87 votes

Recent site instability, major outages – July/August 2022

Any chance you guys can at least consider changing the error page from the "site is undergoing maintenance" that currently gets used? It’s very misleading, when the issues are not, in fact, ...
  • 970
80 votes

Setting Up a HackerOne Security Bug Bounty Program

For context: I'm someone who (A) enjoys the heck out of the Stack Exchange network, (B) very much appreciates when others take (my) data security seriously, and (C) can program sorta well but nowhere ...
  • 1,364
56 votes

Update on the ongoing DDoS attacks and blocking Tor exit nodes

During the last outage when Fastly's servers were down, Stack Overflow and many other websites were down. During that time, in Twitter, I saw a tweet that said that they are going to temporarily route ...
49 votes
Accepted

Update on the ongoing DDoS attacks and blocking Tor exit nodes

For the past 3 weeks we have been working to further strengthen our DDoS mitigation while also accounting for Tor traffic. At this point, we feel that we have been able to strike a good balance ...
  • 6,829
40 votes
Accepted

Malicious app that misuses Stack Overflow trademarks is up on the Google Play Store

Yeah, please do not install this app. Our Trust and Safety team is aware and is following up on this.
  • 13.1k
35 votes

Setting Up a HackerOne Security Bug Bounty Program

This is a fantastic idea. As I mentioned in a comment above, it has been requested by the security community for a long time, and will undoubtedly contribute greatly to the overall security of the ...
35 votes
Accepted

Your handling of security reports is disappointing

Our apologies, not super clear on what happened here honestly. When we saw this post a team member went looking for your ticket, found it (reply should be forthcoming, I don't have access to that ...
33 votes
Accepted

How will Stack Exchange ensure security of adverts?

We don't give clients keys to just upload whatever they want for two reasons, and this is one of them. The other reason is that we need to check every creative for not just security, but also ...
  • 179k
32 votes

Malicious app that misuses Stack Overflow trademarks is up on the Google Play Store

Enough of these, and hopefully someone in Google will notice and nuke this out of orbit.
31 votes

A deeper dive into the May 2019 security incident: blog post feedback

Can you make any comment about the attackers intentions? Does it appear they were after a certain goal / certain (user) data? Or was it perhaps more of a "curious teenager" poking with ...
  • 35k
30 votes

A deeper dive into the May 2019 security incident: blog post feedback

This line: This act of looking up things (visiting questions) across the Stack Exchange Network becomes a frequent occurrence and allows us to anticipate and understand the attacker’s methodology ...
29 votes
Accepted

Who is Samuel Ordonez and why are they a moderator here?

They are staff. Something obviously went wrong with onboarding or an account merge and left them listed as a mod, but without the staff label. This has been fixed (and we'll follow up internally to ...
  • 59.5k
27 votes

Testing new traffic management tool

Thank you for the (early) heads-up. I have two questions though: What is the goal you're trying to achieve by implementing this tool? Can the maintenance entrance on StackStatus include a hyperlink, ...
  • 35k
26 votes

Recent site instability, major outages – July/August 2022

Stack Overflow for Teams Enterprise was unaffected Was this because the SO Teams Enterprise product has less traffic in general, because it wasn't targeted, or because it has a better security ...
  • 25.7k
24 votes
Accepted

How to handle possible user tracking through images?

I'd agree that from a privacy standpoint, banning users hosting images on servers they control would be beneficial. In the DMZ it's been a long standing acknowledgement that people's locations can be ...
23 votes

Setting Up a HackerOne Security Bug Bounty Program

Whilst I can't fault the idea of Bug Bounties, there is some evidence coming through that they many sites on such programmes retain significant bugs even after a substantive period. So I would say get ...
  • 331
23 votes

A deeper dive into the May 2019 security incident: blog post feedback

Several questions related mainly to the attacker: What happened to the attacker? Did you suspend their account? Did SE contact the attacker at any point? Why don't you expose the attacker's identity? ...
22 votes

Is there a stack site for home automation / home security?

There is now the Stack Exchange site: Internet of Things. Its help center defines as on topic, questions about: controlling, automating and sensing the environment using electronics ('smart ...
  • 466
22 votes

Are there any updates to the May 17, 2019 security incident?

SE did make a statement on what kind of data was affected by the security breach, and notified the affected users. That is the reasonable minimum I'd expect from any company. Anything more could be ...
21 votes
Accepted

Possible to see any user's site preferences (privacy breach)

Thanks for reporting! This has been fixed in rev 2020.11.4.37941.
  • 22.1k
21 votes

A deeper dive into the May 2019 security incident: blog post feedback

Was there a detectable sleep cycle at the other end of events? Edit to clarify: After becoming aware of the attacker, and since you followed some of their actions as they unfolded, did you notice ...
  • 25.7k
21 votes

Recent site instability, major outages – July/August 2022

Please say the status page is not hosted on the same infrastructure as the rest of SE... I'd hate for that to go down at the same time as an outage on the rest of SE.
20 votes

Allowing images from external sources opens doors to serious security exploits and privacy risks

Yes PLEASE. I have spent a lot of time Removing link shorteners from posts! and many of the blacklisted link shorteners are actually image hosting services, so I have experience dealing with this. ...
  • 38.4k
20 votes
Accepted

Can a hacker who hacked a Facebook account access security.stackexchange.com through their linked OAuth account?

Can a hacker who hacked Facebook log into a linked Security.StackExchange account and suspend other accounts, edit the questions to point to malicious URLs, or delete content? That's kind of the ...
  • 186k
19 votes
Accepted

Chat links expose a pretty serious JavaScript exploit

A change has been deployed that ensures the transcript (and other code that uses the particular code-path) adds the correct hints, and the hints have been extended to use all of them (although I am ...
  • 92.5k
19 votes
Accepted

Was the Stack Exchange network affected by the Cloudflare parser bug?

We were not directly affected. The parser bug was introduced: The earliest date memory could have leaked is 2016-09-22 Stack Exchange went off CloudFlare around June 2016. The caveat is that it ...
  • 154k
19 votes

A deeper dive into the May 2019 security incident: blog post feedback

This is not really part of the incident, but a more general concern about security measures around employee accounts. There were a lot of steps in this incident, but the final one was escalating ...
18 votes

A deeper dive into the May 2019 security incident: blog post feedback

At around the same time this security incident happened, a few days later, some users began noticing that Twitter oneboxing in chat wasn't working anymore. An employee subsequently confirmed in ...
17 votes

Allowing images from external sources opens doors to serious security exploits and privacy risks

What is possible with this vulnerability? Oh, it's way worse than tracking. Determining the IP addresses of specific chat users or (with less accuracy) highly active users on main This involves ...

Only top scored, non community-wiki answers of a minimum length are eligible