I was at a much smaller YC company when I found that AWS root credentials were checked into the repo, purely for S3 file uploads for logos. When other engineers and I brought it to the CEO (he required infrastructure stuff get brought up to him first), he handled it with zero urgency and didn't see why it was a big deal.

I explained to him how the EC2 instances would assume the role that already had the permission and it took so long to convince him.

Needless to say, we had to explain lots of basic security and networking concepts to him, which he wouldn't believe until given live demos of basic things like public versus private IP addresses in AWS.

Many SWE teams don't care about security. Even talking about security annoys them. I get it though. I've had offensive security training at uni (VUSEC Amsterdam). It's a way different type of thinking.

At a few companies I've worked at, they squelch this kind of bug/security breach reporting by immediately making it the discoverer's job to fix the problem and champion it through the system to production, taking on all responsibility if something breaks of course. You only have to go through that once to get the message.

More proof that software engineering isn't real engineering. If a civil engineer made a mistake that bad in my country, he'd likely lose his engineering licence.

unfortunately, that just how organization was

> I digress, the CTO didn't respond because he was more worried about how it would make him look. This industry is dead - the wrong people work in it.

The main problem is that the IT industry for a loooooooong time "self-regulated" itself, the only areas that did have regulation had it come in externally (i.e. automotive, aeronautic, astronauts and maritime). Only in the last years, GDPR + insurances forced a bit of change and accountability, but still, it's far removed from the standards that company owners, workers and planners are held to in construction (licensed engineers), legal or medical practice. Mess up there and everything can happen from fines over a license suspension to a permanent removal, or even jail time.

In contrast, mess stuff up as a CTO and you'll probably be "asked" to voluntarily depart in exchange for a nice golden parachute.

I used a product with SOC2 certification, which uploads all your chatbot conversations to a server they control (mandatory), which can be made visible to public with a single click. Doesn't matter if you are an individual or enterprise user.

They do have enterprise level controls that let admins turn this off. Unfortunately, it is on by default, and some of those basic security controls require a higher tier of service.

It is absolutely wild that these companies treat security like an afterthought. And I also realized SOC2 Compliant meant absolutely nothing.

Is there an entity that can validate they are not SOC2 compliant outside of their claim?

Once again proof that SOC2 is nothing but a marketing tactic, and busywork

On a personal note, I recognize that I should have kept the researcher updated after his initial outreach earlier this year, and I take full responsibility for that communication gap.

They make it sound like it was a single email. What about all the other outreaches the researcher made to the CEO over a six month period?

Interesting how the CEO didn't contribute any explanation to the blog post and left the CTO out to dry.

Not trying to be rude or mean here but it should be, "a YouTuber" since YouTuber starts with a consonant sound.

Also add the word "secure" a lot.

AI agent: sorry for that, I'll build the next version will be the most secured one

Actually they are taking one from Anthropic's playbook and saying it's the user's fault for misunderstanding what "sharing" means.

I'm definitely biased as the developer, but maybe try https://whistle-enterprise.com and see how it works for you.

It's a hard problem I've been working away on for a while now. It's far from perfect but every step brings it a bit closer.

Drafts.app is hideous but it has great routing capability and a dictation feature. I use it to capture what my thoughts and route based on content. I have a button that routes to an internal voice agent named KiKo. Ideas get routed to Things or todoist. Issues get routed to github, etc. It’s one universal surface for note capture.

But man is it ugly.

> I'm very intrigued by AI note takers, but I'm absolutely unwilling to expose me or my clients to this exact problem

Unfortunately it’s mostly not up to you. It’s a weakest-link problem. It doesn’t matter if you don’t use a note taker AI, if even one person on the call uses one. Their tool doesn’t notify you and usually the person doesn’t either.

It also has the reverse impact to the person using the note taker, where people say less around them. Same as if I'm talking to someone with Meta glasses.

I wonder if the people who use these tools know the people they meet with speak less during their meetings, and then all of the participants have a post-meeting call without them to say what they really thought.

Sturgeon's Law is proved correct time and again. Most things are crap. Most people produce some crap in their lives. Some people only produce crap. Those people still need to eat but unfortunately some of them (somehow) find their way into tech and actually convince people to pay money for crap.

Especially with a low bar to entry like what is essentially AI-backed transcription-as-a-service, I'm not sure 90% is high enough. There will be 100 companies offering essentially the same thing and it's unfortunately the responsibility of the customer to find the one written by someone who doesn't have a parsnip where their brain should be.

I saw that and chuckled.

If something happens again and again, it is by choice. Firebase chooses to make it “easy” to get started rather than “secure by default”.

It's almost like people need knowledge and experience to work with tools securely. The problem with Firebase (I think) is that its marketing is "it's easy to use" and I'm confident most problems - like storing this info - is easy to figure out and finish, then move on to the next thing.

But this is lazy / "move fast" software engineering. They mention all of these certifications, I think they should be stripped of them for a year because of a failure to respond / act.

In this case the CEO was aware of it and... did nothing.

doesnt change the fact that the vulnerability existed. Stop whining

TBH I've been finding Claude quite funny lately, the pasta jokes are pretty good.

> The irony is al dente.

We're going to open your database by default, but PLEASE remember to secure it later! Footgun deployed successfully.

at this point, it's a feature, not a bug.

> 4TB/40,000 contractors voice + government ID + selfie leaked

Leaked selfies? Do you mean ID photos?

If they haven't fixed it in 6 months, I'd say it's fair game to scrape as much as you can.

"Lets circle back and touch base to tease out any low hanging synergies we can capitalise on" - repeated 181,000 times

> how do you respond as CEO to this and not escalate to like priority #1? then kick the can for 6 months?

We might be able to check the meeting minutes and get the answer?

A post on LinkedIn where this CEO seems very active should solve that.

As I see it he is not the one exposing clients to risk. He is frustrated that no one is fixing it. The company that left themselves open like this are the ones that are exposing their clients.

If this person is doing his best to do the right thing, there are probably other people who know about this vulnerability and are using it without telling anyone.

You need to read the article.

Sometimes shame is only option to get things fixed. Sadly we do not have any reliable government institutions that could mandate immediate shut down of services. Before that only way to get things fixed is public shame.

What's the alternative? Seriously. He's spent six months trying to get them to fix it. The risk is already there.

It's unclear. Only stating the existence of the privacy email.

> [...] Buried at the bottom, a single line: "If you have discovered a privacy or security issue that we should address, please always let us know at privacy@tldv.io. Our security team will respond within 24 hours." I emailed the CTO directly. Six months. No response. [...]

This is near the disclosure schedule

From the article - he reached out to the CEO directly, who acknowledged and said it was being worked on by the CTO. He did this repeatedly over 6 months.