5 ms·

Counterpoint: OP is a security researcher and couldn’t find a single human email address at one of the most well-known VC firms on the planet? LinkedIn? Twit

by nlh 2y ago

Counterpoint: OP is a security researcher and couldn’t find a single human email address at one of the most well-known VC firms on the planet? LinkedIn? Twitter? Facebook friends? Come on. They’re not hard to reach if one really wants to. (Note: I still think A16Z should have paid them.)

asopd 2y ago
Exactly, if he even just browsed their website a bit he'd have stumbled across loads of email addresses that could have been a useful point of contact.
- deleted 2y ago
  [deleted]
- dmix 2y ago
  It’s more fun getting attention by doing it publicly and being the victim (security researchers love hitting the 'nobody respects us' button) than putting basic effort in. A single email bouncing is frustrating of course, but he then posted that an easily found vulnerability existed on Twitter, while a16z: - has a contact page page https://a16z.com/connect/ https://a16z.com/connect/ with 4x emails to their offices at the bottom (despite claims the main site had no other emails) - links to their Twitter where DMs are open https://x.com/a16z https://x.com/a16z same with instagram, FB, and linkedin, all open it would be easy to just email all of them at once and waiting a couple days to see if it gets escalated.
  - asopd 2y ago
    [flagged]
mynameisvlad 2y ago
Why should it be an onus on the researcher to find this information? It should be plainly provided in the first place. Someone shouldn’t have to jump through hoops to help the company secure its resources. That is not how this works.
- deleted 2y ago
  [deleted]
- dmix 2y ago
  Trying more than one email is not jumping through hoops when it's one of the worst possible vulnerabilities hitting all of their databases/platforms. Being a research means being an adult and having a basic level of responsibility. Just like being a gun owner, it's a powerful tool that needs to be treated with utmost respect. A lot of pentesters are just kids who are angry at the world and the poor state of security, which I get, but it's not a huge barrier to try a bit more. He would have been rewarded if he did.
  - mynameisvlad 2y ago
    A researcher should not have to “try different emails”. Period. There should be a clearly disclosed email provided by the company to report such issues. Very obviously plastered. Or just use the standard abuse@, security@, infosec@, etc. It is by far in the company’s best interests for this to happen because the alternative is public disclosure or disclosure to black hats instead. Anything more is jumping through hoops. It should not be the researcher’s responsibility or burden to go out of their way to help a company that hasn’t done the bare minimum to welcome white hats helping them secure their own systems.
    - dmix 2y ago
      Yes of course company's should do that, but in the real world a lot of companies don't think to do that, especially a marketing site for a VC firm. Any dev knows what it's like having a million responsibilities, a lot of things get put on TODO lists that never get completed. Them being owned by a wealthy company doesnt mean they have a huge dev team running 247 to handle this stuff. Which is probably why such a obvious failure even happened... Security researchers get high and mighty extremely quickly, which is immature IMO.
      - pixl97 2y ago
        WTF is this thinking? >Any dev knows what it's like having a million responsibilities, Any airplane mechanic has a million responsibilities, and if they are not followed people fucking die. Maybe software devs should step up and take a little responsibility for their lack of action that can have consequences for their users. Security researchers owe you nothing. If you make the path of least resistance selling sploits to blackhat groups the world will be a worse place.
fanf2 2y ago
They said they got in contact via Twitter, but a16z didn’t like that.
- AlchemistCamp 2y ago
  The issue wasn’t using Twitter. It was publicly broadcasting the existence of a security vulnerability. This is especially egregious given that A16Z’s DMs are open.

by nlh 2y ago

asopd 2y ago

Exactly, if he even just browsed their website a bit he'd have stumbled across loads of email addresses that could have been a useful point of contact.

deleted 2y ago
[deleted]
dmix 2y ago
It’s more fun getting attention by doing it publicly and being the victim (security researchers love hitting the 'nobody respects us' button) than putting basic effort in. A single email bouncing is frustrating of course, but he then posted that an easily found vulnerability existed on Twitter, while a16z: - has a contact page page https://a16z.com/connect/ https://a16z.com/connect/ with 4x emails to their offices at the bottom (despite claims the main site had no other emails) - links to their Twitter where DMs are open https://x.com/a16z https://x.com/a16z same with instagram, FB, and linkedin, all open it would be easy to just email all of them at once and waiting a couple days to see if it gets escalated.
- asopd 2y ago
  [flagged]

mynameisvlad 2y ago

Why should it be an onus on the researcher to find this information? It should be plainly provided in the first place. Someone shouldn’t have to jump through hoops to help the company secure its resources. That is not how this works.

deleted 2y ago
[deleted]
dmix 2y ago
Trying more than one email is not jumping through hoops when it's one of the worst possible vulnerabilities hitting all of their databases/platforms. Being a research means being an adult and having a basic level of responsibility. Just like being a gun owner, it's a powerful tool that needs to be treated with utmost respect. A lot of pentesters are just kids who are angry at the world and the poor state of security, which I get, but it's not a huge barrier to try a bit more. He would have been rewarded if he did.
- mynameisvlad 2y ago
  A researcher should not have to “try different emails”. Period. There should be a clearly disclosed email provided by the company to report such issues. Very obviously plastered. Or just use the standard abuse@, security@, infosec@, etc. It is by far in the company’s best interests for this to happen because the alternative is public disclosure or disclosure to black hats instead. Anything more is jumping through hoops. It should not be the researcher’s responsibility or burden to go out of their way to help a company that hasn’t done the bare minimum to welcome white hats helping them secure their own systems.
  - dmix 2y ago
    Yes of course company's should do that, but in the real world a lot of companies don't think to do that, especially a marketing site for a VC firm. Any dev knows what it's like having a million responsibilities, a lot of things get put on TODO lists that never get completed. Them being owned by a wealthy company doesnt mean they have a huge dev team running 247 to handle this stuff. Which is probably why such a obvious failure even happened... Security researchers get high and mighty extremely quickly, which is immature IMO.
    - pixl97 2y ago
      WTF is this thinking? >Any dev knows what it's like having a million responsibilities, Any airplane mechanic has a million responsibilities, and if they are not followed people fucking die. Maybe software devs should step up and take a little responsibility for their lack of action that can have consequences for their users. Security researchers owe you nothing. If you make the path of least resistance selling sploits to blackhat groups the world will be a worse place.

fanf2 2y ago

They said they got in contact via Twitter, but a16z didn’t like that.

AlchemistCamp 2y ago
The issue wasn’t using Twitter. It was publicly broadcasting the existence of a security vulnerability. This is especially egregious given that A16Z’s DMs are open.