87
votes
Recent site instability, major outages – July/August 2022
Any chance you guys can at least consider changing the error page from the "site is undergoing maintenance" that currently gets used? It’s very misleading, when the issues are not, in fact, ...
- 970
82
votes
Setting Up a HackerOne Security Bug Bounty Program
For context: I'm someone who (A) enjoys the heck out of the Stack Exchange network, (B) very much appreciates when others take (my) data security seriously, and (C) can program sorta well but nowhere ...
- 1,414
56
votes
Update on the ongoing DDoS attacks and blocking Tor exit nodes
During the last outage when Fastly's servers were down, Stack Overflow and many other websites were down. During that time, in Twitter, I saw a tweet that said that they are going to temporarily route ...
- 685
49
votes
Accepted
Update on the ongoing DDoS attacks and blocking Tor exit nodes
For the past 3 weeks we have been working to further strengthen our DDoS mitigation while also accounting for Tor traffic. At this point, we feel that we have been able to strike a good balance ...
- 10.5k
40
votes
Accepted
Malicious app that misuses Stack Overflow trademarks is up on the Google Play Store
Yeah, please do not install this app. Our Trust and Safety team is aware and is following up on this.
- 21.2k
36
votes
Setting Up a HackerOne Security Bug Bounty Program
This is a fantastic idea. As I mentioned in a comment above, it has been requested by the security community for a long time, and will undoubtedly contribute greatly to the overall security of the ...
- 2,087
35
votes
Accepted
Your handling of security reports is disappointing
Our apologies, not super clear on what happened here honestly.
When we saw this post a team member went looking for your ticket, found it (reply should be forthcoming, I don't have access to that ...
- 60.2k
32
votes
Malicious app that misuses Stack Overflow trademarks is up on the Google Play Store
Enough of these, and hopefully someone in Google will notice and nuke this out of orbit.
- 175k
31
votes
A deeper dive into the May 2019 security incident: blog post feedback
Can you make any comment about the attackers intentions?
Does it appear they were after a certain goal / certain (user) data?
Or was it perhaps more of a "curious teenager" poking with ...
- 36.2k
30
votes
A deeper dive into the May 2019 security incident: blog post feedback
This line:
This act of looking up things (visiting questions) across the Stack Exchange Network becomes a frequent occurrence and allows us to anticipate and understand the attacker’s methodology ...
- 84k
29
votes
Accepted
Who is Samuel Ordonez and why are they a moderator here?
They are staff. Something obviously went wrong with onboarding or an account merge and left them listed as a mod, but without the staff label. This has been fixed (and we'll follow up internally to ...
- 64k
27
votes
Testing new traffic management tool
Thank you for the (early) heads-up. I have two questions though:
What is the goal you're trying to achieve by implementing this tool?
Can the maintenance entrance on StackStatus include a hyperlink, ...
- 36.2k
26
votes
Recent site instability, major outages – July/August 2022
Stack Overflow for Teams Enterprise was unaffected
Was this because the SO Teams Enterprise product has less traffic in general, because it wasn't targeted, or because it has a better security ...
- 28k
23
votes
Setting Up a HackerOne Security Bug Bounty Program
Whilst I can't fault the idea of Bug Bounties, there is some evidence coming through that they many sites on such programmes retain significant bugs even after a substantive period. So I would say get ...
- 331
23
votes
Allowing images from external sources opens doors to serious security exploits and privacy risks
What is possible with this vulnerability?
Oh, it's way worse than tracking.
Determining the IP addresses of specific chat users or (with less accuracy) highly active users on main
This involves ...
- 5,134
23
votes
Accepted
Possible to see any user's site preferences (privacy breach)
Thanks for reporting! This has been fixed in rev 2020.11.4.37941.
- 22.2k
23
votes
A deeper dive into the May 2019 security incident: blog post feedback
Several questions related mainly to the attacker:
What happened to the attacker?
Did you suspend their account?
Did SE contact the attacker at any point?
Why don't you expose the attacker's identity?
...
- 175k
22
votes
Is there a stack site for home automation / home security?
There is now the Stack Exchange site: Internet of Things.
Its help center defines as on topic, questions about:
controlling, automating and sensing the environment using electronics ('smart ...
- 466
22
votes
Are there any updates to the May 17, 2019 security incident?
SE did make a statement on what kind of data was affected by the security breach, and notified the affected users. That is the reasonable minimum I'd expect from any company. Anything more could be ...
- 190k
21
votes
A deeper dive into the May 2019 security incident: blog post feedback
Was there a detectable sleep cycle at the other end of events?
Edit to clarify:
After becoming aware of the attacker, and since you followed some of their actions as they unfolded, did you notice ...
- 28k
21
votes
Recent site instability, major outages – July/August 2022
Please say the status page is not hosted on the same infrastructure as the rest of SE... I'd hate for that to go down at the same time as an outage on the rest of SE.
- 3,930
20
votes
Accepted
Was the Stack Exchange network affected by the Cloudflare parser bug?
We were not directly affected.
The parser bug was introduced:
The earliest date memory could have leaked is 2016-09-22
Stack Exchange went off CloudFlare around June 2016.
The caveat is that it ...
- 155k
20
votes
Accepted
Can a hacker who hacked a Facebook account access security.stackexchange.com through their linked OAuth account?
Can a hacker who hacked Facebook log into a linked Security.StackExchange account and suspend other accounts, edit the questions to point to malicious URLs, or delete content?
That's kind of the ...
- 190k
19
votes
Accepted
Chat links expose a pretty serious JavaScript exploit
A change has been deployed that ensures the transcript (and other code that uses the particular code-path) adds the correct hints, and the hints have been extended to use all of them (although I am ...
- 93.1k
19
votes
A deeper dive into the May 2019 security incident: blog post feedback
This is not really part of the incident, but a more general concern about security measures around employee accounts. There were a lot of steps in this incident, but the final one was escalating ...
- 190k
18
votes
A deeper dive into the May 2019 security incident: blog post feedback
At around the same time this security incident happened, a few days later, some users began noticing that Twitter oneboxing in chat wasn't working anymore. An employee subsequently confirmed in ...
17
votes
Users are able to register apps that look official (for phishing)
I quite like GitHub's OAuth login screen, which I think we could take ideas from (if you want to see it yourself, try using Login-with for an example):
Here it clearly states that it's not ...
- 19.3k
16
votes
How did TIBCO / Marketo obtain my Stack Exchange profile e-mail address for spamming?
Could've still been the Gravatar thing, if you were using that particular email with Gravatar back before we started salting them.
For several years, the hash that's used to generate the Gravatar ...
- 454k
15
votes
Accepted
Dealing with highly sensitive personal information in a post
Irrespective of any actions that you take outside of the site, I think that you should flag the post and ask the moderators of that site to redact the information:
When to redact revisions?
Even if ...
- 35.8k
Only top scored, non community-wiki answers of a minimum length are eligible