Given the language in this announcement that lays blame at everyone else's feet except the people responsible for maintaining the platform, I'm pretty sure that no lessons were learned, and that the security is not likely to improve beyond whatever bandaids that were needed to address this hack.
In software outdated dependencies are vulnerabilities. The tech leadership knew this tradeoff and closed their eyes and hoped they'd get to it before someone else did. They did not and you shouldn't expect to be able to either.
If you do not have the resources to support the continual, ongoing updating of a dep, you do not the resources to add said dep.
I don't think advertisers, payment providers, service providers, or hardware vendors told 4chan what version of OpenBSD to run or how often to update packages. Those are tasks that require time and effort, yes, but they're not herculean. They could have been done. I think laziness and disinterest are the more likely reasons.
I have never heard of a bank’s core mainframes being hacked in the last decade (outside of pen tests), even for mid size banks outside the global top 100.
In 2017: > More than 40% of the population of America was potentially impacted by the Equifax data breach.
In 2022: > In September 2022, Optus experienced a major data breach that exposed the personal information of millions of customers
That's just 2 off the top of my head.
i.e. what they actually might spend millions of dollars per week on securing.
Everything else outside of that… banks obviously have incentives to cut security spending to as low as possible.
The claim was “ Get real. Companies with infinitely more money, staff, and robust security practices are hacked every day. ”
Banking core mainframes are the only thing I know of that gets anwhere near that kind of claim in terms of money, staff, and “robust security practices” 24/7/365.
And even then it’s far from infinite.
The fact is I provided a fairly comprehensive list of hacks and breaches, many coming from large public companies that spend more in a year on security than 4chan brings in for ad revenue in a decade.
Hence my point.
Are you even fully reading my comments?
If you only meant that your claim applies only within an upper limit of say 1000x… saying “infinitely more” is obviously going to mislead some fraction of the readerbase.
"I'm pretty sure that no lessons were learned." I would bet that was the case.