Maybe they should have installed CrowdStrike
Researcher finds flaw in a16z website that exposed some company data
11–20 of 246 posts
Re: Researcher finds flaw in a16z website that exposed some company data
#12Isn't it fairly easy to get an address like marca's? I'm sure anyone who is responsible for the place would make the connection to IT security.
Re: Researcher finds flaw in a16z website that exposed some company data
#13Sincere question: how do you actually make this mistake while having the skills to build a web app of this complexity level? All the frontend and full stack frameworks that I’m familiar with try pretty hard to stop you.
Don’t mistake complexity for intelligence.
Re: Researcher finds flaw in a16z website that exposed some company data
#14Sincere question: how do you actually make this mistake while having the skills to build a web app of this complexity level? All the frontend and full stack frameworks that I’m familiar with try pretty hard to stop you.
I’ve seen people make exactly this mistake with Next.js. IMO React server components is a fantastic tool for losing track of what’s exposed client side and what isn’t.
Re: Researcher finds flaw in a16z website that exposed some company data
#15Sincere question: how do you actually make this mistake while having the skills to build a web app of this complexity level? All the frontend and full stack frameworks that I’m familiar with try pretty hard to stop you.
It only takes a single mistake.
A little tired because you didn't sleep well, or worried about a relative in the hospital, or you stubbed your toe that morning and it's distracting... and whoops.
Re: Researcher finds flaw in a16z website that exposed some company data
#16Maybe they should have installed CrowdStrike
Cant get hacked if youre bluescreened.
Re: Researcher finds flaw in a16z website that exposed some company data
#17when companies say they are “hacked”, it’s now a corporate term for “we were negligent in securing important credentials, but please shift blame to this no-name entity we called a ‘hacker’”
If you accidentally leave your front door wide open and somebody steals all your stuff, you'll also say that you were robbed.
There might be a legal distinction between "breaking and entering", "burglary", "trespassing" etc, and in a legal sense, whether the front door was open might have some impact on whether the act was illegal or not and what the consequences are, but in colloquial usage, you've still been robbed.
Re: Researcher finds flaw in a16z website that exposed some company data
#18Crypto bullshit - a16z pipeline is a great reflection of a16z as a firm.
Re: Researcher finds flaw in a16z website that exposed some company data
#19Sincere question: how do you actually make this mistake while having the skills to build a web app of this complexity level? All the frontend and full stack frameworks that I’m familiar with try pretty hard to stop you.
I’ve seen people make exactly this mistake with Next.js. IMO React server components is a fantastic tool for losing track of what’s exposed client side and what isn’t.
Next.js makes you prefix env vars with NEXT_PUBLIC_ if you want them to be available client side, and Vercel has warning flags around it when you paste in those keys.
It's obviously not foolproof, but it's a good effort.
Re: Researcher finds flaw in a16z website that exposed some company data
#20> a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because there was no available contact on their main site and the email i could find engineering@a16z.com bounced my emails That's a clever lifehack to save your company money, by not having any way to privately contact engineering all bug bounties wi…
But it also teaches security researchers to sell that info next time instead of reporting.