24 votes
Accepted

I found a bug on this website that allowed me to log in on my account without a password

https://stackexchange.com/about/security Describe to them in detail what you did, and where the security problem is. (My guess is that you used external authentication like google or openid)...
  • 19.9k
13 votes
Accepted

Ask Ubuntu site security

I think you're laboring under a misapprehension. This site (Ask Ubuntu) is not affiliated with Canonical and is instead a project of a completely different company: Stack Overflow. While there is ...
  • 94.4k
8 votes
Accepted

how to go forward with answers including ppa's?

I like to point to this page when referring to PPAs: Are PPA's safe to add to my system and what are some "red flags" to watch out for? I put this warning everytime I add a PPA to an ...
  • 69.3k
8 votes
Accepted

Device fingerprinting and user privacy

Moderators can redact sensitive information to permanently remove something from the site. If you see something you think is a serious issue, flag it up. We can't stop archiving services (eg Wayback) ...
  • 283k
8 votes
Accepted

Is there a way to verify integrity of a link in the answer?

There's no real way to determine if any given suggested piece of software or script contains hidden malicious actions. If you're that concerned, I suggest you run suspicious links and download items ...
  • 68.9k
6 votes
Accepted

How can we be safe about code from this site that we install?

Stack Overflow is far ahead of Ask Ubuntu at reviewing code because it's a programming website. In addition to Stack Overflow's normal way of reviewing code by users who volunteer to be reviewers and ...
  • 103k
5 votes

Ask Ubuntu site security

why does the page need the following scripts from the following sites to analyze performance issues to generate money to keep the servers running Regarding some of the URLs: google them ... 2 of ...
  • 282k
5 votes

Suspect malware behaviour when accessing askubuntu and or any stack exchange site from firefox

Interesting. My default with issues like this is to assume that this is localized to you. Thus far, no one else seems to be experiencing the same issues, so I'm leaning pretty heavily in that ...
  • 101
5 votes

How can we be safe about code from this site that we install?

ANY code that is going to be doing something you do not want will and must have a big fat warning. Most famous one: Why did the command ":(){ :|: & };:" make my system lag so badly I ...
  • 282k
5 votes

Should we add ephemeral security alerts on high priority vulnerabilities?

Well - while this started as a comment, it deserves a fuller answer so... It should be a comment. As per the help center Add relevant but minor or transient information to a post (e.g. a link to a ...
4 votes

How can we be safe about code from this site that we install?

Excellent things have been said already, but let me add a few words from someone who posts those code snippets once in a while. How can we be safe about code from this site that we install? You can't....
  • 80.5k
2 votes

how to go forward with answers including ppa's?

First of all, PPA's are perfectly acceptable as answers here. Sure, it may involve risks, but there's risks of getting malware or at least have vulnerabilities slip through even in official ...
2 votes

Should we add ephemeral security alerts on high priority vulnerabilities?

I will second what Journeyman Geek said: a comment is better. Especially since, in the specific case of CVE-2021-22204, the security vulnerability you pointed out, the issue has already been fixed in ...
  • 94.4k
1 vote

The StackExchange website keeps me logged in between sessions without asking me

That's what browser settings are for: if you insist on being logged out, set the StackExchange/AskUbuntu cookie to "Allow for session" in the exception rules. Applause
  • 33.9k

Only top scored, non community-wiki answers of a minimum length are eligible