> Upon discovering this attack, I responsibly disclosed it to Anthropic via their HackerOne bug bounty program. They confirmed they had identified it internally but hadn't yet patched it. No bounty was awarded.
They recently mitigated the issue: Anthropic disabled web_fetch's ability to follow links on external pages, limiting navigation to web_search results and user-provided URLs.
Yeah I never get the "we knew about it internally" excuse. I can understand if another reporter got to it on the same day and they were in the process of mitigating, but even then they should have to prove it somehow.
I'm sure someone will tell me why I'm wrong but it feels like they're just dodging payouts. Reduces trust and motivation to report it.
So what should you focus on? What OSI layer is a good starting point? It depends on your skills right?
I agree you should use as much established products as possible but you build your stack and create that unique differentiation on the market by also learning technology as you go.
It all depends on where you land with your idea to the market. If you are selling knit figures online - you are right that you should not set this up but if you rely on technology advancements you should “own your technology” knowledge as much as possible because you will need it to solve problems along the way.
Too often I see business leaders come in and say I don’t know technology - let’s buy it all from MS or Amazon. This is not the way to go for your whole business. It’s like saying can you run my business for me. Your business is only as good as your best knowledge workers.
Another aspect is regulations, your data might not be allowed to leave the premise of your nation and these self hosted solutions at least with proper patching procedures offer this guarantee.
Managed services in all its glory to hand over the problem to someone else also hands over key learnings and if you have a complex enough environment you will need to deal with it at some point and for small businesses/startups the cost of outsourcing might be too high to begin with.
Revenue via leverage (managed services) once you have traction (people will pay you for what you're offering). Outsource everything except your core competencies, and optimize as throughput allows for either growth or cost reductions (judgement calls by competent practitioners close to the machinery). Broad strokes, as a startup you're attempting to grow revenue as fast as you can through value delivery to customers; you should be ruthlessly cutting anything you're spending your time on that doesn't contribute to that goal.
For sure, keep an eye towards your regulatory requirements, lock in risk (both vendor and technology), etc. That's not a call to self host everything, just what you absolutely can't grow or survive without (and in many cases, a product or service may come along down the road that allows you to refactor out of homegrown solutions). Organizational contributors who understand technology making these decisions de-risks suboptimal decisions being made.
(observations from experience at a hyper growth startup)
Pretty much every element in your stack should be the result of a build or buy decision initially.
If something doesn't directly contribute to your competitive edge then run with a managed service / something off the shelf until you know enough about the domain to be able to make an informed decision about the trade offs.
Too often I've seen early teams that have spent months building out (and maintaining!) an area of the stack that could have been had off the shelf - freeing up engineering time and allowing focus on the areas that allow for true differentiation in the product.
Obviously off the shelf isn't free in financial or engineering time (though you can sure get a lot of free credits / on free tiers nowadays), but if your main product is doing something fancy on top of the output of a fairly generic process, do yourself a favour and find a company that has a product specialising in that process, don't build it from scratch until you have your product market fit.
You should be focused on building a market for your product. What gives you a competitive advantage? I argue that self-hosting Mattermost doesn't help accomplish that vs. paying Slack.
You are right that there is a time and place to start taking more ownership of those basic pieces. Doing it before you even have something to sell is not the right time.
You have to survive as a small company before you can be a mid-size company.
reply