176
votes
Accepted
Is email from do-not-reply@stackoverflow.email legit?
Yes it is legit. We use it to protect stackoverflow.com user cookies from third parties. The links in the email are all rewritten to a stackoverflow.email subdomain, CNAMEd to a third party service we ...
139
votes
Accepted
"Stackoverflow has been compromised" post
Complete nonsense. That's the torrent of our regular public data dump. Note the torrent URL, the "hacker" is database guru extraordinaire Brent Ozar, and it's linked on http://www.brentozar.com/...
118
votes
Accepted
Why does the Stack Overflow login form tell you whether a specific login exists or not?
Many people are very quick to point out that hinting that an email exists in the system as part of a login error is a bad idea. What most people don't talk about is that nearly all of those systems ...
97
votes
Fixing answers that recommend "chmod 777"
Given the user's story, I believe the moderator did the wrong thing in this case.
Leaving 154 helpful comments is doing a great service to our community. Doing it in a short amount of time is ...
84
votes
Accepted
Problematic PHP Cryptography Advice in Popular Questions
I tend to agree with your notion. Lots of those "example" codes run in production environments worldwide, and it's better for everyone (not just the developer community, but everyone) if their data is ...
77
votes
Accepted
Compromised account or childish "I was there" graffiti?
I've logged them out, in case they left themselves at a public terminal, and temporarily suspended their account until they respond. We occasionally see this with university students or those using ...
Brad LarsonMod
- 170k
74
votes
Accepted
Adding HTML tags or HTML-tag-like to a title, breaks rendering
The vulnerability has been closed (was related to turning off smarty-encoding for titles) and has been fixed (smarty-encoding is once again turned off network-wide).
The vulnerability was on the ...
70
votes
Accepted
What actions have been taken after the data leak reported on Feb 5 2019?
I'm feeling a whole lot of hate here.
I'm not speaking metaphorically. I honestly feel like you and other people in comments really loathe and hate me. And not just the company, me in particular. ...
65
votes
Accepted
Will there be any further updates on the security incident of May 5, 2019?
Thanks for your interest.
While we haven’t found any more compromised users or data, our investigation is still ongoing. Unfortunately, these things can take considerable time. We still plan to post ...
60
votes
Accepted
Blindly Copy-Pasting Code is BAD: A Gentle Reminder!
We should totally add a warning popup that appears whenever someone is copying code. You know, like this:
The Learn more button should link to this meta thread, or the blog post. You may dismiss the ...
57
votes
Embedding Facebook avatars enables tracking of Stack Overflow users
Firefox has an answer in terms of containers, sandboxing a group of URLs so their cookies remain within that group/container.
There is an official extension available that lets you create custom ...
54
votes
Accepted
Is Stack Overflow secure even when not using HTTPS?
No, there are a number of things about the http connection that are not secure.
Your traffic can be sniffed. This means that someone can see what pages you're visiting. This may or may not be a ...
53
votes
Globally fixing spam/malware taking advantage of JSBin quirk
I'm the author of JS Bin.
Firstly, the redirect spam has long been a problem, and (I can only assume) since JS Bin is coming up on 8 years old, it's been the goto tool for abuse.
I addressed the ...
49
votes
Accepted
Your team memberships are leaked to other websites
We've applied a tweak that should mitigate against this, thanks.
when I am in fact a member of several teams (actual names redacted):
45
votes
Should "Run Snippet" option have a reputation requirement? (To prevent... user stupidity and SE as an attack vector)
I think the problem is not in the snippets but with the owner of the router.
If your router can be hacked by a stack snippet, it can also be hacked by a malicious banner ad or by any website for ...
43
votes
Accepted
Is this 'Run code snippet' with payload an attempt to infect SO users' machines with a virus?
At the moment, Stack Snippets are, to the best knowledge of experts who've considered the problem (both SE employees and standard users like ourselves), completely sandboxed and pretty safe to run. ...
42
votes
Problematic PHP Cryptography Advice in Popular Questions
We've covered this before: How to deal with highly voted answers with security vulnerabilities?
The general consensus is that if you can "fix" the answer without destroying it, do so. If not, it may ...
41
votes
Embedding Facebook avatars enables tracking of Stack Overflow users
"Stack Overflow directly links to profile pictures from Facebook, which allows Stack Overflow users to be tracked by Facebook - even if we don't have a Facebook account."
First paragraph of the ...
38
votes
Accepted
My Stack Overflow profile's "About Me" section changed
To put it frankly, the edit came from your account on an existing login session from a couple days before. Past that, there's really not anything else we'd be able to tell you about what happened here ...
37
votes
Accepted
Why do tags like <input> function as an HTML tag in the title of a question on Stack Overflow? Will this cause security issues?
Thanks for the heads-up! This is now fixed:
36
votes
Accepted
Poorly worded 8-year old question with hundreds of votes and security implications
I think some judicious editing would go a long way here.
My first suggestion would be editing the question, especially the title. If you re-paint the search target so that it's square and turquoise ...
34
votes
Why does the Stack Overflow login form tell you whether a specific login exists or not?
Jeff Atwood addressed this point in a relatively recent blog post relating to his experience making a login for Discourse. I assume the same mentality is held at Stack Overflow:
OK, so we know that ...
31
votes
What actions have been taken after the data leak reported on Feb 5 2019?
We got an "oops, sorry, won't happen again"
That's an unfair and inaccurate way to present Anita's answer. They answered with transparency, did not try to bail out of responsibility, and exposed what ...
25
votes
Blindly Copy-Pasting Code is BAD: A Gentle Reminder!
I think the comments on the questions should be addressed:
This is malware. You can go take a flying leap.
This is trolling.
Malware: yes, this would probably qualify as malicious software. Abuse ...
24
votes
What kind of Access Control is used on Stack Overflow?
I don't know the answer to your question about Stack Overflow specifically, but I wanted to respond to another part of what you said: "one of the main disadvantages of it is that it is not ...
23
votes
21
votes
Poorly worded 8-year old question with hundreds of votes and security implications
Even if the answers were justified by the poor wording of the question, it seems to me that would just be reason to improve both the question and the answer(s). The purpose of Stack Overflow isn't to ...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
security × 80discussion × 37
support × 19
bug × 15
feature-request × 14
status-completed × 9
ssl × 7
privacy × 6
answers × 4
stack-snippets × 4
login × 4
stack-overflow-for-teams × 3
accounts × 3
reputation × 2
status-bydesign × 2
spam × 2
moderation × 2
advertising × 2
email × 2
merge-accounts × 2
ethics × 2
copycat-sites × 2
logout × 2
specific-question × 1
flags × 1