HN

Comments (82)

• Menu

  dangoodmanUT
  As I mentioned in the Northflank breach post:Unfortunately for infra startups, I think we're going to see a convergence back to hyperscalers as a result of incidents like this and railway.There's no amount of "nicer to use" that can replace security, at least certainly when selling to enterprisesAlso, a trick i've started doing is encrypting my env vars, then hard-code the decryption key in the code
• Menu

  corvad
  I am sorry, this is "Resolved"? How can they even consider marking this resolved in any situation. Yeah we exposed your env vars but we told you about it over email so it's all good... We dont know how or to what extend though.
• Menu

  theturtletalks
  The biggest case for building bespoke software is that you drop your attack surface area and it’s not as lucrative to hack one person. Don’t even expose it to the internet if you don’t need to and just run Tailscale.
• Menu

  castis
  As far as my personal life is concerned, I honestly don't think I'm going to 'build and deploy' anything to any SaaS that isn't directly in my control for a while.
• Menu

  iampims
  It’s bold to set status page incident to resolved.
• BADCAFE
  This also happened to a trigger.dev competitor a few months ago, inngest.I was able to patch before it was exploited but that definitely made me question the service.
• Menu

  reassess_blind
  Have any of these companies disclosed the actual vulnerabilities used to gain access to their systems?
• CharlieDigital
  This should not be marked as "resolved". "Mitigated" until some percentage of customers ack the email notification at least (track clicks, get teams on Zoom call, etc.).
• anon
  undefined
• Menu

  asdfsa32
  So at this rate, how long before people start hiding use of AI in development of in their SaaS and services? or people really don't care, do they?
• Menu

  rvz
  Given the recent Claude Code remote access tool, it would be wise to not install any new software, or use any package manager for a few weeks as they could have already been silently backdoored during the aftermath of that incident.
• Menu

  cpursley
  The very fact that Nextjs vibe projects need an external (and paid!) background jobs / async service show how much of an anti pattern that this framework and similar are. Just use a sensible stack from day one that can handle concurrency out of the box like Elixir or something with established open source background jobs library. Then you can worry less about this kind of paid 3rd party nonsense. Ditto on auth. I just can't fathom outsourcing these types or core functionalities, the operational, security and cost risks make very little sense when there's libraries that do this out of the box.
• hhelll
  [flagged]
• anon
  undefined
• PavelGIL
  [flagged]
• Menu

  fathermarz
  Holy smokes, is security just not a priority at all anymore? Like in what world do we live in, that this is acceptable. And at the volume this has been happening, bad guys are having a FIELD DAY.