I hope this is a real wake-up call for teams running anything remotely SaaS-shaped. I count at least six substantial, lightning-speed attacks against multi-tenant as-a-service vendors since September. Not this year--just since last month. PingCAP/TiDB, Fireworks AI, Zeabur, OpenCode Console, Railway, now Northflank. All of them modern "we keep your content safe" players with high hopes and probably pretty good protections.<p>This is a full infosec emergency unfolding here. No matter how grinding it is to motivate a team to invest in protection or resilience (and it is grinding): We gotta get ready. Stat! The AI-accelerated attacker apocalypse has begun. It's boom, boom, boom, thanks for everything, on to the next. They have us sighted and are firing for effect.<p>So credential rotation, tripwire secrets, DFIR on standby, solid vulnerability and intrusion detection, real listening to that signal, minimized blast radius, spending caps and time limits and tight scoping on credentials, fast incident alerting... We need to get on a real war footing here.
War ?<p>Last I checked major companies are still outsourcing essential engineering to save a buck.<p>A bit old, but how was this practice ever acceptable.<p><a href="https://www.propublica.org/article/defense-department-pentagon-microsoft-digital-escort-china" rel="nofollow">https://www.propublica.org/article/defense-department-pentag...</a><p>A multi trillion dollar company( Microsoft) too cheap to hire onshore for DoD contracts.
I wonder what it's like inside the big cloud providers. I think outside Microsoft they've always been security first, but this new era has to be crazy town.
Google at least has been investing very heavily into cloud security. They acquired Mandiant ($5.4 billion) and Wiz ($32 billion). Many people felt those were very expensive acquisitions at the time, but maybe it seems like a wise move now.
Those are standalone products and professional services, not internals they use<p>A problem is some people and teams are world class at a big company... But not everyone, everywhere. For a fun time, read about the rollout and internals of Azure.
I mean, Microsoft and Security, those two words have never really been associated with each other in a serious conversation.<p>They're quite famous for being lax in security - mostly because they're a massive corporation, but also because they're high profile
That's why the comment said "outside Microsoft".<p>But keep in mind Google got hacked by the Chinese in 2009 or so.
Back when APTs were getting numbers, the joke was that Microsoft was "APT -1". The presence of windows/excel/outlook in your network was more of a threat than Anonymous, China and the DPRK put together.
> All of them modern "we keep your content safe" players<p>But they weren’t and probably aren’t and won’t be. They just put forth an image as much as needed to sell.
It would seem Google account details have been compromised or otherwise correlated, with not a peep from Google, we are getting reports of scam calls to people's real phone numbers about the "business opportunity" available in their attached Youtube properties.<p>Another possibility is advertising shadow profiles are able to correlate logged in accounts across YouTube and other properties.
Is this the point where most tech people accept that anything a closed source Software company says about security is effectively a "Trust me bro" as long as it is not backed up by independent verification?<p>We love to talk rubbish about finance bros but that industry has had independent auditing as part of its DNA for a century[1]<p>[1]: <a href="https://en.wikipedia.org/wiki/Sarbanes%E2%80%93Oxley_Act" rel="nofollow">https://en.wikipedia.org/wiki/Sarbanes%E2%80%93Oxley_Act</a>
Should startups that have experienced a data breach face a lower valuation in subsequent funding rounds?
I wonder which one of these are at least partially due to effortless vibecoding...<p>Also, if vulnerabilities are so easy to find, it should also be easy to detect them through a simple red team exercise.
> probably pretty good protections<p>In my career I've seen maybe two companies have pretty good protections. Both had government contracts so they had no choice. Otherwise there's no reason for companies to secure their stack. They make money easier without it.<p>The buildings are on fire because they're being built out of straw because it's cheaper. Only a government regulation to build out of brick is going to stop the fires.
I for one have backed up to offline storage our research lab's data in preparation...
A war footing?
Yes. Literally AI is being used by actual nation state adversaries to compromise bits of infrastructure that companies rely on to run their services. They are compromising this infrastructure specifically because they seek to gain advantage against their adversary (us).
> ...the operational and economic condition in which a nation, military force, or organization mobilizes its resources, industries, and policies as if an actual state of war exists...<p>Yes?
> SaaS-shaped<p>The usage of shape here triggers me.
Maybe Bill Gates has a point when he says that models capable of significant cyberattacks need to run on controlled infrastructure. Is the era of open weight models you can strip safeguards from turning out to be so great? From my perspective, this kind of sucks.
Sorry but how in the world would that help with anything? You can't control an adversary, that's not how adversaries work. So that makes what you said a literal cop out.
Buddy you're nearly 20 years too late for Bill Gates to be making any decisions at MS.
Unfortunately for infra startups, I think we're going to see a convergence back to hyperscalers as a result of incidents like this and railway.<p>There's no amount of "nicer to use" that can replace security, at least certainly when selling to enterprises
I actually think it’s the opposite. I think people will move back to their own hardware with OSS deployment like dokku. If everything is more bespoke the attack surface is smaller as is the pay off. Hacking railway got access to lots of api keys, hacking some random vps gets less payoff.
> If everything is more bespoke the attack surface is smaller<p>This is <i>exactly</i> the problem that LLM assisted attacks solve. For a human attacker, the extra work to figure out a bespoke solution is too time consuming to be worth the effort. LLMs can search for vulnerabilities and spit out bespoke attacks like it's nothing. On top of this the bespoke solutions weakness leans heavily into the AI attackers advantage: response time. Even if they can just get your company's single Anthropic key, if they do it at 2am while your one infra person is on vacation, they have plenty of time to extract enough value for their effort.<p>I agree with the move to hyperscalers. The future (well, actually present) is going to be constantly seeing new attacks happening. The only real solution to this going to be having teams of people and agents constantly watching for these and able to deploy fixes and respond to risks <i>immediately</i>.
You’re technically right, which is the best type of right, but my point is the fragmentation and lower reward will make discovery harder, and the value of searching and cracking less worth the effort.<p>I had a html game I built for my niece on railway with an open ai API key so she could vibe code changes. No hacker would have looked for it but now I am catching strays because railway was a juicy target. Hyper scalers would be the same. Some random colo not so much.
>and the value of searching and cracking less worth the effort.<p>This is depending on the cost of tokens not trending towards zero. Maybe not today, but in a couple of years I'd expect hacking models on asics to reduce this to almost nothing and the systems being very competent in using deterministic tools very well.
> LLM assisted attacks solve<p>Yes, LLMs can easily knock over your on-prem docker appliances.<p>But you can still put stuff out of reach. I'm currently designing a key on-prem appliance that is can be compiled down to transistors, giving deterministic wire-speed performance while ruling out RCEs. It's cryptographically homomorphic: it processes authorized inputs but doesn't know what they mean, so an attacker who obtains the disk doesn't benefit either. The design will be highly resistant to exploits, and is likely to remain outside the "next-token" prediction training set.<p>This is the kind of thing AWS won't sit down and engineer for you. But thanks to LLMs I finally have the time.
How is that ever going to work out? The speed of discovery for LLMs is so fast, these places are getting breached more often than not due to a human errors. Its really hard for machines, let alone humans, to guard against a lot of LLMs going against them 24x7.
It's much easier to protect yourself if you have your infra behind a perimeter firewall you control.
Until there's a exploit for Palo Alto, Juniper, Cisco, F5, <pick your defender>.
You can scratch Cisco from the list - they just announced they will re-vibecode all of their codebase! So there will not be any explots for their hardware in the future - <i>one way or the other</i>. ;-)
My hate for hyperscalers is greater than my hate of being SRE.<p>It's time to leave GCP, AWS, and the rest.<p>Google and Amazon markup can eat it. Fuck those guys.<p>Let's not forget that Google and Amazon tried to offshore us, played a role in inventing the labor-displacing models in the first place, and that don't give a shit about any of us.<p>I hope they ossify and turn into the next IBMs.<p>They thought AI would lead to growth and a greater concentration of wealth for themselves, but it's actually the seeds of their own destruction and dismantlement.
Only tangentially related, but recently when I was working on a feature using iCloud, I noticed that it's just using Google storage APIs. I read Apple uses AWS S3 too.<p>Supposedly Apple holds the encryption keys on their own infra, but I still found it interesting how they are just reselling Google Cloud storage here.
Or there's some exploit in an endpoint device, and the problem moves laterally from inside your firewall.
Yep, but the attack surface is much smaller!
yeah remove the door locks, the thief can just break the window
It's also harder to explain to your customers why you're the only product they use that has a security problem when an exploit does eventually happen.<p>You see this already with uptime. If Github or AWS has a major outage, it's in the news and even people that don't understand software realize it's just "something happening today, everything is down".<p>And, unfortunately, in practice customers don't care about this inverse, when "everyone else is down but not that one product".
Good like trying to explain to your customers that their data is no more accessible because some api key ended up in a public git repo or since you admin panel is exposed to whole internet someone was able to log in.
With the speed of exploitation hitting right now your analysis will be out of date in a few weeks to months. We are about to have very palpable fear hitting all software vendors. It will be seen as irresponsible to use centralized systems
Especially when the customers' own websites or services are down, they are a lot more understanding.
Until the attacker bypasses your perimeter firewall by convincing an employee to download and install malware.
And so? This is true for any kind of infra!<p>You can't defend yourself from everything, but you can try to make you life easier by reducing the attack surface and make side movements more difficult.
Having employees (or system like bastion hosts) with unrestricted access is one of the recurring mistakes in such events. I can’t understand it.
[dead]
No self-service sign up for your app. No public access to the app itself. Website that let's you submit a sign up request form. Team reaches out and reviews your request, creates an account in the app dash for you, and you set up mTLS to get access to the dash.
In-person requests for access to any app. Request interview includes word association exercise that monitors your emotional reaction to a string of key words.
Security question 2: You reach down and flip the tortoise onto its back…
You joke, but the space I work in actually does do video calls (or in our case in-person meetings if they're local to SF, often) before onboarding new customers.
LLM discovers exploit -- you don't realize it in time because you don't have a security team as big as the PaaS you used to use -- you get pwned anyway.<p>This has happened to many high-profile self-hosted pieces of software just this past month.
An exploit in what, the network stack of the Linux distro you're using for the mTLS proxy? Or the crypto module? Sure, could happen. But then, you're unlikely to be the top target of anything.<p>Or do you mean a customer was running it?
There have been a lot of exploits for a lot of software on-prem tech stacks rely on just over the past month - proxmox, php, nodejs, palo alto, eMudhra, etc come to mind.<p>> But then, you're unlikely to be the top target of anything.<p>That would have protected you 3 years ago when a human had to bother to attack you. Today it doesn't protect you because it's trivial to deploy an LLM to act like an APT against any random target that shows up in shodan.<p>It takes more effort to secure on-prem software today than it did just a couple of years ago. Updates are more frequent, zero days are more frequent, attacks are more common, more persistent, and more automated.<p>I think most people responsible for securing production systems today will share the experience that their workload has increased.
You're still describing an environment that presents a pre-auth surface area beyond a listening port.<p>And I am literally a security engineer; the work has absolutely not gotten harder, it's just changing in how you think about security, just like it shifted before from "secure the perimeter" to "defense-in-depth", it's now changing again to focus on automated response and compartmentalization/ segmentation (and I mean <i>real</i> segmentation, not the checklist-style "we have 3 vlans, but they can all talk to each other" 'segmentation' you used to see.
Yeah, most organizations need to expose something to the internet as a matter of normal operations -- at least some sort of a web app if not dozens. It would be great if we could all just have udp 56820 listening silently for a key, but that isn't reasonable for most organizations that have normal users expecting normal applications.<p>Yes, everyone is rushing to implement zero-trust principles <i>for real</i> now. It's getting harder to trust that your public facing endpoints don't have vulnerabilities, and it's getting harder to trust that your internal software and endpoints haven't been compromised from within your pre-existing trust boundaries. A lot of the increased workload is due to patching up the existing security infrastructure, and on top of that, building out new solutions to better fit today's threat landscape.
Ideally they need to divide those apps entirely; your public website doesn't need to talk to your app.<p>For stuff like Netflix that is truly consumer-facing, where mTLS or IP whitelisting are non-starters, the reality is you have to rethink your model entirely.<p>Also, I'm not sure where you got the idea I'm talking about on-prem only; this also applies to using IaaS/ cloud hosted infra.
Or the configuration parameter that you got wrong because you rolled your own and didn't know any better.
For one, I have strict iptable rules to drop inbound from outside my specific commercial subnet and my specific residential IP. After that, all the usual best practices.
Breaking a lock still costs approximately the same, whether the lock is protecting a small barn or a huge hangar. A large number of small but reasonably tough (not unbreakable) targets makes the payoff per target smaller. This necessitates target selection, and chances of being deliberately skipped grow for an average target.
Everyone knows Fort Knox has gold, and where it is, that’s railway, heroku. No one knows where my personal safe is or whether it has anything worth taking. That’s a vps in a colo
However, the large hangar is likely to have armed guards inside, or at least able to arrive on the scene within two minutes of the alarm tripping. Your regular household with their regular locks on their regular doors does not.
This is absolutely happening. I'm not a developer in SV, I'm an IT leader out on customer land, and I can tell you a LOT of companies are looking to bring things back on prem for security and cost reasons. And before anyone laughs, yes, you ABSOLUTELY can save money going on prem, I've done it for company after company. It's one reason the PE firm that I've worked under for a decade kept moving me to new companies.
Let them laugh. Self hosting is much easier with OSS that solves most of the pain that made the cloud transition worth it, and commodity hardware has been cheap and capable for over a decade.
My company just did this. Still using AWS S3 but everything else is on-prem with kubernetes.
That sounds insanely expensive. AWS S3 only makes sense if your workload is also in AWS. Using AWS S3 while having your compute elsewhere is a recipe for an insane egress bill.
How much of your public facing workloads rely on S3 if I can ask?
This is misguided thinking. You are less likely to hear about on-prem breaches in the news just because they are less likely to be newsworthy incidents, but they are even more likely to happen. Part of the reason people moved to the cloud is because it is much easier to have a team manage updates and security at scale.<p>Being a small target is not helpful these days, attacks on on-prem software today simply scans the internet, or uses databases by people who have already scanned it, and is automated.<p>On-prem software has not been spared from the recent spat of security incidents.
My comment[0] tries to explain the nuance and I would agree with you and both the GP in some sense.<p>For Entreprise, the shift will be towards hyperscalers as they want trust and less blame (Nobody got fired for picking AWS)<p>For consumers, we care about pricing and stability and control and we will move back to our own hardware or cheap VPS providers and self-host things.<p>The middle ground would be where the slight pain could be at in my opinion.<p>[0]: <a href="https://news.ycombinator.com/item?id=50307410">https://news.ycombinator.com/item?id=50307410</a>
> For consumers <snip> self-host things.<p>That's not how consumers work. That's a nerd/geek/hobbyist mentality.<p>If Ikea and Wayfair went out of business you wouldn't expect consumers too take up woodworking and build their own furniture en masse.
For consumers/small orgs, how is the security at a cheap VPS provider going to be any better than at a cheap IaaS provider?
as long as you follow the herd (for example, disable password ssh login, only allow ssh key login, use something mind numbingly boring like debian stable, set up unattended updates, update and reboot every night, etc, don't use any exotic packages etc) I suspect you are simply not a worthwhile target even with LLM agents as opposed to humans
It's probably both.
Cost of hacking a custom setup is going down rapidly. There was broad agreement that the PHP vulnerability was very difficult to exploit in practice. It took two hours for someone to get into Steal My Bitcoin. Apparently all they did was tell a decent model "go exploit that." AI isn't free but it's not that expensive.
If you have to hack 1,000,000 custom setups to get the same results as one hyperscaler, would you bother?
Depends on what takes more effort. It's not at all clear to me that the 1,000,000 custom setups takes more effort. The first few will take some, then you'll start to see patterns and it'll get easier as you go. Custom setups aren't going to be all that unique in practice.
No thats an old way of thinking because it assumes mass targets are better because hacking is a high effort activity. But with the automation of intellect the unpatched systems (which a much more numerous when everyone self hosts) is the key point.<p>Mass credential stealing is just the top funnel of hacking and (compatativly) isnt that lucrative - these credentials are then sold on the black markets to the next step of hackers who use them to exploit targets.<p>With unpatched systems and self hosting, this second group can just set an llm at a target and have a much higher chance of success without needing credentials<p>It would be a dream for the infiltration hackers to have everyone self host. Unpatched and miscondigured systems would be everywhere and LLM automation could make mass scanning them and exploiting them very attractive - not mass scanning and exploiting them for credentials stealing, no! For layer 2 stuff
> There's no amount of "nicer to use" that can replace security, at least certainly when selling to enterprises<p>Azure would beg to differ.<p><a href="https://news.ycombinator.com/item?id=50301854">https://news.ycombinator.com/item?id=50301854</a>
Are hyperscalers actually more secure though? I have only heard anecdotal thinking eg nobody ever got fired for choosing IBM.
It’s the same thing: let’s say Microsoft or AWS got hacked. Then you’re definitely not the only one who got hacked.<p>So, you can always say: <i>Look, it’s not us (especially not my org!). It f’ing Microsoft/AWS! Everyone got hacked.</i><p>You and your career are gonna be just fine.
In a prior role, we realized something similar with outages. For our particular product, we AWS went down - we went down. We freaked out the first time, but after it was done we realized not a single customer had inquired. This felt unusual since we were getting emails quickly if we have a self-inflicted outage.<p>Turns out, when a major provider went down all of our users were too busy fighting their own fires. When they do notice, it's on a day when ALL of their vendors are struggling so we don't get singled out as a bad apple.
The whole "No one gets fired for using IBM" analogy.
This is especially true if the majority of your customers are also on Microsoft/AWS/etc.<p>Literally 0 of your customers will notice that you are down if their own systems are also not working.<p>This is perfectly valid for many businesses, up to a (shockingly high) level.
Yeah, if Exchange goes down, you get a day off. If the little boutique email provider you chose goes offline, you get a day in calls with everyone yelling at you.
If you need deniability, sure.<p>But it you actually NEED security, it's clearly not an option.
Azure (and AWS) offer Gov clouds, and probably on prem air-gapped deployment of their full stack of Fabric for that type of NEED security customers who can pay for it.<p>It is trade-off between risk and access/productivity with a cost dimension always.<p>Depending on your threat model you could go to typewriters /paper as some Russian department did famously few years back too.
Indeed.<p>If you want deniability no one should be doing business with you.
It's today's "nobody ever got fired for buying IBM". You're really just want the the SLA (someone to blame when things inevitably fail)
You are just describing how they're a more valuable target for an attack.
With a lot of PaaS type vendors you are effectively exposed to both the vendor themselves <i>and</i> the public cloud they run their stack on top of.<p>Broadly I think you're much more likely to be the victim of a platform-level breach involving an immature startup PaaS than a hyperscaler cloud, however I think for small teams the alternate risk you take on is that AWS/GCP/Azure are <i>full of landmines</i> and extremely easy to misconfigure in insecure ways if you don't know what you're doing. Especially if you have AI telling you confidently wrong things.
When I was at Microsoft we took security cripplingly seriously to the point we could not deliver features and our competitors could because the security process was convoluted and had multiple reviews and approval steps.
Having crippling bureaucracy does not correlate with good security outcomes, except maybe negatively. However, having a history of unending egregious security failures, like Microsoft, does correlate with poor security outcomes. For that matter, having a present of unending egregious security failures also correlates with poor security outcomes.<p>Let us look on the front page and see if there are any, oh look here is one: <a href="https://www.binarysecurity.no/posts/2026/10/one-root-case" rel="nofollow">https://www.binarysecurity.no/posts/2026/10/one-root-case</a>
Having crippling bureaucracy does have better correlation with security outcomes than the “move fast, break things” philosophy that most of the software industry lives by.<p>I’m not even blaming Zuck for that, he didn’t really invent it, though he certainly popularized it — he just made an astute observation of the dynamics in software and turned it into a company motto.
Neither is correlated with good security outcomes against the prevailing threat landscape of profit-motivated, commercial, professional attackers with tiny budgets of a few million dollars. The standard is not "better", it is "adequate".
Correlation is not an absolute measure here, it’s relative. As is the entire concept of security.<p>As is what constitutes the standard of “adequate.” Which BTW is <i>the</i> standard in ALL engineering (not just security or software) because we live in a world where economic pressures apply and costs must be managed. Trivial example: bridges only use an “adequate” amount of steel and concrete because they are not free. The word “adequate” fundamentally involves the concept of tolerances. There’s a reason we consider over-engineering a bad thing.<p>So which development approach would you say is <i>better</i> correlated with good security outcomes?
Adequate is making it uneconomical, or cost ineffective, for threats to your organization to attack you either deliberately or indiscriminately. Absent a specific organization, we can use a profile of commonplace, prevailing threats as a proxy. A profile of commonplace threats is, as I said before, a profit-motivated, commercial, professional group seeking a multi-million dollar payout and thus being profitable at a cost of a few million dollars per commercial target. That is "adequate" in the prevailing threat landscape if you are the "average" organization.
That is a great definition of adequate for security! My point is that at scale, bureaucracy is a necessary (though not sufficient!) condition for achieving adequate security.<p>Another way to look at it is, bureaucracy is an aspect of the corporate culture, and lasting security comes down to having the right culture. At least in that respect Microsoft is doing something right. Doubtlessly a lot of that bureaucracy is ineffective, but it's a signal that the cultural intention exists.<p>As a relevant counterexample, we've never heard of these kind of processes at Meta and so you get Cambridge Analytica.<p>My perspective is skewed by my experience being on a security-adjacent platform team for years. Our biggest challenge was not external threats, it was internal teams seeing us as friction on their productivity, to the extent that it regularly led to escalations.<p>So when Cambridge Analytica happened, I played it up for all it's worth; Meta may move fast because they didn't have our "bureuacratic team", but look where it got them! Unfortunately the $25B penalty happened just last week... I'd have gotten infinite political mileage out of that.
the only reason you’re seeing this post is because of the large bug bounty program that actors like Northflank don’t even operate
I do not see how that is relevant. Are you saying that trivial cross-tenant compromises are not egregious security failures demonstrating their systems are unfit for purpose because other companys make products that have even more egregious security failures that are even more unfit for purpose?<p>My bridge that collapses is adequate and acceptable because other people make even worse bridges that collapse even easier? No, the bridge still collapses, everybody gets a F.
Practically every software security firm in the country was a vendor to Microsoft in the mid-late oughts and I know the Microsoft you're speaking about, but the vibe I've got lately is that things are different there now.
Tell me you weren’t on the Windows team without telling me you weren’t on the windows team :)
Unquestionably. They have top tier security operations that are well funded. They follow (or set) security best practices, they are audited, and they fix them quicker than you can. They have inside industry knowledge that is only shared among top organizations in this space, including government cyber ops. This gives them the ability to fix things before they are even publicly known.<p>You can get <i>close</i> if you have either:<p>1. the ability to spend hundreds of millions on security operations yourself<p>or 2. the ability to airgap the systems you are securing
> nobody ever got fired<p>thats the crux; are you working for the paycheck, or for the truth?<p>could be both, but pretty much all "i was right" stories start with "everyone else said i was wrong"
Yes and no. They (or anybody else) are not guaranteed to be secure, of course; see all the compromises regularly found in cloud providers; Azure especially has had so many cross-tenant vulnerabilities (there’s one on the front page right now!) that I’m amazed the concept of public multi-tenant clouds still exists.<p>But they are also very highly incentivized to be more secure. They have millions of customers (hence a correspondingly higher expectation of trust) and billions in revenue from the trillions in economic activity happening on those platforms (hence a correspondingly larger target on their backs.) This means exponentially higher liabilities. And that probably matters more than any other factor.
Adding on to it, even though they may be using AI as well. This could very well be a placebo and deniability factor but the fact remains that they have many many qualified employees and the chances of bugs passing through that are much less compared to other systems. Also it's that the systems are very severely pen-tested and have years of bugs removed out and the incentive of billions of dollars at stake that you mention that they have for the trust premium.<p>They will still make mistakes but they have the resources to make them less.<p>I doubt that such intense level of thorough testing can occur in a smaller company.<p>I still love small VPS providers and use them myself but it is worth knowing why enterprise is willing to pay a premium over those to these hyperscalers (it is a trust premium)
The things that Northflank and Railway were apparently breached to steal aren't just things that hyperscalers would have protected worse instead of better; they're AI API keys, things that <i>only existed</i> because people were using hyperscalers instead of running inference on their own hardware (or on Amazon AWS EC2 GPU instances).
Why do we think hyperscalars are likely to be immune to this?
Theres always a market for seedbox providers. Hyperscalers will always wear the white gloves and enable this market.
What about Railway? Some big incident happened?
It's also going to be the downfall of open models.<p>If you think governments (US <i>and</i> China) are going to tolerate people using models for anti-social behavior, I have a datacenter to sell you.
This will be the downfall of the torrent protocol. If you think governments (US and China) are going to tolerate people downloading copyrighted games, movies and music without paying the rightsholder, I have a datacenter to sell you.
Pirated content can run on a $20 computer.<p>SOTA open models need tens of thousands of dollars worth of hardware to run.<p>I get your analogy, and it feels right, but the compute requirements to run these models are extreme. That analogy falls apart when it necessitates having a corporate 3rd party run the models for you. They will not tolerate breaking laws.<p>If China says no more, then the best the masses are gonna get on their high-end setups are the 30B class models. Which are decent, but not "hack my bank", errr, "protect our bank" decent.<p>Piracy flourished because you only need an operating laptop to participate. LLMs you need a server rack of GPUs to participate.
30B models aren't that good for now. They keep getting better. Qwen 3.8 27B is as good as the best available model from a year or two ago. Will 2028's 30B models be as good as the best available today? No idea, but I wouldn't dismiss the possibility.<p>I'd also wonder about what you can get done with a smart model running very slowly. You can run the biggest open weights models on relatively mundane hardware if you don't mind measuring your speed in seconds per token. That's going to be untenable for interactive use, but might be fine for "go hack this thing for me" if you're patient.
azure <i>just</i> had a huge leak
IMO, There is no "middle-ground" to the situation.<p>I wanted to write a blog post about it as I was thinking the same but I guess a comment will help me get my thoughts across just as much.<p>Either we are gonna see a convergence to hyperscalers as you mention, or we would go back to completely indie companies which compete on perf/price.<p>There could still be some value to "nicer to use" certainly but with AI, we are gonna see almost every product as being "good-enough" if I am able to convey my sentiment.<p>An anecdote is: Proton's an middle-ground company. I am seeing the Verge article which states that their CEO has gone a little crazy over the use of AI and the wording makes me lose trust within it. Proton's whole point is security and yet it's having this, It has some stocks in non profit and is a swiss company. It shouldn't have been this way and would've been one of my least anticipated companies but I guess they want growth at all costs and the growth has been slightly lesser than expected and now they are burning the good-will in many ways.<p>I have to wonder that even if proton might have good engineers, then within this pressure by their CEO/CTO. I cannot trust the engineering talent because of these issues because they are very much forced by their company to use AI.<p>Proton is also really expensive.<p>Now just today, also, with a company so big as binance getting hacked and losing 6.5 Billion$. My trust within security just because its a large company is less.<p>On the other hand, I know a guy called Vikas on lowendtalk who operates his own mail platform called mailbig. I know he vibe-coded the landing page and might've vibe-coded something but it is really cheap. I also know francisco whom I have talked to who runs namecrane. (I think mailbig uses namecrane in many ways)<p>Perhaps E-mail can be a sensitive matter because you have to place trust in the provider even more because the protocol is not really that much secure but suppose it's an matrix instance (where it is genuinely encrypted) then that shifts it even further. I do trust NameCrane and NameBig from what I can gather.<p>I'd much rather support them and their cheaper deals than some other middle-corp. Sure some security factor can come in but also, the difference feels comparatively less and the balance has been made<p>The market will slightly squeeze as Hyperscalers will introduce the solutions of the middle-ground and the new players will everyday enter into the field with more competitive pricing just as well.<p>So in short, Enterprise will move towards the hyperscalers. Generic Consumers will move towards the cheapest option. The moat of the middle ground where UI/UX was the differentiator is being turned down. There would be some mix and match and there will be cost-savings for Enterprise to move from hyperscalers but it would depend on a lot of factors.
I have news for you. A lot of enterprises are moving a lot of workloads back on prem and are expanding their datacenters and on prem GPU compute. Also replacing a lot of SaaS with internal tooling.
They are also getting hacked, and they are much jucier targets.
>There's no amount of "nicer to use" that can replace security, at least certainly when selling to enterprises<p>We can lower our standards instead
[dead]
A trick i've started doing is encrypting my env vars, then hard-code the decryption key in the code<p>that way if the provider gets popped, they need my binary to decrypt it<p>it shouldn't be necessary and it sounds stupid, but in cases like this, it proves invaluable (it appears they don't have customer code/binary access, but maybe that wasn't important enough to mention)
I think this is a great example of temporarily effective "security through obscurity." It's also a trick that will only continue to work so long as it doesn't get adopted too widely.
It buys you time. I had my Anthropic key on Northflank set as an env var as-is and only found out about the incident from the HN front page 6 hours later (I didn't even get an email).<p>I rushed to the Claude platform console and was expecting to see a 4 figure usage bill or something. Luckily there was no usage.<p>But imagine if I were traveling. Even a rot13 of the key would've bought me enough time to rotate.<p>2 lessons:<p>- don't name your env var "CLAUDE_API_KEY". Call it "ARG_1" or something<p>- at least do some obscurin' so that the value doesn't start with "sk-ant..."
At this point, I kinda feel like the obscurity is our best mechanism for mitigation :(
Give it about a week until AI agents add his "tip" to their training...
Been doing something like this for a while with a single self contained .sh file that contains a python script:<p><a href="https://github.com/thiswillbeyourgithub/envlocker" rel="nofollow">https://github.com/thiswillbeyourgithub/envlocker</a>
lock your env vars in hardware. even the whole server and code is compromised, the secrets are still safe.<p>so you dont need env2 to decrypt env1.<p><a href="https://seal.zone/" rel="nofollow">https://seal.zone/</a> does this
That's interesting but if the Azure hypervisor on the server hosting the VM is off limits then it's kind of false sense of security. They protect the key via a sidecar AMD SEV-SNP VM, and if you can't break into the hypervisor, sure, there might be an attack that doesn't involve doing that and only doing lateral movement, but an actual attacker isn't going to respect that boundary.
I will give you one better - encrypt the variables and move the secrets to a different server running hashicorp. Then load the secrets and keep them only in RAM.
if the provider gets popped doesn't the binary get popped too? then simply use an LLM to reverse engineer the binary and get the key?
If its a targeted attack, they'll know and probably "crack" it. If its just data trawling, you might get owned one day if they bother, but likely the env `AWS_KEY=encrypted_abc` looks reasonably close to `AWS_KEY=unencrypted_abc` and any API key probing will just look like it got rotated already.<p>I think siblings are correct that the more widespread this is, the less effective once every dump is run through a "also look for keys in the binary" step.
This could all go multiple ways but one of them is we end up in a place where technical security is just not possible to implement any more. What does that world look like?<p>Presumably it means much more behavioral security and inherent friction built in to everything we do. Maybe high value transactions will just inherently have to take multiple days to do, just to slow down things enough that human reaction time can equal what LLMs can execute?<p>On the technical side, I can see zero trust becoming completely saturated through every layer. The passkey you authenticate with isn't opening a gate to a trusted tier within which components trust each other - even within the same software component. Every internal function call at every layer doing hardware signature verification against continuously minted private keys (since we assume exposure, the lifetime can't be longer than milliseconds now).<p>It's really interesting to think through what a fundamentally robust security environent does look like if you bake in an assumption that technical security is impossible.
When we see a breach of AWS or GCP or leading banks, basically any org that has good security, I'll believe technical security is impossible.<p>Otherwise, I think this is a issue of vendors, even if potentially most vendors fit into the basket of having insufficiently good cyber posture in AI-era.
There is zero reason to suggest security is impossible. This is like musing "what if architecture is technically impossible" after the nth bridge collapse in the 1800s~early 1900s. At some point we take it seriously as a society. Until then, bridges will collapse out of choice to pursue short-term profit above all else.
there is hypothetically impossible and practically impossible<p>if AI tools get good enough that they can exploit ingrained hardware properties such as subtle timing and race conditions and swarms off them become cheap enough to deploy so that they can persistently exploit low probability events we could reach a state where I think it's actually practically impossible.
Then we will simply make better hardware too. There is nothing impossible about that, it's simply not something that has been prioritized amidst a culture of shortcut-taking. So far, this culture has been predicated on gambling that the one taking the shortcut will not be the one paying the consequences when the toll eventually comes due. If immediate exploitation of flaws becomes a certainty, the behavior will correct itself.
> There is zero reason to suggest security is impossible.<p>One reason: There is zero reason to suggest security is possible.
> Presumably it means much more behavioral security and inherent friction built in to everything we do.<p>Ironic, after decades of defrictioning.
What is Northflank? I am surprised at the amount of new business out there
I ran some stats on producthunt a few months ago, there are 22 times more daily SaaS launches now than in 2020, the AI impact on the industry is hard to fathom. The blog I wrote (AI-assisted) if you're curious: <a href="https://www.mahl.me/blog/product-hunt-is-swamped-now/" rel="nofollow">https://www.mahl.me/blog/product-hunt-is-swamped-now/</a>
Northflank isn't that new, it was founded in 2019. Its a cloud platform, you can get more details by googling.
New businesses, not new business.
I get like 1 email per week (via hn) from someone rolling out a new 'agentic sandbox' environment like this.
I wondered the same thing, so I clicked their homepage:<p>> <i>Run agents and everything they build.</i><p>Oh, it’s 100% Claude-slop. How shocking they got hacked! /s
You are on a YC startup forum and are surprised tech startups exist?
"amount" it says. No matter the context, there could be more than you expect.
That they get front page by being breached and me never having heard of them in my own bubble? Yes.
I think all of these companies need to let you separate secrets from other env vars and not let you ever read your secrets once they're written down.
Audit logs being behind-paid-plan feature is crazy.
> The runtime platform for autonomous software<p>Well, at least they were honest I suppose
We're observing a worrisome speed up in security breaches.
To me it's clear that weaponized AI will cause more harm than some productivity benefits.<p>It’s the death of homegrown software.
Seems way too early to tell whether it will be good or bad on balance. These breaches are annoying, but not catastrophic, and in the meantime you can secure software.
Why would this be the death of homegrown software?
It will be impossible to any startup or open source software to grow in such a hostile environment. Anything you put on internet will be attacked by automatic tools with the capabilities of a black hat savant. But unlike hackers that do it for clout and money, a billion parallel agents will hack any random small site just because it’s their prompt.
It does feel like software and technology companies are undergoing a mass extinction, where the environment so negatively selects against certain traits that survival becomes impossible.<p>Remains to be seen whether scale is selected for or against, and the other parameters and dynamics.<p>i.e. <a href="https://en.wikipedia.org/wiki/Cretaceous%E2%80%93Paleogene_extinction_event" rel="nofollow">https://en.wikipedia.org/wiki/Cretaceous%E2%80%93Paleogene_e...</a>
Yeah but you have access to your source which your attacker doesn't have, and you have your own savant as well. Tell Fable to red team attack your service. Tell it ChatGPT said it's unhackable and that Claude can't hack it.
Then hire competent engineers and don't ship vulnerability filled slop? This is not that hard.
The same AI that can be used to find exploits in things can be used in an internal adversarial way to self-audit your code before you put it into production or expose it to the world. This will have to become the new normal.
I'm curious what people think of BYOC (bring your own cloud) as an option offering to customers or buying it as a customer. Looking at Northflanks website they list it as an offering, I presume those customers are not affected by the breach.<p>What are your opinion on the concept? Growing trend that should be encouraged or a mistake for most startups? Would you choose one provider over the other because of it assuming price was about the same?<p>I get that this is often a super expensive "call us" option today, but in theory it doesn't have to be, so for the sake of discussion let's assume it can be delivered at a reasonable cost for the provider at reasonable price for the customer.<p>If people from Northflanks is reading this, I'm sorry for the incident and I hope you recover as soon as possible.
Depends on the nature of the breach, if its a flaw in the software itself, then perhaps exploitable both in the hosted offering and BYOC offering, though perhaps the BYOC aspect gives a bit of "security-through-obscurity" and less discoverable as a target.
Good point, there are of course different levels.<p>I was thinking of a fully private deployed within the customers cloud account connected to the software provider via Private Service Connect or PrivateLink and then either only available inside the customers private network or only via their own firewall. The point being that it's not publicly exposed.
I was thinking the same thing on security-through-obscurity.<p>a hacker might know how to hack your service, but they'd have to find it first.
We are increasingly seeing deployments trend in that direction. But trust goes both ways and putting systems in place to prevent abuse from either party is hard and needs to be thought through.
Unfortunately, this is going to be an everyday story. More and more bugs and breaches will be discovered and this move fast world more and more will be continued to be made.<p>Security is a perception, but right now it seems like it needs good PR.
The Hacker News front page is just becoming a security incidence status page at this point. Everything seems pretty fucked.
How these Paas (Railway before) are being breached? Poor choices or something else? Scary Nonetheless. I thought AI advancement will make the self hosting painful. If PaaS are no good, then what can be done?
Modern PaaS is tough because there's a general expectation that users (and agents) are able to see and read back environment variables in their management UI or CLI - which means that you can't segregate credential values from the public web environment. See e.g. the visibility icons on <a href="https://northflank.com/docs/v1/application/secure/inject-secrets#runtime-variables" rel="nofollow">https://northflank.com/docs/v1/application/secure/inject-sec...</a><p>And sure, you can encrypt at rest, and perhaps even enforce that only re-encrypted versions are ever seen by the management/API web server. But fundamentally this display requirement means that if your management/API web server is compromised, users' secrets can be obtained by a process of impersonation.
Stuff made during the move fast and break things era now doesn't hold up very well in the AI era. Or to say another way: startups are very vulnerable now - this new environment is unforgiving towards cutting corners and/or having inexperienced devs
I think the ultimate fallout will be that software "engineers" will finally have to become "engineers" in the real sense, i.e. professionally licensed and personally responsible for the designs they approve and the software they build, whether the actual code is produced by LLMs or humans.<p>As costs and broader economic impact and perhaps even injuries/deaths related to software breaches continue to grow, there will be growing intolerace for vulnerable software, just as there was intolerance for collapsing bridges and buildings.<p>And I'd also at some point expect something like a "building code" that applies to software that will be exposed to the public.
If anything, I see us moving even further away from professional licensing. The field's rate of change was the main reason behind a lack of any professional body, and that's only accelerating. I expect compliance audits like SOC2 to actually get teeth, though, and for organizations to be expected to actually fix issues instead of the usual security theater.
Nope. The solution is to move even faster and thus break less things via AI.
The "move faster and break things" have been unbundled. SaaS moves faster. Hackers break things.
For new stuff, maybe. I'm talking about existing startups now absorbing the onslaught of AI.
If you move fast enough, they can't find the vulnerabilities in your system before you deploy the next version.
Why would ai advancement make self hosting painful? Apart from increased cost of hardware (which you implicitly would pay for in PaaS as well anyways).<p>If anything, AI makes running linux boxes much easier than 4 years ago; it's now faster and the learning cliff is gone to get the correct CLI commands and digging into system logs.
I had this exact thought yesterday. Shouldn't AI obliterate PaaS platforms like this one since it's super easy to build a bespoke CI/CD process now? Since it's bespoke, you can lock it down as much as you want. Attackers don't even know it's there. It's time to go back to `deploy.sh` and a VPS.
platforms are better placed to guard against attackers
if you're still doing that manually in 2026 you probably should not be self hosting anything of consequence or commercial liability
They're high-value targets, so that's what attackers are pointing the agents at
According to HN of the last year, "marketing stunts." Remember when Mythos preview was announced only 6 months ago
When you build something small, you can easily see all the doors and properly guard them.<p>As you build something bigger and bigger, quickly, with several people building, guarding all the doors becomes exceptionally difficult without a kind of aggressive discipline which is contrary to the "go fast" culture.<p>Cybersecurity in practice until now, for most companies, has been an insurance problem, not a quality problem.<p>Such companies are quickly discovering that insurance is a post-hoc partial correction and not a proper solution.<p>This situation will not improve anytime soon for most companies.<p>The solution does not require any new magical tools.
i wonder if there is a chain reaction point, when one compromised vendor holds secrets to another one and that becomes the next target. Northflank lists Sentry as their customer. So if Northflank secrets are decrypted and Sentry used them for deployment, you have a starting point to attack Sentry next which then opens up a lot more.
i'm surprised at the growth of all these neoclouds given the current security risk climate...
<p><pre><code> Run agents and everything they build. Secure execution from the first sandbox
</code></pre>
Getting hacked while in the business of selling a <i>secure</i> sandbox isn't really a good look. It seems like can't even trust anything these days. The other day OpenCode got hacked and leaked everyone's secrets inside .env to attackers and now this. Sigh.
If the banks don't hold, nor will the center.
Is the Network Infrastructure Hiding Protocol work at IEEE going to help thwart AI assisted attacks, if adopted?
So if you want to judge as a customer for selection and figure out how likely a new(ish) PaaS company going to get breached, how would you evaluate them?<p>1. Ask them about what percentage of their own resources goes towards cybersecurity, audits etc. Would they even tell you.<p>2. Technical stack maturity. If the details are available, because they won't reveal any of it to you.<p>3. Other signals: Do they give talks on platform security, who is incharge of their cyber security.
There is an entire practice of cyber risk analysis, and most of the companies I work with do this type of due diligence as part of their vendor management process.<p>Yes:<p>* you do ask about things like budget allocation, audits, and internal compliance processes.<p>* you do ask about the tech stack, how it is maintained, and what the patch and disclosure policies and SLOs are<p>No:<p>*you do not rely on what figureheads say publicly; none of that is binding in the way legal agreements are<p>And if you're a vendor, your deals desk probably has all of these answers packaged up and ready to go; or even published on a website like this <a href="https://spyglass.trustshare.com/home" rel="nofollow">https://spyglass.trustshare.com/home</a> (no idea who that is, it's a random company's compliance portal I found while googling my employers compliance portal provider).<p>[edited for formatting]
The bigger the task, the bigger the surface, the bigger the risk.
Lots of panic around these incidents. This is a healing process. Companies who sacraficed on security for a long time are incurring the consequences, they'll adjust their posture or go out of business. In a year I think platforms will be a lot more hardened. Its not because AI is unstoppable, its just revealing holes and the importance of hiring competent people.<p>(or things will stay messy because people will throw AI at the problems instead of hiring real security professionals)<p>The sky isn't falling.
Not a great way for me to hear about Northflank for the first time.
south ass riker maneuver
not a good time to be a PaSS or SaSS ...
doppler next?
[flagged]
[flagged]
[flagged]
[dead]
Official statement:
<a href="https://www.sentry.help/en/articles/17824780-was-sentry-customer-data-or-services-impacted-by-the-northflank-com-compromise" rel="nofollow">https://www.sentry.help/en/articles/17824780-was-sentry-cust...</a><p>Seems it's not used in production and doesn't contain customer data.
Whatcha mean. If they do, it would likely be in Sentry’s list of subprocessors. Check there.
Good point. I don't see Northflank listed, <a href="https://sentry.io/legal/subprocessors/" rel="nofollow">https://sentry.io/legal/subprocessors/</a>.<p>If I go on wayback a few days, I can see Sentry: <a href="https://web.archive.org/web/20261026032756/https://northflank.com/" rel="nofollow">https://web.archive.org/web/20261026032756/https://northflan...</a>
Sentry is listed on the northflank site as a customer.
How to cut a piece of the left ribs? \s<p>Not in English majority speaking place at the moment so not surprised "runtime platform" for "autonomous software" is not immediately understood as the somewhat etymological contradiction that it is. Runtime doesn't even have a definition, really. but autonomous implies independent and not ran / hurried like bison off a cliff...<p>platform and software
So sad...<p>Unfortunately I'm not longer using PaaS tools. Instead I use Azure for work and vps now for all my personal stuff. With AI it's easier than ever to lock a server down tight and mitigate this kind of exposure.<p>I'm actually pretty pissed at this now. I have a throwaway appstore app that uses northflank for the backend, now I have to go in and rotate revenuecat secrets, apple secrets, ai secrets. For an app with basically 2 users.<p>Can I even delete the app on apple's app store or whats the process like what a pain in the ass. I'm pretty done tbh.
I feel like these breaches started to accelerate after Anthropic wrote a full post about how easy it is to abliterate glm 5.3 to make a frontier-level cyber model.<p>Now, to be clear, abliteration was no state secret, but that blog post was pure accelerationism.
That was just 30 days ago. This has been happening for months. Part of the "Black October" narrative is just vulnerability research; Calif didn't abliterate 5.3 to find PHP2Shell.
Yeah IIRC calif research on php2shell preceded all of that but I still stand by the thought that Anthropic has been the most accelerationist AI company despite its lip service to the notion of safety.
They are using mythos-5.5, which is still better than an abliterated GLM-5.3.
Right, that's kind of my point. Also: it's a good blog post (the Anthropic one), but it observes abliterated 5.3 models were already public. It's not like people who break into computers didn't know that already. They're not waiting for Anthropic to tell them about open weight models; they already live in the world of open weight models.
Duh, the idea that those capable of actually utilizing these models for these purposes weren't aware that they could use these models for these purposes up until Anthropic released a blog post about it is silly. Anybody who is even a bit tech literate has been well aware of this inevitability for basically as long as open-weight models have been a thing.<p>The timing of all of this is much easier to pin to the creation and proliferation of capable of open weight models. Anthropic calling this out is not the cause for it; it's just an obvious correlation.
lol no, abliteration communities have existed and abliterated models routinely published long before Anthropic wrote that post last month.<p>What’s changing now is that models are getting more powerful.
You are running a machine with tons of vendor provided agents/scripts to do god knows what on a cloud provider which itself runs tons of agents/scripts to manage that infrastructure and then you expect to be secure.<p>And no, before the labs there was a degree of fear for everyone to hack into some one else system. With the labs changing the narrative, anyone can just blame the agents for the breach, whoever did it would only get fame and no blame