4

Recently an employee has posted some code at SO which exposes some of the security details which are used in the code. And the same employee is not aware / no longer working with the organisation.

The post doesn't have any mistakes or issues. The only thing is that it shows some confidential data. Is it acceptable to edit the post and remove that information?

These meta posts didn't give any idea on said situation:

10
  • 2
    Does your company make employees sign a NDA? If so you should be able to contact that person directly and tell them to remove it themselves but keep in mind that once it's been posted online you'll have to assume it's now public knowledge.
    – ivarni
    Commented Jan 28, 2016 at 6:52
  • @ivarni company has a NDA in place..also is it acceptable if an immediate edit is done at SO ?
    – Tharif
    Commented Jan 28, 2016 at 6:53
  • 2
    You have full edit privileges so if you refer to the fact that they have signed a NDA in the edit description I don't see how that would be a problem.
    – ivarni
    Commented Jan 28, 2016 at 7:07
  • 2
    This doesn't address the question, but the security of your product should not rely on the algorithms used to protect it - only on the key (see Kerckhoffs's principle). Assume that an attacker has the source code (they can decompile the binary). If the post has revealed the key, then that was really dumb. (Note: It will probably be a mistake for you to respond to this comment as any response will probably leak information you want to keep private.) Commented Jan 28, 2016 at 8:10
  • @MartinBonner if the revelations had any crucial security keys the only help would be SE team i think..
    – Tharif
    Commented Jan 28, 2016 at 8:15
  • @utility No, if keys was posted you must assume an attacker already has them, removing them from SO after-the-fact does not mitigate the issue.
    – ivarni
    Commented Jan 28, 2016 at 8:41
  • 1
    @utility depending on the situation, you may find Dealing with a claim that a post on SO is using copyrighted content without permission useful. Since it wasn't your account that posted the content, you may be told you have to claim a copyright infringement. Commented Jan 28, 2016 at 9:42
  • @ivarni: You are right that if the keys have been posted you should assume an attacker has them - but removing them from SO can mitigate the issue. Commented Jan 28, 2016 at 9:54
  • 1
    @MartinBonner If keys were posted they must be changed, leaving the old ones unusable. If anything is mitigated from removing the now unusable keys it's not much but probably marginally better than nothing.
    – ivarni
    Commented Jan 28, 2016 at 9:58
  • @ivarni: You usually can't force users to upgrade, and they can be reluctant to do so even if it is a security vulnerability in a security critical component. Removing the keys somewhat reduces the chances those users will come to harm. Commented Jan 28, 2016 at 10:00

1 Answer 1

6

While you could edit the immediate, top-facing post and remove the sensitive information, that doesn't address the other issue: anyone with a link to that particular page can go back and review the edit history on it, or potentially perform a rollback if your actions are considered hostile to the post overall.

This is a good opportunity to flag it for moderator attention. Provide as much information as you can and explain to them that this post contains sensitive information, and they can alert Stack Exchange employees to remove any trace of it from the database.

Merely taking it into your own hands isn't advisable. It also puts a huge target on you too, since what you edit is also public record, and it isn't hard to infer which question had the sensitive information.

1
  • exactly that was why i didnt make any change in the same..I hope contacting SE will be the best solution..thanks
    – Tharif
    Commented Jan 28, 2016 at 7:32

Not the answer you're looking for? Browse other questions tagged .