176 votes
Accepted

Is email from do-not-reply@stackoverflow.email legit?

Yes it is legit. We use it to protect stackoverflow.com user cookies from third parties. The links in the email are all rewritten to a stackoverflow.email subdomain, CNAMEd to a third party service we ...
m0sa's user avatar
  • 10.6k
139 votes
Accepted

"Stackoverflow has been compromised" post

Complete nonsense. That's the torrent of our regular public data dump. Note the torrent URL, the "hacker" is database guru extraordinaire Brent Ozar, and it's linked on http://www.brentozar.com/...
balpha's user avatar
  • 49.9k
118 votes
Accepted

Why does the Stack Overflow login form tell you whether a specific login exists or not?

Many people are very quick to point out that hinting that an email exists in the system as part of a login error is a bad idea. What most people don't talk about is that nearly all of those systems ...
nategood's user avatar
  • 11.8k
97 votes

Fixing answers that recommend "chmod 777"

Given the user's story, I believe the moderator did the wrong thing in this case. Leaving 154 helpful comments is doing a great service to our community. Doing it in a short amount of time is ...
erickson's user avatar
  • 264k
84 votes
Accepted

Problematic PHP Cryptography Advice in Popular Questions

I tend to agree with your notion. Lots of those "example" codes run in production environments worldwide, and it's better for everyone (not just the developer community, but everyone) if their data is ...
Madara's Ghost's user avatar
77 votes
Accepted

Compromised account or childish "I was there" graffiti?

I've logged them out, in case they left themselves at a public terminal, and temporarily suspended their account until they respond. We occasionally see this with university students or those using ...
Brad Larson's user avatar
  • 170k
74 votes
Accepted

Adding HTML tags or HTML-tag-like to a title, breaks rendering

The vulnerability has been closed (was related to turning off smarty-encoding for titles) and has been fixed (smarty-encoding is once again turned off network-wide). The vulnerability was on the ...
Yaakov Ellis's user avatar
  • 40.6k
70 votes
Accepted

What actions have been taken after the data leak reported on Feb 5 2019?

I'm feeling a whole lot of hate here. I'm not speaking metaphorically. I honestly feel like you and other people in comments really loathe and hate me. And not just the company, me in particular. ...
Tim Post's user avatar
  • 33.2k
65 votes
Accepted

Will there be any further updates on the security incident of May 5, 2019?

Thanks for your interest. While we haven’t found any more compromised users or data, our investigation is still ongoing. Unfortunately, these things can take considerable time. We still plan to post ...
Tim Post's user avatar
  • 33.2k
60 votes
Accepted

Blindly Copy-Pasting Code is BAD: A Gentle Reminder!

We should totally add a warning popup that appears whenever someone is copying code. You know, like this: The Learn more button should link to this meta thread, or the blog post. You may dismiss the ...
Bergi's user avatar
  • 622k
57 votes

Embedding Facebook avatars enables tracking of Stack Overflow users

Firefox has an answer in terms of containers, sandboxing a group of URLs so their cookies remain within that group/container. There is an official extension available that lets you create custom ...
Rahul K's user avatar
  • 101
54 votes
Accepted

Is Stack Overflow secure even when not using HTTPS?

No, there are a number of things about the http connection that are not secure. Your traffic can be sniffed. This means that someone can see what pages you're visiting. This may or may not be a ...
Laurel's user avatar
  • 5,944
53 votes

Globally fixing spam/malware taking advantage of JSBin quirk

I'm the author of JS Bin. Firstly, the redirect spam has long been a problem, and (I can only assume) since JS Bin is coming up on 8 years old, it's been the goto tool for abuse. I addressed the ...
Remy Sharp's user avatar
  • 4,510
49 votes
Accepted

Your team memberships are leaked to other websites

We've applied a tweak that should mitigate against this, thanks. when I am in fact a member of several teams (actual names redacted):
Marc Gravell's user avatar
45 votes

Should "Run Snippet" option have a reputation requirement? (To prevent... user stupidity and SE as an attack vector)

I think the problem is not in the snippets but with the owner of the router. If your router can be hacked by a stack snippet, it can also be hacked by a malicious banner ad or by any website for ...
GolezTrol's user avatar
  • 114k
43 votes
Accepted

Is this 'Run code snippet' with payload an attempt to infect SO users' machines with a virus?

At the moment, Stack Snippets are, to the best knowledge of experts who've considered the problem (both SE employees and standard users like ourselves), completely sandboxed and pretty safe to run. ...
CertainPerformance's user avatar
42 votes

Problematic PHP Cryptography Advice in Popular Questions

We've covered this before: How to deal with highly voted answers with security vulnerabilities? The general consensus is that if you can "fix" the answer without destroying it, do so. If not, it may ...
ircmaxell's user avatar
  • 163k
41 votes

Embedding Facebook avatars enables tracking of Stack Overflow users

"Stack Overflow directly links to profile pictures from Facebook, which allows Stack Overflow users to be tracked by Facebook - even if we don't have a Facebook account." First paragraph of the ...
chrislgarry's user avatar
38 votes
Accepted

My Stack Overflow profile's "About Me" section changed

To put it frankly, the edit came from your account on an existing login session from a couple days before. Past that, there's really not anything else we'd be able to tell you about what happened here ...
animuson's user avatar
  • 53.6k
37 votes
Accepted

Why do tags like <input> function as an HTML tag in the title of a question on Stack Overflow? Will this cause security issues?

Thanks for the heads-up! This is now fixed:
Shog9's user avatar
  • 156k
36 votes
Accepted

Poorly worded 8-year old question with hundreds of votes and security implications

I think some judicious editing would go a long way here. My first suggestion would be editing the question, especially the title. If you re-paint the search target so that it's square and turquoise ...
jscs's user avatar
  • 63.6k
34 votes

Why does the Stack Overflow login form tell you whether a specific login exists or not?

Jeff Atwood addressed this point in a relatively recent blog post relating to his experience making a login for Discourse. I assume the same mentality is held at Stack Overflow: OK, so we know that ...
Aaron Critchley's user avatar
31 votes

What actions have been taken after the data leak reported on Feb 5 2019?

We got an "oops, sorry, won't happen again" That's an unfair and inaccurate way to present Anita's answer. They answered with transparency, did not try to bail out of responsibility, and exposed what ...
Félix Adriyel Gagnon-Grenier's user avatar
25 votes

Blindly Copy-Pasting Code is BAD: A Gentle Reminder!

I think the comments on the questions should be addressed: This is malware. You can go take a flying leap. This is trolling. Malware: yes, this would probably qualify as malicious software. Abuse ...
Carcigenicate's user avatar
24 votes

What kind of Access Control is used on Stack Overflow?

I don't know the answer to your question about Stack Overflow specifically, but I wanted to respond to another part of what you said: "one of the main disadvantages of it is that it is not ...
Shriram Krishnamurthi's user avatar
23 votes

If there was an EMP from the sun would all of Stack Overflow's data be wiped out?

Yeah, probably.
Nick Craver's user avatar
21 votes

Poorly worded 8-year old question with hundreds of votes and security implications

Even if the answers were justified by the poor wording of the question, it seems to me that would just be reason to improve both the question and the answer(s). The purpose of Stack Overflow isn't to ...
David Conrad's user avatar
  • 15.2k

Only top scored, non community-wiki answers of a minimum length are eligible