users using things like Tor) unless the user default blocks image loads.
So restricting image links (or ...
Whilst I can't fault the idea of Bug Bounties, there is some evidence coming through that they many sites on such programmes retain significant bugs even after a substantive period. So I would say get an application security testing company to make recommendations first and implement them (Declaration I don't work for one, although I do security test web ...
I agree with the principle, generally, that indicating which aspect of the credentials is incorrect (the email or password) gives attackers a larger surface area to attack; if the system tells them that the password is wrong, they know that the email is valid. If the system tells them that the email doesn't exist, they won't expend resources on trying to ...
Update: Thanks for the help, Gilles, Manishearth, and snailplane. Gilles' version ([\x00-\x08\x11\x12\x14-\x1f\x7f-\x9f]) will be going into production later today.
Could something be done about this?
I'm looking at putting this regex into production:
to strip out every control character that's not ...
A change has been deployed that ensures the transcript (and other code that uses the particular code-path) adds the correct hints, and the hints have been extended to use all of them (although I am informed that noreferrer by itself would work)
We were not directly affected.
The parser bug was introduced:
The earliest date memory could have leaked is 2016-09-22
Stack Exchange went off CloudFlare around June 2016.
The caveat is that it is entirely possible that some services we use were compromised - after all, a large amount of the Internet goes through CloudFlare.
There is now the Stack Exchange site: Internet of Things.
Its help center defines as on topic, questions about:
controlling, automating and sensing the environment using electronics ('smart devices'),
consumer technology used for home automation,
industrial applications of the Internet of Things, or
the security, privacy, reliability and safety ...
Can a hacker who hacked Facebook log into a linked Security.StackExchange account and suspend other accounts, edit the questions to point to malicious URLs, or delete content?
That's kind of the point of going in and changing your password and re-securing your Facebook account if your login information was compromised - so that people can't login to your ...
Yes PLEASE. I have spent a lot of time Removing link shorteners from posts! and many of the blacklisted link shorteners are actually image hosting services, so I have experience dealing with this.
Many image hosting services delete their images after a certain period of time. After this has happened, it can be IMPOSSIBLE to get a replacement.
There is only ...
Any way to get people to spend more time looking for security vulnerabilities and disclosure them responsibly is an obvious win. Not just for the Stack Exchange network admins, but for everyone using the site.