Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vercel April 2026 security incident

bleepingcomputer.com

Post reply on HN
Print view View original

251–260 of 540 posts

Re: Vercel April 2026 security incident

#251

Post by slopinthebag »

arcfour wrote: post #233
bdangubic wrote: post #231

Earlier quoted context omitted.

exactly this, write - not use some sh*t written by some dude from Akron OH 2 years ago”

That's why I wrote my own compiler and coreutils. Can't trust some shit written by GNU developers 30 years ago. And my own kernel. Can't trust some shit written by a Finnish dude 30 years ago. And my own UEFI firmware. Definitely can't trust some shit written by my hardware vendor ever.

Yeah definitely no difference between GNU coreutils and some vibe coded AI tool released last month that wants full oAuth permissions.

Re: Vercel April 2026 security incident

#252

Post by hansmayer »

liveoneggs wrote: post #213
duped wrote: post #195

Earlier quoted context omitted.

I'm suggesting people shouldn't lie to sell things because their customers will believe them and this causes measurable harm to society.

AI does outsource thinking. It is not a lie.

If you don't tend to think much in the first place or have low expectations, then yes

Re: Vercel April 2026 security incident

#253

Post by eddythompson80 »

raw_anon_1111 wrote: post #223

Why does anyone running a third party tool have access to all of their clients’ accounts? I can’t imagine something this stupid happening with a real service provider. I see Vercel is hosted on AWS? Are they hosting every one on a single AWS account with no tenant isolating? Something this dumb could never happen on a real AWS account. Yes I know the internal controls that AWS has (former employee). Anyone who is hos…

Is AWS security boundary the AWS account? Are you expecting Vercel to provision and manage an AWS account per user? That doesn’t make any sense man, though makes sense if you’re a former AWS employee.

Re: Vercel April 2026 security incident

#254

Post by jackconsidine »

tom1337 wrote: post #191
MattIPv4 wrote: post #4

Related: https://news.ycombinator.com/item?id=47824426 https://x.com/theo/status/2045862972342313374 > I have reason to believe this is credible. https://x.com/theo/status/2045870216555499636 > Env vars marked as sensitive are safe. Ones NOT marked as sensitive should be rolled out of precaution https://x.com/theo/status/2045871215705747965 > Everything I know about this hack suggests it could happen to any host http…

> Ones NOT marked as sensitive should be rolled out of precaution if it's not marked as sensitive (because it is not sensitive) there is no reason to roll them. if you must roll a insensitive env var it should've been sensitive in the first place, no?

There's a difference between sensitive, private and public. If public (i.e. NEXT_PUBLIC_) then yeah likely not a reason to roll. Private keys that aren't explicitly sensitive probably are still sensitive. It doesn't seem to be the default to have things "sensitive" and I can't tell if that's a new classification or has always been there.

I can imagine the reason why an env variable would be sensitive, but need to be re-read at some point. But overwhelmingly it makes sense for the default to be set, and never access again (i.e. Fly env values, GCP secret manager etc)

Re: Vercel April 2026 security incident

#255

Post by raw_anon_1111 »

eddythompson80 wrote: post #253
raw_anon_1111 wrote: post #223

Why does anyone running a third party tool have access to all of their clients’ accounts? I can’t imagine something this stupid happening with a real service provider. I see Vercel is hosted on AWS? Are they hosting every one on a single AWS account with no tenant isolating? Something this dumb could never happen on a real AWS account. Yes I know the internal controls that AWS has (former employee). Anyone who is hos…

Is AWS security boundary the AWS account? Are you expecting Vercel to provision and manage an AWS account per user? That doesn’t make any sense man, though makes sense if you’re a former AWS employee.

Yes the security boundary is the AWS account.

It doesn’t make sense for a random employee who mistakenly uses a third party app to compromise all of its users it’s a poor security architecture.

It’s about as insecure as having one Apache Server serving multiple customer’s accounts. No one who is concerned about security should ever use Vercel.

Re: Vercel April 2026 security incident

#256

Post by walthamstow »

themafia wrote: post #152
neal_jones wrote: post #142

Earlier quoted context omitted.

The thing I can’t stop thinking about is that Ai is accelerating convergence to the mean (I may be misusing that) The internet does that but it feels different with this

> convergence to the mean That's a funny way of saying "race to the bottom." > The internet does that but it feels different with this How does "the internet do that?" What force on the internet naturally brings about mediocrity? Or have we confused rapacious and monopolistic corporations with the internet at large?

I'd call it race to the median, converging to mediocrity, or what the kids would call "mid"

Re: Vercel April 2026 security incident

#258

Post by arcfour »

slopinthebag wrote: post #251
arcfour wrote: post #233

Earlier quoted context omitted.

That's why I wrote my own compiler and coreutils. Can't trust some shit written by GNU developers 30 years ago. And my own kernel. Can't trust some shit written by a Finnish dude 30 years ago. And my own UEFI firmware. Definitely can't trust some shit written by my hardware vendor ever.

Yeah definitely no difference between GNU coreutils and some vibe coded AI tool released last month that wants full oAuth permissions.

Embrace the suck.

Re: Vercel April 2026 security incident

#259

Post by 1970-01-01 »

birdsongs wrote: post #78
toddmorey wrote: post #73

I've been part of a response team on a security incident and I really feel for them. However, this initial communication is terrible. Something happened, we won't say what, but it was severe enough to notify law enforcement. What floors me is the only actionable advice is to "review environment variables". What should a customer even do with that advice? Make sure the variable are still there? How would you know if a…

Seriously. Why am I reading about this here and not via an email? I've been a paying customer for over a year now. My online news aggregator informs me before the actual company itself does?

I just deleted my account. Their laid-back notice just is not worth it anymore. I will hold them accountable using my cash. You can get out with me. Let their apologies hit your spam filter. They need to be better prepared to react to the storm of insanity that comes with a breach or they lose my info (lose it twice, I guess..)

Re: Vercel April 2026 security incident

#260

Post by adhamsalama »

nightski wrote: post #126
0xmattf wrote: post #82

Earlier quoted context omitted.

> The only reason to dramatically overpay for the hosting resources they provide is because you expect them to expertly manage security and stability. This and because it's so convenient to click some buttons and have your application running. I've stopped being lazy, though. Moved everything from Render to linode. I was paying render $50+/month. Now I'm paying $3-5. I would never use one of those hosting providers a…

Looking at linode, those prices get you an instance with 1Gb of ram and a mediocre CPU. So you are running all of your applications on that?

For $3.5, Hetzner gives 2 vCPU, 4GB RAM, 40 GB SSD, and 10 TB of bandwidth.
Post reply on HN