YHK - yet another hacker news clone

Northflank Breached

71 points js4ever 1 hour ago 34 comments

hmokiguess 1 hour ago | parent

What is Northflank? I am surprised at the amount of new business out there

paxy 1 hour ago | parent

You are on a YC startup forum and are surprised tech startups exist?

jmull 58 minutes ago | parent

"amount" it says. No matter the context, there could be more than you expect.

gorgmah 58 minutes ago | parent

I ran some stats on producthunt a few months ago, there are 22 times more daily SaaS launches now than in 2020, the AI impact on the industry is hard to fathom. The blog I wrote (AI-assisted) if you're curious: https://www.mahl.me/blog/product-hunt-is-swamped-now/

quadrature 56 minutes ago | parent

Northflank isn't that new, it was founded in 2019. Its a cloud platform, you can get more details by googling.

jacquesm 54 minutes ago | parent

New businesses, not new business.

dangoodmanUT 53 minutes ago | parent

Unfortunately for infra startups, I think we're going to see a convergence back to hyperscalers as a result of incidents like this and railway.

There's no amount of "nicer to use" that can replace security, at least certainly when selling to enterprises

bix6 45 minutes ago | parent

Are hyperscalers actually more secure though? I have only heard anecdotal thinking eg nobody ever got fired for choosing IBM.

baxtr 41 minutes ago | parent

It’s the same thing: let’s say Microsoft or AWS got hacked. Then you’re definitely not the only one who got hacked.

So, you can always say: Look, it’s not us (especially not my org!). It f’ing Microsoft/AWS. Everyone got hacked.

You and your career are gonna be fine.

codegeek 29 minutes ago | parent

The whole "No one gets fired for using IBM" analogy.

inglor 41 minutes ago | parent

When I was at Microsoft we took security cripplingly seriously to the point we could not deliver features and our competitors could because the security process was convoluted and had multiple reviews and approval steps.

loloquwowndueo 38 minutes ago | parent

Tell me you weren’t on the Windows team without telling me you weren’t on the windows team :)

Veserv 22 minutes ago | parent

Having crippling bureaucracy does not correlate with good security outcomes, except maybe negatively. However, having a history of unending egregious security failures, like Microsoft, does correlate with poor security outcomes. For that matter, having a present of unending egregious security failures also correlates with poor security outcomes.

Let us look on the front page and see if there are any, oh look here is one: https://www.binarysecurity.no/posts/2026/10/one-root-case

whimsicalism 19 minutes ago | parent

the only reason you’re seeing this post is because of the large bug bounty program that actors like Northflank don’t even operate

jareklupinski 29 minutes ago | parent

> nobody ever got fired

thats the crux; are you working for the paycheck, or for the truth?

could be both, but pretty much all "i was right" stories start with "everyone else said i was wrong"

mac3n 5 minutes ago | parent

> There's no amount of "nicer to use" that can replace security, at least certainly when selling to enterprises

Azure would beg to differ.

https://news.ycombinator.com/item?id=50301854

FLeXMurphy 4 minutes ago | parent

A moron could build a better UX and DevX.

carimura 53 minutes ago | parent

i'm surprised at the growth of all these neoclouds given the current security risk climate...

ankit70 48 minutes ago | parent

How these Paas (Railway before) are being breached? Poor choices or something else? Scary Nonetheless. I thought AI advancement will make the self hosting painful. If PaaS are no good, then what can be done?

trouve_search 45 minutes ago | parent

Why would ai advancement make self hosting painful? Apart from increased cost of hardware (which you implicitly would pay for in PaaS as well anyways).

If anything, AI makes running linux boxes much easier than 4 years ago; it's now faster and the learning cliff is gone to get the correct CLI commands and digging into system logs.

monster_truck 38 minutes ago | parent

if you're still doing that manually in 2026 you probably should not be self hosting anything of consequence or commercial liability

dns_snek 13 minutes ago | parent

What's "that"? Running your own hardware, using a CLI to manage servers, or touching anything below your application layer?

whimsicalism 17 minutes ago | parent

platforms are better placed to guard against attackers

vorpalhex 43 minutes ago | parent

When you build something small, you can easily see all the doors and properly guard them.

As you build something bigger and bigger, quickly, with several people building, guarding all the doors becomes exceptionally difficult without a kind of aggressive discipline which is contrary to the "go fast" culture.

Cybersecurity in practice until now, for most companies, has been an insurance problem, not a quality problem.

Such companies are quickly discovering that insurance is a post-hoc partial correction and not a proper solution.

This situation will not improve anytime soon for most companies.

The solution does not require any new magical tools.

btown 26 minutes ago | parent

Modern PaaS is tough because there's a general expectation that users (and agents) are able to see and read back environment variables in their management UI or CLI - which means that you can't segregate credential values from the public web environment. See e.g. the visibility icons on https://northflank.com/docs/v1/application/secure/inject-sec...

And sure, you can encrypt at rest, and perhaps even enforce that only re-encrypted versions are ever seen by the management/API web server. But fundamentally this display requirement means that if your management/API web server is compromised, users' secrets can be obtained by a process of impersonation.

gavxn 44 minutes ago | parent

Does anyone know to what degree Sentry use Northflank?

loloquwowndueo 35 minutes ago | parent

Whatcha mean. If they do, it would likely be in Sentry’s list of subprocessors. Check there.

skinfaxi 14 minutes ago | parent

Sentry is listed on the northflank site as a customer.

gavxn 9 minutes ago | parent

They've updated their website to remove their customers

gavxn 9 minutes ago | parent

Good point. I don't see Northflank listed, https://sentry.io/legal/subprocessors/.

If I go on wayback a few days, I can see Sentry: https://web.archive.org/web/20261026032756/https://northflan...

sergiotapia 4 minutes ago | parent

So sad...

Unfortunately I'm not longer using PaaS tools. Instead I use Azure for work and vps now for all my personal stuff. With AI it's easier than ever to lock a server down tight and mitigate this kind of exposure.