Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vercel April 2026 security incident

bleepingcomputer.com

Post reply on HN
Print view View original

131–140 of 540 posts

Re: Vercel April 2026 security incident

#131

Post by fintler »

dennisy wrote: post #120
nightski wrote: post #118

Earlier quoted context omitted.

It's a good point, but I don't think the problem here is Claude. It's how you use it. We need to be guiding developers to not let Claude make decisions for them. It can help guide decisions, but ultimately one must perform the critical thinking to make sure it is the right choice. This is no different than working with any other teammate for that matter.

I think most people would agree. However it is less clear on how to do this, people mostly take the easiest path.

Its an eternal september moment.

https://en.wikipedia.org/wiki/Eternal_September

Re: Vercel April 2026 security incident

#132

Post by fantasizr »

operatingthetan wrote: post #125
nikcub wrote: post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

It's interesting how many of the low-effort vibecoded projects I see posted on reddit are on vercel. It's basically the default.

next, vercel, and supabase is basically the foundation of every vibecoded project by mere suggestion.

Re: Vercel April 2026 security incident

#134

Post by btown »

nikcub wrote: post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

"Nobody ever got fired for putting their band page on MySpace."

Re: Vercel April 2026 security incident

#135

Post by sbrother »

embedding-shape wrote: post #51
jtreminio wrote: post #8

I'm on a macbook pro, Google Chrome 147.0.7727.56. Clicking the Vercel logo at the top left of the page hard crashes my Chrome app. Like, immediate crash. What an interesting bug.

Huh, curiously; I'm on Arch Linux, crash happens in Google Chrome (147.0.7727.101) for me too, but not in Firefox (149.0.2) nor even in Chromium (147.0.7727.101). I find it fun we're all reading a story how Vercel likely is compromised somehow, and managed to reproduce a crash on their webpage, so now we all give it a try. Surely could never backfire :)

Following since I just reproduced the crash on my own system (Chrome on Ubuntu)

Re: Vercel April 2026 security incident

#136

Post by tucnak »

zoul wrote: post #103
zuzululu wrote: post #86

What is the rationale for using vercel ? I'm getting a lot of value out of cloudflare with the $5/month plan lately but my bare metal box with triple digit ram has seen zero downtime since 2015.

Very nice developer experience. A lot of batteries included, like CDN, incremental page regeneration, image pipeline or observability. Not having to maintain a server. I’m still planning to move elsewhere though, the vendor lock-in is not worth it and I’d like to keep our infra in the EU.

All of this is available in Cloudflare $5 plan?

Re: Vercel April 2026 security incident

#137

Post by kandros »

zuzululu wrote: post #86

What is the rationale for using vercel ? I'm getting a lot of value out of cloudflare with the $5/month plan lately but my bare metal box with triple digit ram has seen zero downtime since 2015.

For many people Vercel is Easy (not simple)

Knowing how to operate a basic server is perceived as hard and dangerous by many, especially the generation that didn’t have a chance to play with Linux for fun when growing up

Re: Vercel April 2026 security incident

#138

Post by systemvoltage »

senko wrote: post #97
zuzululu wrote: post #86

What is the rationale for using vercel ? I'm getting a lot of value out of cloudflare with the $5/month plan lately but my bare metal box with triple digit ram has seen zero downtime since 2015.

You use a free template that's done in Next.js and uses its Image component, so you need a server. Everything runs fine locally until you try to deploy it, and bam you need 4g ram machine to run the thing. So you host it on Vercel for free cause it's easy! Then you want to check for more than 30 seconds of analytics, and it's pay time.

I am not following the logic. If you’re a hobbyist, sure.

But the argument is if you’re using Vercel for production, you’re paying 5-10x what you’d pay for a VM, with 4gb.

So then what’s the rationale? You can’t be a hobbyist but also “it’s pay time” for production?

Re: Vercel April 2026 security incident

#139

Post by stefan_ »

nikcub wrote: post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

It's so trivial to seed. LLMs are basically the idiots that have fallen for all the SEO slop on Google. Did some travel planning earlier and it was telling me all about extra insurances I need and why my normal insurance doesn't cover X or Y (it does of course).
Post reply on HN