Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Roblox cheat and one AI tool brought down Vercel's platform

webmatrices.com

Post reply on HN
Print view View original

71–80 of 186 posts

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#71

Post by CodesInChaos »

rcxdude wrote: post #58
kstrauser wrote: post #16

I think this is wrong about what “sensitive” means here. AFAIK, all Vercel env cars are encrypted. The sensitive checkbox means that a develop looking at the env var can’t see what value is stored there. It’s a write-only value. Only the app can see it, via an env var (which obviously can’t be encrypted in such a way that the app can’t see it, otherwise it’d be worthless). If you don’t check that box, you can view th…

You always get people screaming about 'it should have been encrypted!' when there's a leak without understanding what encryption can and can't do in principle and in practice (it most certainly isn't a synonym for 'secure' or 'safe').

Encryption turns your data confidentiality problem into a key management problem.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#72

Post by QuantumNomad_ »

TheDong wrote: post #27
magackame wrote: post #26

Earlier quoted context omitted.

It seems only encrypt and throw away the key would be the acceptable strategy

They need to give your app the environment variables later so they cannot throw away the key. For non-sensitive environment variables, they also show you the value in the dashboard so you can check and edit them later. Things like 'NODE_ENV=production' vs 'NODE_ENV=development' is probably something the user wants to see, so that's another argument for letting the backend decrypt and display those values even ignorin…

> You're welcome to add an input that goes straight to '/dev/null' if you want, but it's not exactly a useful feature.

Piping to /dev/null is of course pointless.

What you really want is the /dev/null as a Service Enterprise plan for $500/month with its High Availability devnull Cluster ;)

https://devnull-as-a-service.com/pricing/

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#73

Post by dnnddidiej »

kstrauser wrote: post #16

I think this is wrong about what “sensitive” means here. AFAIK, all Vercel env cars are encrypted. The sensitive checkbox means that a develop looking at the env var can’t see what value is stored there. It’s a write-only value. Only the app can see it, via an env var (which obviously can’t be encrypted in such a way that the app can’t see it, otherwise it’d be worthless). If you don’t check that box, you can view th…

Where I work we started using Vault and you store the vault key (as in looup key) in as a regular non-hidden env var. I think this is probably more solid.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#74

Post by nextaccountic »

kstrauser wrote: post #16

I think this is wrong about what “sensitive” means here. AFAIK, all Vercel env cars are encrypted. The sensitive checkbox means that a develop looking at the env var can’t see what value is stored there. It’s a write-only value. Only the app can see it, via an env var (which obviously can’t be encrypted in such a way that the app can’t see it, otherwise it’d be worthless). If you don’t check that box, you can view th…

> Only the app can see it, via an env var (which obviously can’t be encrypted in such a way that the app can’t see it, otherwise it’d be worthless)

Yeah, I'm very confused. It's not possible to encrypt env vars that the program needs; even if it's encrypted at rest, it needs to be decrypted anyway before starting the program. Env vars are injected as plain text. This is just how this works, nothing to do with Vercel.

This situation could some day improve with fully homomorphic encryption (so the server operates with encrypted data without ever decrypting it), but that would have very high overhead for the entire program. It's not realistic (yet)

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#75

Post by dnnddidiej »

CodesInChaos wrote: post #71
rcxdude wrote: post #58

Earlier quoted context omitted.

You always get people screaming about 'it should have been encrypted!' when there's a leak without understanding what encryption can and can't do in principle and in practice (it most certainly isn't a synonym for 'secure' or 'safe').

Encryption turns your data confidentiality problem into a key management problem.

Also if you want to keep a secret a secret forever, encrypted but saved data may be easily decrypted in the future. Most secrets though in reality are less useful in X years time.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#76

Post by lemagedurage »

dnnddidiej wrote: post #75
CodesInChaos wrote: post #71

Earlier quoted context omitted.

Encryption turns your data confidentiality problem into a key management problem.

Also if you want to keep a secret a secret forever, encrypted but saved data may be easily decrypted in the future. Most secrets though in reality are less useful in X years time.

Theoretically maybe, but there's no indication that a quantum-resistant algorithm can't encrypt something that's secure for the coming million+ years.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#77

Post by Topfi »

Odd, they used Delve [0] and a SOC2 compliant company like Context.ai [1] should have an AUP, EDR, etc. that prevents their employees from installing a Roblox cheat on their work computer. Heck, even outside SOC2, I have never worked at a company without endpoint restrictions to prevent unauthorised installs.

It's almost like the denials were in fact false and Delve truly was just selling a sticker, not providing an actual service.

If I were a VC that had funded Delve for a considerable amount of time, I'd be embarrassed that we did not catch that. I'd probably rework my processes, publicly analyse how this alleged fraud got past me and go far and beyond in disclosing my findings to rebuild trust. I'd most certainly not think just cutting funding is sufficient given the situation. Even more so if I'd encouraged other companies funded by me to use their "services". I'd maybe even reevaluate whether a circular approach wherein our funded companies are incentivised to rely on other also by us funded companies leads to the best options being chosen and whether that isn't antithetical to a forward thinking environment and competition. At the same time, I'd also think that maybe such a setup just hides unsuccessful companies and potentially even alleged fraud which once it gets to the broader market, may cause significant harm...

[0] https://web.archive.org/web/20250918025724/https://trust.del...

[1] https://web.archive.org/web/20260217220817/https://www.conte...

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#78

Post by baxtr »

sitkack wrote: post #67
ErroneousBosh wrote: post #63

Earlier quoted context omitted.

Right? This isn't "A Roblox cheat and an AI tool", this is a failure of basic basic basic opsec across two organisations. One for which the Context.ai employee needs to have their arse booted up and down the car park for.

What about the context.ai security team? You can blame individuals, but security is a property of the system.

It’s a very fine line. How do you check if people adhere to policies and at the same time don’t monitor them permanently?

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#79

Post by wongarsu »

gmerc wrote: post #65
darkwater wrote: post #49

I don't want to do the easy finger-pointing and scapegoating but honestly, what should happen to the Context.ai employee that thought it was a good idea to play games in their work machine and, on top of that, install cheats which are by definition of dubious provenance? I know defense in depth, security layers etc etc but there is also some personal responsibility at play here. We can chalk up the Vercel's employee…

Let’s just say that OpSec at companies adopting AI is low across the board because security just isn’t a deciding feature at the moment. See McDonalds breach 2 years ago

As somebody who tried selling cybersecurity software: Cyber-related OpSec is bad in most companies, AI or not. If effort and budget is allocated to it at all it's usually to a box-checking exercise that is about optics, liability and staying eligible for insurance payouts

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#80

Post by lemagedurage »

apgwoz wrote: post #4
jesse_dot_id wrote: post #3

> How many developers do you think knew that checkbox existed? How many assumed their database credentials and API keys were encrypted by default? If I don't see asterisks, I'm not hitting save on the field with a secret in it. Maybe they were setting them programmatically? They should definitely still be looking to pass some kind of a secret flag, though. This is a weird problem for a company like Vercel to have.

You pretty much have to assume someone is going to put sensitive data in an input like this. Encryption by default is the only sensible choice.

But the encrypted API key doesn't work, it needs to be decrypted first. Let's give the server access to the private key so it can decrypt the API key. We can do this by putting the private key in an env var. But now the private key is unencrypted. Ah, it doesn't work.
Post reply on HN