37

About a year ago, there was a security incident on Stack Exchange.

The last blog post I found on that matter concludes with:

We will provide more public information after our investigation cycle concludes.

... which I couldn't find. I'm not asking to blame anyone (maybe it has simply been forgotten in the end-2019 trouble), but as I'm a curious person, I'd like to know whether there are any updates or if the matter was simply dropped.

2
  • Probably nothing interesting, it all boils down to a bug in the code allowing the hacker to get access. Doubt they will reveal what code, at least not until it's all re-written in the far future. – Shadow Wizard Wearing Mask V2 Aug 2 '20 at 8:52
  • 11
    @Shadow Quite possible, yet there was a promise for more, public, information. So they must've seen possibilities to share part of the details without compromising security. – Mast Aug 2 '20 at 12:32
13

We have just been able to post about more of the details of what happened during the incident. Please read about it on our blog and discuss on MSE.

0
22

SE did make a statement on what kind of data was affected by the security breach, and notified the affected users. That is the reasonable minimum I'd expect from any company. Anything more could be dismissed as idle curiosity by the SE community, but I don't think that is the only reason we have to ask for more details on this. I mean, it's still a good reason to ask, many of us would like to know the details to learn more about this kind of issue. But aside from that, the details are also important so that SE can convince the community that it does protect our data properly. This is even more important with the focus on Teams, which has potentially much more sensitive data than the public sites.

Right now the public communication looks like what you'd expect from any big non-technical company. It fulfills the minimum requirements, but nothing more. Many developer-focused companies have provided extensive public post-mortems on security issues. Those are an invaluable educational resource for developers, and they help to restore trust in the company. Developers understand that everyone will have security issues at some point, what distinguishes good and bad companies is how they handle them. Right now, SE is pretty solidly in the "meh" category for this one.

There are two major reasons I can think of why the details were not made public by SE. Either they are particularly embarrassing, or the details are still valuable for potential future attacks. The first one is understandable, but really not a good enough reason. The second one would be rather worrying, as it would mean that there are bigger security problems with the SE infrastructure than just a specific bug that was exploited.

One thing that stood out to me (and quite a few other people as far as I remember) is that the attacker was able to jump from the devel server to production in some way. This indicates that devel and production are more closely linked than they should be, and this is exactly the kind of bigger problem where SE should do their best to convince us that they have fixed the bigger picture, and not just that one hole.

4
  • 2
    Good points. An other thing that I thought about was, that some of the devs wrote (or still write? I don't know) quite extensive and interesting to read post-mortems on outages and the like, so it's not like SE hasn't "own historical precedent" with being transparent about own dev problems, others might have, too. – MEE Aug 2 '20 at 19:25
  • 2
    I was one of the affected users. I received no information beyond what's in the blog post (and the fact that my account was affected). [for completeness: I was no longer working for SO at the time] – balpha Aug 5 '20 at 15:26
  • @balpha not even which specific data was accessed in your account? That's the minimum I would have expected. – Mad Scientist Aug 5 '20 at 15:43
  • 1
    @MadScientist Just what the blog post says, "IP address, names, or emails", and that they "may or may not have actually been seen by the hacker, but it was possible." – balpha Aug 5 '20 at 15:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .