Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Researcher finds flaw in a16z website that exposed some company data

kibty.town

Post reply on HN
Print view View original

221–230 of 246 posts

Re: Researcher finds flaw in a16z website that exposed some company data

#221

Post by AlchemistCamp »

Ukv wrote: post #138
paxys wrote: post #61

Earlier quoted context omitted.

The company doesn't need a "hack" to not pay money. If they don't have a published bug bounty program then they owe nothing. They also have contact email addresses listed at the bottom of https://a16z.com/connect , which the researcher conveniently missed. They were looking for clout, not responsible disclosure.

> not responsible disclosure. The researcher found an email address, tried it, it bounced, then reached out over Twitter with: > someone from @a16z get in touch, now. its bad. security related. https://x.com/xyz3va/status/1807330215955177937 That doesn't seem irresponsible to me. Sure they could have searched the bottom of a connect page for the office emails to try, but I don't see any significant issue with what th…

Why broadcast the tweet publicly instead of sending it as a DM to A16Z then?

It’s obviously not safe to publicly announce the existence of a security vulnerability, and there was no barrier to alerting them privately via the same platform.

Re: Researcher finds flaw in a16z website that exposed some company data

#222

Post by djhn »

AlchemistCamp wrote: post #221
Ukv wrote: post #138

Earlier quoted context omitted.

> not responsible disclosure. The researcher found an email address, tried it, it bounced, then reached out over Twitter with: > someone from @a16z get in touch, now. its bad. security related. https://x.com/xyz3va/status/1807330215955177937 That doesn't seem irresponsible to me. Sure they could have searched the bottom of a connect page for the office emails to try, but I don't see any significant issue with what th…

Why broadcast the tweet publicly instead of sending it as a DM to A16Z then? It’s obviously not safe to publicly announce the existence of a security vulnerability, and there was no barrier to alerting them privately via the same platform.

Are their DMs open though? Can’t DM someone who isn’t following you.

Re: Researcher finds flaw in a16z website that exposed some company data

#223

Post by cqqxo4zV46cp »

chefandy wrote: post #21
Drakim wrote: post #2

> a16z did not give me any bug bounty on this because of the fact i publicly reached out instead of trying to reach out privately. the only reason i did it this way was because there was no available contact on their main site and the email i could find engineering@a16z.com bounced my emails That's a clever lifehack to save your company money, by not having any way to privately contact engineering all bug bounties wi…

All sorts of cleverness going on there. I'll bet they saved a ton of money on development by lowballing people on fiverr or whatever they did, and indirectly they'll also save a ton on bookkeeping when a russian ransomware group effortlessly takes them for everything they have.

With all the money a16z funnelling into the Trump campaign as it is, yada yada, I’m too lazy to make the rest of the line.

Re: Researcher finds flaw in a16z website that exposed some company data

#224

Post by specialist »

archagon wrote: post #210
j-bos wrote: post #64

The fact that this VC firm didn't provide bug bounty for such a gaping hole does not instill trust.

Unsurprising given that the founders are Trumpists now: https://siliconangle.com/2024/07/17/co-founders-andreessen-h...

They believe Trump will be best for tech. Ironic, since Trump has pledged roll back our transition to renewable energy, curtail the use of EVs, etc.

Maybe marca and ben meant Trump would be better for VCs and tech investors. Which would be true.

Re: Researcher finds flaw in a16z website that exposed some company data

#225

Post by specialist »

TeaBrain wrote: post #217
notfed wrote: post #215

Earlier quoted context omitted.

Billionaires like tax cuts for billionaires; go figure.

According to the article, the decision to back him was due to the 2025 tax plan to tax unrealized gains, which I hadn't heard of, but I'm not surprised that he wouldn't be a fan of that, given that his entire business is built on investing in companies, and that these investments on the part of founders and investors are unrealized. It does seem like it would de-incentivize much of the startup and venture capital eco…

I'm not smart enough to understand finance and so forth. So can't comment on that 2025 tax plan.

I do know that "Bidenomics", aka the torrent of federal money (CHIPS Act, Inflation Reduction Act, EPAs new "Green Bank", Dept of Defense's retooling, etc), has been a huge boon for startups.

I would have thought a group of savvy entrepreneurs like a18z would join the renewable energy and domestic manufacturing bonanza.

But like I said, I don't understand finance. So I'm sure a17z have their reasons to sit this one out.

Re: Researcher finds flaw in a16z website that exposed some company data

#226

Post by Ukv »

AlchemistCamp wrote: post #221
Ukv wrote: post #138

Earlier quoted context omitted.

> not responsible disclosure. The researcher found an email address, tried it, it bounced, then reached out over Twitter with: > someone from @a16z get in touch, now. its bad. security related. https://x.com/xyz3va/status/1807330215955177937 That doesn't seem irresponsible to me. Sure they could have searched the bottom of a connect page for the office emails to try, but I don't see any significant issue with what th…

Why broadcast the tweet publicly instead of sending it as a DM to A16Z then? It’s obviously not safe to publicly announce the existence of a security vulnerability, and there was no barrier to alerting them privately via the same platform.

> It’s obviously not safe to publicly announce the existence of a security vulnerability

Publicly showing the vulnerability would have been unsafe, but I don't think there's much harm in asking to get in touch about an unspecified security issue (not even saying that it's a vulnerability in their website). Andreessen Horowitz is a massive firm, not some tiny website flying under the radar.

> and there was no barrier to alerting them privately via the same platform

DM would have to get picked up by their social media person next time they check Twitter, whereas a directed tweet can additionally leverage networks and be escalated by people with contacts - possibly someone could give the up-to-date engineering contact email, for instance.

Either way would have been fine, really. I feel we're going over the actions of an individual researcher with a fine-comb, searching for any hint that there was an arguably better course of action, when there are multiple huge obvious mistakes from a16z.

Re: Researcher finds flaw in a16z website that exposed some company data

#228

Post by AlchemistCamp »

Ukv wrote: post #226
AlchemistCamp wrote: post #221

Earlier quoted context omitted.

Why broadcast the tweet publicly instead of sending it as a DM to A16Z then? It’s obviously not safe to publicly announce the existence of a security vulnerability, and there was no barrier to alerting them privately via the same platform.

> It’s obviously not safe to publicly announce the existence of a security vulnerability Publicly showing the vulnerability would have been unsafe, but I don't think there's much harm in asking to get in touch about an unspecified security issue (not even saying that it's a vulnerability in their website). Andreessen Horowitz is a massive firm, not some tiny website flying under the radar. > and there was no barrier…

> I feel we're going over the actions of an individual researcher with a fine-comb, searching for any hint that there was an arguably better course of action, when there are multiple huge obvious mistakes from a16z.

You're going over things "with a fine-comb". I just wrote two sentences that made a single point.

Re: Researcher finds flaw in a16z website that exposed some company data

#229

Post by stuartromanek »

wouldbecouldbe wrote: post #8

I made a similar mistake actually. We used a nodejs cms called apostrophecms that had an admin panel called global settings. We used that for managing api keys to our auth server. We only found out a few months in that it was outputted in the html source code. They did this so it was available to JS, of course it was in their docs. So not blaming them. We glossed over it. Annoyingly we paid a reasonable amount of mon…

Hello, I'm really sorry you had this unexpected exposure using ApostropheCMS. As you've mentioned, this data sharing was noted in the documentation but can still prove surprising.

A note for future researchers: the currently supported major version of Apostrophe no longer behaves in this way. Any data injection to the logged-out front-end would be a choice made at the developer level, specifically to avoid this sort of surprise.

That said, there are still use cases for including API keys as part of the configuration and 'content' of certain types of widgets.

For context, I am the head of design at Apostrophe and also play an engineering role.

Re: Researcher finds flaw in a16z website that exposed some company data

#230

Post by TeaBrain »

specialist wrote: post #225
TeaBrain wrote: post #217

Earlier quoted context omitted.

According to the article, the decision to back him was due to the 2025 tax plan to tax unrealized gains, which I hadn't heard of, but I'm not surprised that he wouldn't be a fan of that, given that his entire business is built on investing in companies, and that these investments on the part of founders and investors are unrealized. It does seem like it would de-incentivize much of the startup and venture capital eco…

I'm not smart enough to understand finance and so forth. So can't comment on that 2025 tax plan. I do know that "Bidenomics", aka the torrent of federal money (CHIPS Act, Inflation Reduction Act, EPAs new "Green Bank", Dept of Defense's retooling, etc), has been a huge boon for startups. I would have thought a group of savvy entrepreneurs like a18z would join the renewable energy and domestic manufacturing bonanza. B…

I wouldn't be surprised if they would have been on board for most of the Biden era economic policies. I think it may have just been the possible industry repercussions from the coming 2025 tax plan that made A&H anxious, given that it could disincentivize the venture capital growth market.
Post reply on HN