About a year ago, there was a security incident on Stack Exchange.
The last blog post I found on that matter concludes with:
We will provide more public information after our investigation cycle concludes.
... which I couldn't find. I'm not asking to blame anyone (maybe it has simply been forgotten in the end-2019 trouble), but as I'm a curious person, I'd like to know whether there are any updates or if the matter was simply dropped.
We have just been able to post about more of the details of what happened during the incident. Please read about it on our blog and discuss on MSE.
SE did make a statement on what kind of data was affected by the security breach, and notified the affected users. That is the reasonable minimum I'd expect from any company. Anything more could be dismissed as idle curiosity by the SE community, but I don't think that is the only reason we have to ask for more details on this. I mean, it's still a good reason to ask, many of us would like to know the details to learn more about this kind of issue. But aside from that, the details are also important so that SE can convince the community that it does protect our data properly. This is even more important with the focus on Teams, which has potentially much more sensitive data than the public sites.
Right now the public communication looks like what you'd expect from any big non-technical company. It fulfills the minimum requirements, but nothing more. Many developer-focused companies have provided extensive public post-mortems on security issues. Those are an invaluable educational resource for developers, and they help to restore trust in the company. Developers understand that everyone will have security issues at some point, what distinguishes good and bad companies is how they handle them. Right now, SE is pretty solidly in the "meh" category for this one.
There are two major reasons I can think of why the details were not made public by SE. Either they are particularly embarrassing, or the details are still valuable for potential future attacks. The first one is understandable, but really not a good enough reason. The second one would be rather worrying, as it would mean that there are bigger security problems with the SE infrastructure than just a specific bug that was exploited.
One thing that stood out to me (and quite a few other people as far as I remember) is that the attacker was able to jump from the devel server to production in some way. This indicates that devel and production are more closely linked than they should be, and this is exactly the kind of bigger problem where SE should do their best to convince us that they have fixed the bigger picture, and not just that one hole.
