Earlier quoted context omitted.
Not of this kind
That you’re aware of.
I come from security background and have been following best practices since 1997 so I’m pretty sure I have not made a blunder of this sort
Researcher finds flaw in a16z website that exposed some company data
191–200 of 246 posts
Re: Researcher finds flaw in a16z website that exposed some company data
#192Earlier quoted context omitted.
Whoops I accidentally exposed all API keys ever to the public. No really this is unacceptable for a professional, it’s even bad for an amateur. If your processes are so insecure that a little tired breaks your whole company you done goofed.
Yes, the answer must be additional processes and procedures. That way, you’ll never make a mistake! /s Also bizarre to frame this as “unacceptable behavior”, as if whoever is involved was in some way aware of their mistake and/or would say “this is acceptable behavior!” when confronted with it or something.
GP framed leaking all your keys at something that happens when you are tired or distracted.
This is unacceptable behaviour for a professional in my eyes.
Re: Researcher finds flaw in a16z website that exposed some company data
#193Wait, do hackers feel entitled to money for finding security holes, even if there was never any signal of such reward?
Ha my actual question was downvoted. I guess people are as entitled as they say.
Actually, I think entitlement is the wrong word. Maybe more like "window washing panhandler who's upset because you don't give them money for their service"
Re: Researcher finds flaw in a16z website that exposed some company data
#194even web3 could protect a16z ugh, thats very bad
Re: Researcher finds flaw in a16z website that exposed some company data
#195Too much javascript for everything (front & back) seems easy but for new developers it kind of blurs the lines between what should be on the server vs the client.
Re: Researcher finds flaw in a16z website that exposed some company data
#196Earlier quoted context omitted.
That’s env vars, but not actual variables - it’s really easy (if you are not actively context aware) to f.ex. pass a ”user” object from a server context into a client component and expose passwords etc to the client side.
If you add `import “server-only”` to the file, it will fail to compile if you to use it on the client. React also has more fine grained options where you can “taint” objects (yes that’s the real name).
Yeah, the problem is that these mitigations require the developer to be context aware, ”server-only” only saves you in the positive case where you correctly tagged your sensitive code as such. The default case is to expose anything without asking. I have also seen developers simply marking everything as ”use client” because then things ”just work” and the compiler stops complaining about useState in a server context etc.
Re: Researcher finds flaw in a16z website that exposed some company data
#197Earlier quoted context omitted.
Collecting the keys from a public source-code of a web page is legal (and can be safely reported). Using these keys to access unauthorized systems is a crime. This is a major difference.
How can it possibly be a crime? They literally gave the keys to everyone who accessed their website
You (unintentionally) drop your house key in front of your door. Now we can all freely enter your house! It can't be trespassing with the key sitting right there, can it?
Re: Researcher finds flaw in a16z website that exposed some company data
#198I made a similar mistake actually. We used a nodejs cms called apostrophecms that had an admin panel called global settings. We used that for managing api keys to our auth server. We only found out a few months in that it was outputted in the html source code. They did this so it was available to JS, of course it was in their docs. So not blaming them. We glossed over it. Annoyingly we paid a reasonable amount of mon…
Why were you using a web-based content management system for secret management?
In apostrophecms you can easily create setting and content types with custom defined fields. There are quite a few good ideas in there.
Those are mostly used on the node side of things, but often for convenience also shared to the front end.
Re: Researcher finds flaw in a16z website that exposed some company data
#199Earlier quoted context omitted.
> it was in their docs. So not blaming them. We glossed over it. You should be blaming them. You can't excuse dangerous behaviour by documenting it. I feel like this lesson should be known by now.
If the panel setting was specifically for API keys, then yes, that's on apostrophecms. If it's just some kind of generic settings with name/value pairs, then it might make sense to expose those to the browser, and make that very clear up front.
Yeah you can define extra global settings extending the existing fields, so we used that for our multi tenancy solution. And is available on the node side of things as well as on the frontend.
Re: Researcher finds flaw in a16z website that exposed some company data
#200I made a similar mistake actually. We used a nodejs cms called apostrophecms that had an admin panel called global settings. We used that for managing api keys to our auth server. We only found out a few months in that it was outputted in the html source code. They did this so it was available to JS, of course it was in their docs. So not blaming them. We glossed over it. Annoyingly we paid a reasonable amount of mon…
Edit: don’t wanna blame apostrophe cms here, it was our multi tenant setup and misunderstanding of apostrophe that lead to this situation