0

So sometimes I ask security questions, e.g. questions about sql-injection. And sometimes I ask questions about security configuration that are made easier to solve by linking to the site that I'm working on.

Unfortunately, this makes generally identifiable the site that has a security problem.

Rediculous example:

Q: My site has a sql-injection problem where if you pass the param: ?obliterate=1 it drops the database, how do I deal with this?

and:

Q: My site at example.com doesn't have the right apache config, blah, blah, blah.

How should I deal with that linkage issue? Anyone else considered that and come to a conclusion they'd like to share?

1
  • It may be worth pointing out that the first question is a programming issue (you need to sanitize your input), so is off topic for SF.
    – John Gardeniers
    Commented Jul 7, 2011 at 23:59

1 Answer 1

Reset to default
4

I just plain never reveal the actual URL of the server or any other non-public information. I carefully strip IPs, DNS, and internal server names from my examples/questions/answers/etc. I even do so for other people Q&A at times, especially if it's isn't 100% necessary to resolving the question.

I highly recommend figuring out how to ask question without divulging this information, though it's your choice (and opens you up to the problems you cited).

3
  • I do the same except for RFC 1918 addresses.
    – user9517
    Commented Jul 7, 2011 at 20:53
  • 5
    I use RFC 5737 addresses when I remember to do so.
    – Chris S
    Commented Jul 7, 2011 at 20:55
  • 1
    @Chris S - Wow, another day, another RFC learned that I had never seen before. Thanks!
    – EEAA
    Commented Jul 7, 2011 at 21:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .