HN

Comments (162)

• jonathaneunice
  I hope this is a real wake-up call for teams running anything remotely SaaS-shaped. I count at least six substantial, lightning-speed attacks against multi-tenant as-a-service vendors since September. Not this year--just since last month. PingCAP/TiDB, Fireworks AI, Zeabur, OpenCode Console, Railway, now Northflank. All of them modern "we keep your content safe" players with high hopes and probably pretty good protections.This is a full infosec emergency unfolding here. No matter how grinding it is to motivate a team to invest in protection or resilience (and it is grinding): We gotta get ready. Stat! The AI-accelerated attacker apocalypse has begun. It's boom, boom, boom, thanks for everything, on to the next. They have us sighted and are firing for effect.So credential rotation, tripwire secrets, DFIR on standby, solid vulnerability and intrusion detection, real listening to that signal, minimized blast radius, spending caps and time limits and tight scoping on credentials, fast incident alerting... We need to get on a real war footing here.
• Menu

  dangoodmanUT
  Unfortunately for infra startups, I think we're going to see a convergence back to hyperscalers as a result of incidents like this and railway.There's no amount of "nicer to use" that can replace security, at least certainly when selling to enterprises
• Menu

  hmokiguess
  What is Northflank? I am surprised at the amount of new business out there
• maherbeg
  I think all of these companies need to let you separate secrets from other env vars and not let you ever read your secrets once they're written down.
• yieldcrv
  doppler next?
• Menu

  Scorpiion
  I'm curious what people think of BYOC (bring your own cloud) as an option offering to customers or buying it as a customer. Looking at Northflanks website they list it as an offering, I presume those customers are not affected by the breach.What are your opinion on the concept? Growing trend that should be encouraged or a mistake for most startups? Would you choose one provider over the other because of it assuming price was about the same?I get that this is often a super expensive "call us" option today, but in theory it doesn't have to be, so for the sake of discussion let's assume it can be delivered at a reasonable cost for the provider at reasonable price for the customer.If people from Northflanks is reading this, I'm sorry for the incident and I hope you recover as soon as possible.
• anuptalwalkar
  Unfortunately, this is going to be an everyday story. More and more bugs and breaches will be discovered and this move fast world more and more will be continued to be made.Security is a perception, but right now it seems like it needs good PR.
• Menu

  jdprgm
  The Hacker News front page is just becoming a security incidence status page at this point. Everything seems pretty fucked.
• Menu

  highspeedbus
  We're observing a worrisome speed up in security breaches. To me it's clear that weaponized AI will cause more harm than some productivity benefits.It’s the death of homegrown software.
• Menu

  ankit70
  How these Paas (Railway before) are being breached? Poor choices or something else? Scary Nonetheless. I thought AI advancement will make the self hosting painful. If PaaS are no good, then what can be done?
• Menu

  itissid
  So if you want to judge as a customer for selection and figure out how likely a new(ish) PaaS company going to get breached, how would you evaluate them?1. Ask them about what percentage of their own resources goes towards cybersecurity, audits etc. Would they even tell you.2. Technical stack maturity. If the details are available, because they won't reveal any of it to you.3. Other signals: Do they give talks on platform security, who is incharge of their cyber security.
• Menu

  carimura
  i'm surprised at the growth of all these neoclouds given the current security risk climate...
• Menu

  neya
  Run agents and everything they build. Secure execution from the first sandbox Getting hacked while in the business of selling a secure sandbox isn't really a good look. It seems like can't even trust anything these days. The other day OpenCode got hacked and leaked everyone's secrets inside .env to attackers and now this. Sigh.
• anon
  undefined
• Menu

  postalcoder
  I feel like these breaches started to accelerate after Anthropic wrote a full post about how easy it is to abliterate glm 5.3 to make a frontier-level cyber model.Now, to be clear, abliteration was no state secret, but that blog post was pure accelerationism.
• insane_dreamer
  not a good time to be a PaSS or SaSS ...
• anon
  undefined
• CreepyHunterX
  [flagged]
• Menu

  gavxn
  [dead]
• Menu

  sergiotapia
  So sad...Unfortunately I'm not longer using PaaS tools. Instead I use Azure for work and vps now for all my personal stuff. With AI it's easier than ever to lock a server down tight and mitigate this kind of exposure.I'm actually pretty pissed at this now. I have a throwaway appstore app that uses northflank for the backend, now I have to go in and rotate revenuecat secrets, apple secrets, ai secrets. For an app with basically 2 users.Can I even delete the app on apple's app store or whats the process like what a pain in the ass. I'm pretty done tbh.