Skip to main content
186 votes
Accepted

Is email from [email protected] legit?

Yes it is legit. We use it to protect stackoverflow.com user cookies from third parties. The links in the email are all rewritten to a stackoverflow.email subdomain, CNAMEd to a third party service we ...
m0sa's user avatar
  • 10.9k
74 votes
Accepted

Adding HTML tags or HTML-tag-like to a title, breaks rendering

The vulnerability has been closed (was related to turning off smarty-encoding for titles) and has been fixed (smarty-encoding is once again turned off network-wide). The vulnerability was on the ...
Yaakov Ellis's user avatar
  • 41.4k
59 votes
Accepted

Blindly Copy-Pasting Code is BAD: A Gentle Reminder!

We should totally add a warning popup that appears whenever someone is copying code. You know, like this: The Learn more button should link to this meta thread, or the blog post. You may dismiss the ...
Bergi's user avatar
  • 662k
57 votes

Embedding Facebook avatars enables tracking of Stack Overflow users

Firefox has an answer in terms of containers, sandboxing a group of URLs so their cookies remain within that group/container. There is an official extension available that lets you create custom ...
Rahul K's user avatar
  • 101
54 votes
Accepted

Is Stack Overflow secure even when not using HTTPS?

No, there are a number of things about the http connection that are not secure. Your traffic can be sniffed. This means that someone can see what pages you're visiting. This may or may not be a ...
Laurel's user avatar
  • 6,163
48 votes
Accepted

Your team memberships are leaked to other websites

We've applied a tweak that should mitigate against this, thanks. when I am in fact a member of several teams (actual names redacted):
Marc Gravell's user avatar
43 votes
Accepted

Is this 'Run code snippet' with payload an attempt to infect SO users' machines with a virus?

At the moment, Stack Snippets are, to the best knowledge of experts who've considered the problem (both SE employees and standard users like ourselves), completely sandboxed and pretty safe to run. ...
CertainPerformance's user avatar
40 votes

Embedding Facebook avatars enables tracking of Stack Overflow users

"Stack Overflow directly links to profile pictures from Facebook, which allows Stack Overflow users to be tracked by Facebook - even if we don't have a Facebook account." First paragraph of the ...
chrislgarry's user avatar
37 votes
Accepted

Poorly worded 8-year old question with hundreds of votes and security implications

I think some judicious editing would go a long way here. My first suggestion would be editing the question, especially the title. If you re-paint the search target so that it's square and turquoise ...
jscs's user avatar
  • 64k
37 votes
Accepted

Why do tags like <input> function as an HTML tag in the title of a question on Stack Overflow? Will this cause security issues?

Thanks for the heads-up! This is now fixed:
Shog9's user avatar
  • 159k
30 votes

What actions have been taken after the data leak reported on Feb 5 2019?

We got an "oops, sorry, won't happen again" That's an unfair and inaccurate way to present Anita's answer. They answered with transparency, did not try to bail out of responsibility, and exposed what ...
Félix Adriyel Gagnon-Grenier's user avatar
25 votes

Blindly Copy-Pasting Code is BAD: A Gentle Reminder!

I think the comments on the questions should be addressed: This is malware. You can go take a flying leap. This is trolling. Malware: yes, this would probably qualify as malicious software. Abuse ...
Carcigenicate's user avatar
24 votes

What kind of Access Control is used on Stack Overflow?

I don't know the answer to your question about Stack Overflow specifically, but I wanted to respond to another part of what you said: "one of the main disadvantages of it is that it is not ...
Shriram Krishnamurthi's user avatar
22 votes

Poorly worded 8-year old question with hundreds of votes and security implications

Even if the answers were justified by the poor wording of the question, it seems to me that would just be reason to improve both the question and the answer(s). The purpose of Stack Overflow isn't to ...
David Conrad's user avatar
  • 16.3k
20 votes

With Regards to the Security Update

I do have a minor quibble with this (and I do mean minor), but it does need saying Security Update If someone were to ask a question entitled that anywhere on SO/SE, it would be edited or closed. ...
Machavity's user avatar
  • 31.6k
19 votes

Adding HTML tags or HTML-tag-like to a title, breaks rendering

It appears that it included script tags as well. I was able to snap this screenshot at 2021-09-01T10:41:16Z before it was fixed:
jsejcksn's user avatar
  • 33.5k
19 votes

User (well, answerer) security on Stack Overflow

Let me start with saying that a comment that states: I asked the user what he was trying to do with that page, collect users' IP addresses or something. is unfriendly, if not harassment and that ...
rene's user avatar
  • 42.3k
18 votes

Stack Overflow account security is vulnerable

Stack Exchange is already covered as far as "Brute-force" attacks go: I got this verification request after only 3 phoney (manual) login attempts using Stack Overflow's own login option. I'm sure ...
Cerbrus's user avatar
  • 72.6k
17 votes

The Impact of Information Sources on Code Security

No, we don't have to change a thing. The developer copying and pasting code blindly from here, or the company that permits that thing to happen, is the entity that needs to change. The article ...
Makoto's user avatar
  • 106k
17 votes

Poorly worded 8-year old question with hundreds of votes and security implications

Related: Sample code within questions about cryptography / encryption Editing of Insecure Code Examples Flag posts with security issues How to Warn of Serious Issues in Code Unrelated to Question? ...
CodeCaster's user avatar
  • 151k
16 votes
Accepted

Suspicious email about the end of OpenID support

Yes, there is a legitimate email going out to all users with OpenID credentials attached to their account that will be expiring and will lock them out of their account. You previously only ever used ...
animuson's user avatar
  • 54.7k
15 votes
Accepted

Why is window.open() blocked?

Security. The moment you allow a window from a different domain to open, it gets access to the parent window and details about the parent page and can change the parent page.
Oded's user avatar
  • 498k
14 votes

Is Stack Overflow secure even when not using HTTPS?

The best that we know about is that it's still in progress. Here's a similar question on Meta Stack Exchange which has some details. To answer your specific questions... Your login is secured ...
Makoto's user avatar
  • 106k
14 votes

Has SO considered adding facilities for removing or obfuscating sensitive data contained in posts?

As others have pointed out, moderators currently have the ability to manually redact portions of a post to remove sensitive information. It requires two moderators to turn the key, because such ...
Brad Larson's user avatar
13 votes

Poorly worded 8-year old question with hundreds of votes and security implications

I would argue that keeping posts with bad advice around is really harmful, at any rate. The question and its answers have to go. I propose the following way of achieving this: Get some crypto-...
Siguza's user avatar
  • 23.7k

Only top scored, non community-wiki answers of a minimum length are eligible