Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vercel April 2026 security incident

bleepingcomputer.com

Post reply on HN
Print view View original

341–350 of 540 posts

Re: Vercel April 2026 security incident

#341

Post by pianopatrick »

lijok wrote: post #221
slopinthebag wrote: post #218

Earlier quoted context omitted.

Idk exactly how to articulate my thoughts here, perhaps someone can chime in and help. This feels like a natural consequence of the direction web development has been going for the last decade, where it's normalised to wire up many third party solutions together rather than building from more stable foundations. So many moving parts, so many potential points of failure, and as this incident has shown, you are only as…

This isn't a web development concept. It's the unix philosophy of "write programs that do one thing and do it well" and interconnect them, being taken to the extremes that were never intended. We need a different hosting model.

Just throwing it out there - the Unix way to write software is often revered. But ideas about how to write software that came from the 1970s at Bell Labs might not be the best ideas for writing software for the modern web.

Instead of "programs that do one thing and do it well", "write programs which are designed to be used together" and "write programs to handle text streams", I might go with a foundational philosophy like "write programs that are do not trust the user or the admin" because in applications connected to the internet, both groups often make mistakes or are malicious. Also something like "write programs that are strict on which inputs they accept" because a lot of input is malicious.

Re: Vercel April 2026 security incident

#342

Post by cyral »

Aurornis wrote: post #189
operatingthetan wrote: post #125

Earlier quoted context omitted.

It's interesting how many of the low-effort vibecoded projects I see posted on reddit are on vercel. It's basically the default.

Reddit vibecoded LLM posts are kind of fascinating for how homogenous they are. The number of vibe coded half-finished projects posted to common subreddits daily is crazy high. It’s interesting how they all use LLMs to write their Reddit posts, too. Some of them could have drawn in some people if they took 5 minutes to type an announcement post in their own words, but they all have the same LLM style announcement pos…

It's insane how most of the dev subreddits are filled with slop like this. I've thought the same thing - why can't they even spend 5 minutes to write their own post about their project?

Re: Vercel April 2026 security incident

#343

Post by huflungdung »

gk1 wrote: post #335
cowsup wrote: post #304

Earlier quoted context omitted.

> Still no email blast from Vercel alerting users, which is concerning. On the one hand, I get that it's a Sunday, and the CEO can't just write a mass email without approval from legal or other comms teams. But on the other hand... It's Sunday. Unless you're tuned-in to social media over the weekend, your main provider could be undergoing a meltdown while you are completely unaware. Many higher-up folks check company…

> On the one hand, I get that it's a Sunday, and the CEO can't just write a mass email without approval from legal or other comms teams This is not how things work. In a crisis like this there is a war room with all stakeholders present. Doesn’t matter if it’s Sunday or 3am or Christmas. And for this company specifically, Guillermo is not one to defer to comms or legal.

[dead]

Re: Vercel April 2026 security incident

#344

Post by fragmede »

esseph wrote: post #290
lijok wrote: post #221

Earlier quoted context omitted.

This isn't a web development concept. It's the unix philosophy of "write programs that do one thing and do it well" and interconnect them, being taken to the extremes that were never intended. We need a different hosting model.

> We need a different hosting model. There really isn't an option here, IMO. 1. Somebody does it 2. You do it Much happier doing it myself tbh.

There's a lot of wiggle room on how you define "it". At the ends of the spectrum it's obvious, but in the middle it gets a bit sticky.

Re: Vercel April 2026 security incident

#345

Post by jofzar »

gib444 wrote: post #217
OsrsNeedsf2P wrote: post #3

The lack of details makes me wonder how large this "subset" of users really is

I remember working support and being told "always say 'subset' unless you absolutely know it's exactly 100% of customers" lol

Same, there was always very specific wording we had to use unless legal approved an exact number or scope.

Re: Vercel April 2026 security incident

#347

Post by eddythompson80 »

raw_anon_1111 wrote: post #255
eddythompson80 wrote: post #253

Earlier quoted context omitted.

Is AWS security boundary the AWS account? Are you expecting Vercel to provision and manage an AWS account per user? That doesn’t make any sense man, though makes sense if you’re a former AWS employee.

Yes the security boundary is the AWS account. It doesn’t make sense for a random employee who mistakenly uses a third party app to compromise all of its users it’s a poor security architecture. It’s about as insecure as having one Apache Server serving multiple customer’s accounts. No one who is concerned about security should ever use Vercel.

> It’s about as insecure as having one Apache Server serving multiple customer’s accounts.

You really have no clue what you’re talking about don’t you? Were you a sales guy at AWS or something?

Re: Vercel April 2026 security incident

#348

Post by eclipticplane »

jtreminio wrote: post #8

I'm on a macbook pro, Google Chrome 147.0.7727.56. Clicking the Vercel logo at the top left of the page hard crashes my Chrome app. Like, immediate crash. What an interesting bug.

Same thing here, 147.0.7727.101, M3 Macbook Air. Immediate crash of all open profile windows, so not even a tab-level crash.

Re: Vercel April 2026 security incident

#349

Post by eddythompson80 »

arcfour wrote: post #280
eddythompson80 wrote: post #263

Earlier quoted context omitted.

I’m not joking, but weirdly enough, that’s what most AI arguments boil down to. Show me what the difference is while I pull up the endless CVE list of which ever coreutils package you had in mind. It’s a frustrating argument because you know that authors of coreutils-like packages had intentionality in their work, while an LLM has no such thing. Yet at the end, security vulnerabilities are abundant in both. The AI ma…

I wouldn't describe myself as an AI maximalist at all. I just don't believe the false dichotomy of you either produce "vulnerable vibe coded AI slop running on a managed service" or "pure handcrafted code running on a self hosted service." You can write good and bad code with and without AI, on a managed service, self-hosted, or something in between. And the comment I was replying to said something about not trusting…

I used to believe that too, yet the dichotomy is what’s being pushed by what I called an “AI maximalist” and it’s what I was pushing against.

There is no “I wrote this code with some AI assistance” when you’re sending 2k line change PR after 8 minutes of me giving you permission on the repo. That’s the type of shit I’m dealing with and management is ecstatic at the pace and progress and the person just looks at you and say “anything in particular that’s wrong or needs changing? I’m just asking for a review and feedback”

Re: Vercel April 2026 security incident

#350

Post by raw_anon_1111 »

eddythompson80 wrote: post #347
raw_anon_1111 wrote: post #255

Earlier quoted context omitted.

Yes the security boundary is the AWS account. It doesn’t make sense for a random employee who mistakenly uses a third party app to compromise all of its users it’s a poor security architecture. It’s about as insecure as having one Apache Server serving multiple customer’s accounts. No one who is concerned about security should ever use Vercel.

> It’s about as insecure as having one Apache Server serving multiple customer’s accounts. You really have no clue what you’re talking about don’t you? Were you a sales guy at AWS or something?

Well, I know that you have never heard of someone using a third party SaaS product at any major cloud provider compromising all of their customers accounts.

Are you really defending Vercel as a hosting platform that anyone should take seriously?

Post reply on HN