4 ms·

The company doesn't need a "hack" to not pay money. If they don't have a published bug bounty program then they owe nothing. They also have contact email addre

by paxys 2y ago

The company doesn't need a "hack" to not pay money. If they don't have a published bug bounty program then they owe nothing. They also have contact email addresses listed at the bottom of https://a16z.com/connect https://a16z.com/connect, which the researcher conveniently missed. They were looking for clout, not responsible disclosure.

rvnx 2y ago
Let's imagine your backpack is open. It's polite to say thanks if someone informs you that you accidentally left your backpack open. But in no way you are supposed to give them anything. Even further, some people take precious things from your backpack (trying to exploit the issue) and then come back to you asking for money; claiming they are nice people. This is non-sense.
- rdedev 2y ago
  It's not the same. Figuring out a bagpack is open takes no effort. Finding a backdoor takes a lot of effort.
  - TheRealPomax 2y ago
    Not when you find it on first "inspect element". That really is the equivalent of looking through someone's window and seeing their bank information and credits cards just lying in full view of anyone who'd look in.
- IshKebab 2y ago
  Terrible analogy. This is more like someone returning your wallet full of cash, on live TV. You aren't legally obligated to give them anything, but it sure is a dick move not to and good luck getting your wallet back next time you drop it if you don't.
  - abejfehr 2y ago
    Why will giving someone a cash reward mean you have a better chance of getting your wallet back in the future?
    - IshKebab 2y ago
      Because the next person will know there's a good chance you'll give them a cash reward, and that will tip the "immorally take all the cash" vs "return it and hope for a reward" balance more in favour of it being returned. I would have thought that was completely obvious so maybe that's not what you were asking? (On the other hand this is HN...)
      - mananaysiempre 2y ago
        It’s just that the analogy breaks down a bit. It’s fair to say a dropped wallet in a city is a one-shot game—it’s reasonable to expect neither the participants nor their acquaintances will ever encounter each other again; whereas a security vulnerability is closer to a repeated one—it’s a fairly small world. (Some kind of neighbourly behaviour would work better here, but then again, it’s more difficult to find a universal experience of that kind.) I didn’t misunderstand this, but perhaps GP did?..
      - nox101 2y ago
        The places you're most likely to get your wallet back in the world are the places you're also less likely to get a reward. The reward for returning a wallet is knowing you're doing your part to make the place you live in a nice place to live.
        spencerflem 2y ago
        Doing free work for A16Z or any of the awful companies ruining our world is not helping make anything better.
        AlchemistCamp 2y ago
        I think A16Z and the companies they’ve funded have done a great deal of good for the world. The very web browser you’re typed your angry comment into is a technology pioneered by one of its two founders. Being anti-VC is essential being against technological and economic progress.
  - YeahThisIsMe 2y ago
    >You aren't legally obligated to give them anything, Acktchually, depending on where you live, you might be.
  - largbae 2y ago
    Also the wallet had "please return me, cash reward" written on it. (Bug bounty advertised)
- tomrod 2y ago
  ... Did they actually steal anything or take advantage, or just touch the bag to make sure it wasn't fake? Seems more of the latter, and your analogy falls flat when the bag carrier contains other people's pii.
  - account42 2y ago
    There are pleny of people here saying the equivalent that "not paying will only encourage people to take things from your backpack instead".
mynameisvlad 2y ago
So you’d rather researchers reach out to black hats with this information instead? Because that’s what this line of thinking leads to. It’s in everyone’s, especially the company’s, best interests to have a bug bounty and easily accessible security hotline. Expecting researchers to jump through hoops like contacting their offices’ front desks to get to security is absurd.
- paxys 2y ago
  > So you’d rather researchers reach out to black hats with this information instead? That is pretty much what they did. Posting publicly about the vulnerability most certainly meant that every hacker in the world tried (and probably succeeded) at reproducing it, all before the company had enough time to act.
  - mynameisvlad 2y ago
    So you’d rather this happen? That is the question I asked. Because this is explicitly what happens when a company doesn’t have a good process for accepting and responding to exploits. The onus should entirely be on the company to invite researchers to find and report exploits in a responsible way. They are the ones at risk of losing millions of dollars over an exploit.
  - pavel_lishin 2y ago
    They didn't post publicly about the vulnerability; they reached out via twitter to tell them that they had one, without giving any details about it whatsoever.
    - paxys 2y ago
      Telling everyone that there's a vulnerability is usually as bad as providing detailed steps. No one was looking, and now you've pointed them in the right direction.
      - pavel_lishin 2y ago
lawgimenez 2y ago
I did the same thing with OP years ago, I tried to contact in every way possible the dev team of the largest telecom company in my country. All channels were ignored, so I have to resort to contacting our government agencies. Luckily, one agency replied to me and had one of the devs contacted me. For this hassle I was only paid $50. You have no idea the effort we go to report this things. So I quit bug hunting after that. I mean, a16z should be very grateful this got reported by an honest hunter regardless of the means it was reported.
- dvdkon 2y ago
  I stumbled upon a big vulnerability in an unnamed Czech ministry's web apps around January. It's now July and after trying the appropriate support email, the official "snail mail but digital", and calling various people's office landlines (thankfully they publish those in the org chart), it might get fixed this month. If there is a next time, maybe I'll try convincing the cybersecurity bureau to take my vulnerability reports instead.
leononame 2y ago
Am I blind? I don't seem to find the email address at all on that page
- consp 2y ago
  Only thing I can find are office mails, which looks more like a trashbin than mail which would respond. Also not where I'd look for a contact mail. They seem to only want you to connect via social media (which is a poor choice for primary contact IMO).
xyzeva 2y ago
i think you're missing the fact that that indeed is not a security email, and the engineering/security email i found bounced. i had no ill intentions. stop pretending i did.
- hluska 2y ago
  It’s hard to assume good intentions when you find the site via a set of searches that begin with ‘crypto bullshit’.
jmholla 2y ago
> They also have contact email addresses listed at the bottom of https://a16z.com/connect https://a16z.com/connect, which the researcher conveniently missed. They have those now. Do we know they did when the researcher tried to reach out? Edit: I decided to take a look at it myself. It does seem that that was available on June 3rd of this year [0]. (You'll have to look at the source since the archive doesn't do their animations.) It seems to be available on previous snapshots as well [1]. [0]: https://web.archive.org/web/20240603210532/https://a16z.com/connect/ https://web.archive.org/web/20240603210532/https://a16z.com/... [1]: https://web.archive.org/web/20240000000000*/https://a16z.com/connect/ https://web.archive.org/web/20240000000000*/https://a16z.com... [0]: https://web.archive.org/web/20240603210532/https://a16z.com/connect/ https://web.archive.org/web/20240603210532/https://a16z.com/...
Ukv 2y ago
> not responsible disclosure. The researcher found an email address, tried it, it bounced, then reached out over Twitter with: > someone from @a16z get in touch, now. its bad. security related. https://x.com/xyz3va/status/1807330215955177937 https://x.com/xyz3va/status/1807330215955177937 That doesn't seem irresponsible to me. Sure they could have searched the bottom of a connect page for the office emails to try, but I don't see any significant issue with what they did instead.
- paxys 2y ago
  "an" email address, not the one on their contact page.
  - Ukv 2y ago
    The email the researcher found (engineering) seems more appropriate than the office info emails (menlopark-info, ...) at the bottom of the Connect page (an actual "contact" page used to exist, but is now 404 with no redirect). I don't see anything irresponsible about trying engineering then reaching out over social media.
- AlchemistCamp 2y ago
  Why broadcast the tweet publicly instead of sending it as a DM to A16Z then? It’s obviously not safe to publicly announce the existence of a security vulnerability, and there was no barrier to alerting them privately via the same platform.
  - djhn 2y ago
    Are their DMs open though? Can’t DM someone who isn’t following you.
  - Ukv 2y ago
    > It’s obviously not safe to publicly announce the existence of a security vulnerability Publicly showing the vulnerability would have been unsafe, but I don't think there's much harm in asking to get in touch about an unspecified security issue (not even saying that it's a vulnerability in their website). Andreessen Horowitz is a massive firm, not some tiny website flying under the radar. > and there was no barrier to alerting them privately via the same platform DM would have to get picked up by their social media person next time they check Twitter, whereas a directed tweet can additionally leverage networks and be escalated by people with contacts - possibly someone could give the up-to-date engineering contact email, for instance. Either way would have been fine, really. I feel we're going over the actions of an individual researcher with a fine-comb, searching for any hint that there was an arguably better course of action, when there are multiple huge obvious mistakes from a16z.
idontknowtech 2y ago
I'm generally sympathetic to what you're saying, but I also detest a16z and Horowitz personally for being the epitome of "software guy decides he's expert at everything now" and his role in the crypto bubble. Should the hacker have tried more? Sure, maybe. Do I really care? Definitely not

by paxys 2y ago

rvnx 2y ago

Let's imagine your backpack is open. It's polite to say thanks if someone informs you that you accidentally left your backpack open. But in no way you are supposed to give them anything. Even further, some people take precious things from your backpack (trying to exploit the issue) and then come back to you asking for money; claiming they are nice people. This is non-sense.

rdedev 2y ago
It's not the same. Figuring out a bagpack is open takes no effort. Finding a backdoor takes a lot of effort.
- TheRealPomax 2y ago
  Not when you find it on first "inspect element". That really is the equivalent of looking through someone's window and seeing their bank information and credits cards just lying in full view of anyone who'd look in.
IshKebab 2y ago
Terrible analogy. This is more like someone returning your wallet full of cash, on live TV. You aren't legally obligated to give them anything, but it sure is a dick move not to and good luck getting your wallet back next time you drop it if you don't.
- abejfehr 2y ago
  Why will giving someone a cash reward mean you have a better chance of getting your wallet back in the future?
  - IshKebab 2y ago
    Because the next person will know there's a good chance you'll give them a cash reward, and that will tip the "immorally take all the cash" vs "return it and hope for a reward" balance more in favour of it being returned. I would have thought that was completely obvious so maybe that's not what you were asking? (On the other hand this is HN...)
    - mananaysiempre 2y ago
      It’s just that the analogy breaks down a bit. It’s fair to say a dropped wallet in a city is a one-shot game—it’s reasonable to expect neither the participants nor their acquaintances will ever encounter each other again; whereas a security vulnerability is closer to a repeated one—it’s a fairly small world. (Some kind of neighbourly behaviour would work better here, but then again, it’s more difficult to find a universal experience of that kind.) I didn’t misunderstand this, but perhaps GP did?..
    - nox101 2y ago
      The places you're most likely to get your wallet back in the world are the places you're also less likely to get a reward. The reward for returning a wallet is knowing you're doing your part to make the place you live in a nice place to live.
      - spencerflem 2y ago
        Doing free work for A16Z or any of the awful companies ruining our world is not helping make anything better.
        AlchemistCamp 2y ago
        I think A16Z and the companies they’ve funded have done a great deal of good for the world. The very web browser you’re typed your angry comment into is a technology pioneered by one of its two founders. Being anti-VC is essential being against technological and economic progress.
- YeahThisIsMe 2y ago
  >You aren't legally obligated to give them anything, Acktchually, depending on where you live, you might be.
- largbae 2y ago
  Also the wallet had "please return me, cash reward" written on it. (Bug bounty advertised)
tomrod 2y ago
... Did they actually steal anything or take advantage, or just touch the bag to make sure it wasn't fake? Seems more of the latter, and your analogy falls flat when the bag carrier contains other people's pii.
- account42 2y ago
  There are pleny of people here saying the equivalent that "not paying will only encourage people to take things from your backpack instead".

mynameisvlad 2y ago

So you’d rather researchers reach out to black hats with this information instead? Because that’s what this line of thinking leads to. It’s in everyone’s, especially the company’s, best interests to have a bug bounty and easily accessible security hotline. Expecting researchers to jump through hoops like contacting their offices’ front desks to get to security is absurd.

paxys 2y ago
> So you’d rather researchers reach out to black hats with this information instead? That is pretty much what they did. Posting publicly about the vulnerability most certainly meant that every hacker in the world tried (and probably succeeded) at reproducing it, all before the company had enough time to act.
- mynameisvlad 2y ago
  So you’d rather this happen? That is the question I asked. Because this is explicitly what happens when a company doesn’t have a good process for accepting and responding to exploits. The onus should entirely be on the company to invite researchers to find and report exploits in a responsible way. They are the ones at risk of losing millions of dollars over an exploit.
- pavel_lishin 2y ago
  They didn't post publicly about the vulnerability; they reached out via twitter to tell them that they had one, without giving any details about it whatsoever.
  - paxys 2y ago
    Telling everyone that there's a vulnerability is usually as bad as providing detailed steps. No one was looking, and now you've pointed them in the right direction.
    - pavel_lishin 2y ago

lawgimenez 2y ago

I did the same thing with OP years ago, I tried to contact in every way possible the dev team of the largest telecom company in my country. All channels were ignored, so I have to resort to contacting our government agencies. Luckily, one agency replied to me and had one of the devs contacted me. For this hassle I was only paid $50. You have no idea the effort we go to report this things. So I quit bug hunting after that. I mean, a16z should be very grateful this got reported by an honest hunter regardless of the means it was reported.

dvdkon 2y ago
I stumbled upon a big vulnerability in an unnamed Czech ministry's web apps around January. It's now July and after trying the appropriate support email, the official "snail mail but digital", and calling various people's office landlines (thankfully they publish those in the org chart), it might get fixed this month. If there is a next time, maybe I'll try convincing the cybersecurity bureau to take my vulnerability reports instead.

leononame 2y ago

Am I blind? I don't seem to find the email address at all on that page

consp 2y ago
Only thing I can find are office mails, which looks more like a trashbin than mail which would respond. Also not where I'd look for a contact mail. They seem to only want you to connect via social media (which is a poor choice for primary contact IMO).

xyzeva 2y ago

i think you're missing the fact that that indeed is not a security email, and the engineering/security email i found bounced. i had no ill intentions. stop pretending i did.

hluska 2y ago
It’s hard to assume good intentions when you find the site via a set of searches that begin with ‘crypto bullshit’.

jmholla 2y ago

> They also have contact email addresses listed at the bottom of https://a16z.com/connect https://a16z.com/connect, which the researcher conveniently missed. They have those now. Do we know they did when the researcher tried to reach out? Edit: I decided to take a look at it myself. It does seem that that was available on June 3rd of this year [0]. (You'll have to look at the source since the archive doesn't do their animations.) It seems to be available on previous snapshots as well [1]. [0]: https://web.archive.org/web/20240603210532/https://a16z.com/connect/ https://web.archive.org/web/20240603210532/https://a16z.com/... [1]: https://web.archive.org/web/20240000000000*/https://a16z.com/connect/ https://web.archive.org/web/20240000000000*/https://a16z.com... [0]: https://web.archive.org/web/20240603210532/https://a16z.com/connect/ https://web.archive.org/web/20240603210532/https://a16z.com/...

Ukv 2y ago

> not responsible disclosure. The researcher found an email address, tried it, it bounced, then reached out over Twitter with: > someone from @a16z get in touch, now. its bad. security related. https://x.com/xyz3va/status/1807330215955177937 https://x.com/xyz3va/status/1807330215955177937 That doesn't seem irresponsible to me. Sure they could have searched the bottom of a connect page for the office emails to try, but I don't see any significant issue with what they did instead.

paxys 2y ago
"an" email address, not the one on their contact page.
- Ukv 2y ago
  The email the researcher found (engineering) seems more appropriate than the office info emails (menlopark-info, ...) at the bottom of the Connect page (an actual "contact" page used to exist, but is now 404 with no redirect). I don't see anything irresponsible about trying engineering then reaching out over social media.
AlchemistCamp 2y ago
Why broadcast the tweet publicly instead of sending it as a DM to A16Z then? It’s obviously not safe to publicly announce the existence of a security vulnerability, and there was no barrier to alerting them privately via the same platform.
- djhn 2y ago
  Are their DMs open though? Can’t DM someone who isn’t following you.
- Ukv 2y ago
  > It’s obviously not safe to publicly announce the existence of a security vulnerability Publicly showing the vulnerability would have been unsafe, but I don't think there's much harm in asking to get in touch about an unspecified security issue (not even saying that it's a vulnerability in their website). Andreessen Horowitz is a massive firm, not some tiny website flying under the radar. > and there was no barrier to alerting them privately via the same platform DM would have to get picked up by their social media person next time they check Twitter, whereas a directed tweet can additionally leverage networks and be escalated by people with contacts - possibly someone could give the up-to-date engineering contact email, for instance. Either way would have been fine, really. I feel we're going over the actions of an individual researcher with a fine-comb, searching for any hint that there was an arguably better course of action, when there are multiple huge obvious mistakes from a16z.

idontknowtech 2y ago

I'm generally sympathetic to what you're saying, but I also detest a16z and Horowitz personally for being the epitome of "software guy decides he's expert at everything now" and his role in the crypto bubble. Should the hacker have tried more? Sure, maybe. Do I really care? Definitely not