YHacker Newsscreenshots

Screenshot of blog.railway.com: Security Disclosure

First screen, captured 4 days ago.

Security Disclosure

More from blog.railway.com →

Railway blog post disclosing that an unauthorized party may have accessed and decrypted customer environment variables, urging users to rotate all secrets.

What HN thinks

Rotate your keys, they said. Then you can't deploy them, they also said, eventually.

Rotate-then-can't-deploy is maddening
Many customers rotated keys as advised, then found deploys paused, so their services broke; they say Railway should have led with that consequence.
Disclosure came far too late
Commenters reject Railway's 'aviate, navigate, communicate' explanation, arguing breaches must be disclosed immediately to everyone possibly affected, with updates later.
AI-driven breach wave is here
Alongside PHP RCE, eMudhra, GitLab and PingCAP incidents, many expect constant AI-accelerated exploits, with debate over on-prem, static HTML and fewer dependencies.

Consensus: Most agree Railway's communication was poor and that leaked keys (especially LLM API keys, which attackers actively abused) are worse than downtime; several are migrating away.

Recommended in the comments

Google Cloud Run (service): Called rock solid and used as a migration target off Railway.
Fly.io (service): One commenter did an emergency migration there with minimal disruption.
systemd credentials ↗ (tool): Suggested as an easier way to avoid storing secrets in env vars.
spiped ↗ (tool): Suggested for securely linking servers when direct cabling isn't possible.
Pigsty (tool): Recommended as UI/tooling for a simple single big Postgres host setup.

Summarised by Claude from the comment thread 3 days ago.

Points: 571
Comments: 334
Best rank: #1
Posted: 2026-10-21 by passenger
Category: Security

railway security-breach environment-variables secrets-management paas incident-disclosure

All captures:

Full page

Full-page screenshot of blog.railway.com

Captured 4 days ago. Click for the whole screenshot.

Looks similar

Screenshot of discourse.nixos.org: The Nixpkgs core team has disbanded

The Nixpkgs core team has disbanded (discourse.nixos.org)

358 points by Meleagris 2 months ago | 182 comments

NixOS Discourse announcement that the Nixpkgs core team has disbanded, reviewing its achievements and citing unsustainability and maintainer health.

nixpkgs nixos open-source-governance nix

Screenshot of orchidfiles.com: What does GitHub's security team even do?

What does GitHub's security team even do?(orchidfiles.com)

74 points by theorchid 3 months ago | 19 comments

Screenshot of Hacker News post: Launch HN: Corgea (YC S23) – Auto fix vulnerable code

Launch HN: Corgea (YC S23) – Auto fix vulnerable code

30 points by asadeddin 2 years ago | 42 comments

Screenshot of Hacker News post: Ask HN: Startup getting spammed with PayPal disputes, what should we do?

Ask HN: Startup getting spammed with PayPal disputes, what should we do?

209 points by june3739 1 year ago | 149 comments

Screenshot of Hacker News post: Launch HN: Escape (YC W23) – Discover and secure all your APIs

Launch HN: Escape (YC W23) – Discover and secure all your APIs

88 points by glimow 2 years ago | 30 comments

Screenshot of usmannkhan.com: Sei pays out $2M bug bounty

Sei pays out $2M bug bounty (usmannkhan.com)

197 points by sygma 2 years ago | 94 comments

Related stories

Screenshot of adguard-dns.io: Our investigation into the suspicious pressure on Archive.today

Our investigation into the suspicious pressure on Archive.today (adguard-dns.io)

1714 points by immibis 11 months ago | 426 comments

AdGuard DNS blog post investigating suspicious complaints and bailiff demands pressuring it to block Archive.today amid an FBI subpoena of the site's registrar.

archive-today adguard-dns censorship dns-blocking

Screenshot of dreamstation.systems: I'm being cyberattacked by Tesla, Inc

I'm being cyberattacked by Tesla, Inc (dreamstation.systems)

389 points by robinpie 1 month ago | 109 comments

Personal blog post describing persistent attack traffic in nginx logs from IPs with Host/Referer headers pointing to pool-ntp.tesla.com.

tesla nginx server-logs scanner-traffic

Screenshot of blog.tripu.info: Encrypting private data and private communications is now an ethical duty

Encrypting private data and private communications is now an ethical duty (blog.tripu.info)

416 points by gasull 3 years ago | 200 comments

A personal blog essay arguing that end-to-end encrypting private data and communications has become an ethical duty, using a glass-walls analogy.

end-to-end-encryption privacy surveillance encryption

Screenshot of blog.cryptographyengineering.com: Going Dark, and the era of law enforcement hacking

Going Dark, and the era of law enforcement hacking (blog.cryptographyengineering.com)

438 points by vslira 2 months ago | 232 comments

Matthew Green blog post reflecting on Usenix Security and how AI may affect encryption, the 'going dark' debate, and law enforcement hacking.

going-dark encryption law-enforcement-hacking usenix-security

Screenshot of rosalux.de: Britain's railway privatization was an abject failure

Britain's railway privatization was an abject failure (rosalux.de)

419 points by robtherobber 11 months ago | 368 comments

Rosa Luxemburg Stiftung essay arguing that Britain's 1990s railway privatization failed, as the railways now return to public ownership.

railway-privatization uk-railways nationalization public-infrastructure

Screenshot of theocharis.dev: Kidnapped by Deutsche Bahn

Kidnapped by Deutsche Bahn (theocharis.dev)

1122 points by JeremyTheo 10 months ago | 978 comments

Personal blog post by Jeremy Theocharis recounting a Deutsche Bahn train journey gone wrong, which he likens to being kidnapped, and the 1.50 EUR compensation he received.

deutsche-bahn germany rail-travel public-transport