How these Paas (Railway before) are being breached? Poor choices or something else? Scary Nonetheless. I thought AI advancement will make the self hosting painful. If PaaS are no good, then what can be done?

▲

corford 6 hours ago | parent | next [-]

Stuff made during the move fast and break things era now doesn't hold up very well in the AI era. Or to say another way: startups are very vulnerable now - this new environment is unforgiving towards cutting corners and/or having inexperienced devs

▲

SoftTalker 5 hours ago | parent | next [-]

I think the ultimate fallout will be that software "engineers" will finally have to become "engineers" in the real sense, i.e. professionally licensed and personally responsible for the designs they approve and the software they build, whether the actual code is produced by LLMs or humans.

As costs and broader economic impact and perhaps even injuries/deaths related to software breaches continue to grow, there will be growing intolerace for vulnerable software, just as there was intolerance for collapsing bridges and buildings.

And I'd also at some point expect something like a "building code" that applies to software that will be exposed to the public.

	▲	tortasaur 3 hours ago \| parent [-]
		If anything, I see us moving even further away from professional licensing. The field's rate of change was the main reason behind a lack of any professional body, and that's only accelerating. I expect compliance audits like SOC2 to actually get teeth, though, and for organizations to be expected to actually fix issues instead of the usual security theater.

▲

seanw444 6 hours ago | parent | prev [-]

Nope. The solution is to move even faster and thus break less things via AI.

▲

bongofizzbuzz 6 hours ago | parent | next [-]

The "move faster and break things" have been unbundled. SaaS moves faster. Hackers break things.

▲

corford 6 hours ago | parent | prev | next [-]

For new stuff, maybe. I'm talking about existing startups now absorbing the onslaught of AI.

	▲	seanw444 6 hours ago \| parent [-]
		I was just being sarcastic.

▲

this_user 5 hours ago | parent | prev [-]

If you move fast enough, they can't find the vulnerabilities in your system before you deploy the next version.

▲

btown 7 hours ago | parent | prev | next [-]

Modern PaaS is tough because there's a general expectation that users (and agents) are able to see and read back environment variables in their management UI or CLI - which means that you can't segregate credential values from the public web environment. See e.g. the visibility icons on https://northflank.com/docs/v1/application/secure/inject-sec...

And sure, you can encrypt at rest, and perhaps even enforce that only re-encrypted versions are ever seen by the management/API web server. But fundamentally this display requirement means that if your management/API web server is compromised, users' secrets can be obtained by a process of impersonation.

▲

trouve_search 8 hours ago | parent | prev | next [-]

Why would ai advancement make self hosting painful? Apart from increased cost of hardware (which you implicitly would pay for in PaaS as well anyways).

If anything, AI makes running linux boxes much easier than 4 years ago; it's now faster and the learning cliff is gone to get the correct CLI commands and digging into system logs.

▲

roncesvalles 7 minutes ago | parent | next [-]

I had this exact thought yesterday. Shouldn't AI obliterate PaaS platforms like this one since it's super easy to build a bespoke CI/CD process now? Since it's bespoke, you can lock it down as much as you want. Attackers don't even know it's there. It's time to go back to `deploy.sh` and a VPS.

▲

whimsicalism 7 hours ago | parent | prev | next [-]

platforms are better placed to guard against attackers

▲

pluralmonad 7 hours ago | parent [-]

Certainly. They are also larger targets.

	▲	whimsicalism 7 hours ago \| parent [-]
		to me, this is a variant of security by obscurity and will not fare well in the LLM age

▲

monster_truck 7 hours ago | parent | prev [-]

if you're still doing that manually in 2026 you probably should not be self hosting anything of consequence or commercial liability

	▲	dns_snek 7 hours ago \| parent [-]
		What's "that"? Running your own hardware, using a CLI to manage servers, or touching anything below your application layer?

▲

ascorbic 5 hours ago | parent | prev | next [-]

They're high-value targets, so that's what attackers are pointing the agents at

▲

reducesuffering 6 hours ago | parent | prev | next [-]

According to HN of the last year, "marketing stunts." Remember when Mythos preview was announced only 6 months ago

▲

vorpalhex 8 hours ago | parent | prev [-]

When you build something small, you can easily see all the doors and properly guard them.

As you build something bigger and bigger, quickly, with several people building, guarding all the doors becomes exceptionally difficult without a kind of aggressive discipline which is contrary to the "go fast" culture.

Cybersecurity in practice until now, for most companies, has been an insurance problem, not a quality problem.

Such companies are quickly discovering that insurance is a post-hoc partial correction and not a proper solution.

This situation will not improve anytime soon for most companies.

The solution does not require any new magical tools.