As someone who has helped to secure critical national infrastructure several years ago, I can say that it was a mess to disclose the vulnerabilities I identified, and in some cases it took years to patch them. Some of these vulnerabilities were RCEs and mass PII leaks. It's simply not worth the risk for most people - who aren't in the USA - to bother doing this sort of security research. However, if you are in the USA, there are provisions in the CFAA that enable good-faith security research to take place (https://www.justice.gov/archives/opa/pr/department-justice-a...), so to the best of my understanding, you're able to do good-faith research without being charged or prosecuted, and you should take advantage of this if you have the skills or models to do so. I am not based in the USA, and there are no laws in my country that guarantee me zero jail time for simply trying to do the right thing, so I am not incentivized to continue finding vulnerabilities in my country's infrastructure.

Edit: If other countries don't catch up and include similar provisions in their laws, they'll simply fall behind and put their citizens at risk. I'm sure every country has individuals willing to help that currently feel unsafe - look at the large amount of bug bounty hunters worldwide who, I'm sure, wouldn't mind practicing their skills by securing their country's infrastructure.

> I'd feel a lot better if I knew some red team security researchers were going hard trying to break into critical national infrastructure

Decades ago, I met someone at a conference who was red-teaming a NATO country's infrastructure: power plants, water treatment etc.

Said that things had improved dramatically since 1990s nethack days.

But the team had a secret weapon: a young woman in a short skirt with a laptop computer, pretending to be a systems software vendor. The Weapon had been able to compromise every site, had never failed. Never.

> I'd feel a lot better if I knew some red team security researchers were going hard trying to break into critical national infrastructure

They are. Most critical infrastructure providers worldwide have in house or contract red teams. Every western government has an agency dedicated to cyber defense and they all have red team programs.

It is absolutely happening, paid by your taxpayer dollars (if you’re American).

Most major countries have this kind of programs. Those could probably be bigger and they will always miss obvious stuff but they exist, at least for CNI.

I'm sure this is happening but I also wonder if ironically those systems are hardened by adversaries. I could imagine nation state actors, once they're in, hardening the systems themselves so they can keep their presence and exclude others.

Using that access is the kind of thing that is only done when there's a need and in the case of really critical stuff that can be years in the future - or never.

One could even imagine hyper-critical exploits being shared back to the host. For instance if Russian agents got access to critical nuclear systems (or vice versa), I could imagine leadership warning the other side and getting out of the system entirely in order to maintain the status quo at the expense of pretenders.

IMHO our best hope is some benevolent grey hat or government organization unleashes a well-aligned AI botnet to patch everything it can find before the black hats do.

imagine if we just turned off 90% of the non-critical internet for two weeks, hardened up in an absolute mad dash where everyone has access to top tier cyber models, and then afterwards we go back to business as usual. it’d be a disaster short-term but long-term would it be worse than the years of slow drip we’re about to go through? idk! I kinda think it’d be interesting to find out!

Regular people are often bad guys too, you know. If the reality was "bad guys will have it. Should regular people too?" The entire core dilemma would be entirely eliminated lol.

AI is actually a big reason why there are so many vulnerabilities over the past year and a half. People don't even know what their code bases look like anymore. It's really bad so sayeth my friends doing consulting.

A lot of companies cyber security posture is asking Claude to "find all security issues make no mistakes".

Don't worry - Siri is on it - that's actually why they've been so lacklustre. Just too busy hacking for the good guys

Yep, absolutely no feelings for that cancer of a website.

Can we, like, also have a pinterest breach plz?

And you have to subscribe to view it, download maybe is a paid feature

The email received is a rehash of the linked article, nice find.

>Why not tell all customers at once, especially if payment information was involved?

Answered in the article!

“Q: Am I affected? How will I be notified?

A: We are sending notices to affected individuals in phases, so not everyone has received theirs yet“

And also..

"Q: Where can I find the latest updates?

A: The latest updates regarding the incident will be made available on this page.“

..."Updated October 01, 2026 19:29"

For a site where you find data, they are completely devoid of any useful data on their own incident and redirecting everyone to phone calls where data cannot easily be shared.

> This particular set of beached data could stop existing if, instead of reusing a set of fixed data for payments, your bank allowed you to generate a unique code that sent a one-time (or recurring, locked to a single vendor) payment to the recipient.

Also known as virtual cards, discussed here [0]. At the moment, the onus is up to the cardholder and availability of the service from banks. It should be requested if your bank doesn't provide it.

0 https://news.ycombinator.com/item?id=50313747

This. Scribd has absolutely no goodwill here. Can't say I feel sorry for them in the slightest.

The victims, absolutely. However; the organization not one damn iota. Perhaps if they sucked less, but they do not, so I do not.

Whole business model is literally based off of reselling access to other people's content. No value add. Just grift.

It's a pdf archive; their idea is to scrape pdf that are public, then charge you to download when they are no longer public.

My understanding is that companies tend do disclose the bare minimum they are required by law, and keep everything else to themselves.

Indeed. :(

Yeah, in my view this is one of those sites that add negative value to the internet, by putting a paywall in front of PDFs that would otherwise be freely available. I have seen tech-illiterate people upload material there (and to its sister site slideshare) just because they didn't know better (I suppose it's what they got by Googling "upload PDF to the interwebs" or similar), and it's a pity.

Uploaders don't even get paid at all for views, it's just taking free labor and paywalling access to it, very similar to the infamous paid academic journals. But journals survive because they are an entrenched system that lives on prestige and hard-to-change academic bureaucracy. I really don't understand how Scribd, being an obvious scam and without those legacy advantages, can survive. I suppose hosting PDFs costs so little that a 0.001% of victims paying is enough to support it, but still, I don't understand why a free competitor hasn't come up to outrank it in searches and send it to oblivion where it belongs.

> I just ignore it in my searches and just find the pdf elsewhere.

In retrospect, this was the correct way to proceed.

The docs I found were content, but nothing that could be used for its original purpose. Splurging a monthly subscription to find out sucked, but being breached and getting my info stolen is a kick in the ass.

No one has ever been safe. I would rephrase it as: "More and more people are becoming aware of their exposure".

Yes, but I think it also just shows the widespread ignorance and incompetence in many companies.

I'm not saying everything can be secured easily, but a lot of those leaks recently could have been prevented easily.

Hide yo apps, hide yo websites, hide yo hosts

> I don't see any email like this in my inbox.

They stated that they're doing a staggered rollout for email notifications which states at the beginning of October with other users reporting receiving the email yesterday[0].

0 https://news.ycombinator.com/item?id=50313006

> We detected that an unauthorized third party may have gained access to certain user data in one of our systems. After investigating this activity, we found that the third party may have accessed your email address and the following of your information: last 4 digits of your credit card and country, credit card issuer, credit card expiry date.

This is a common sentiment, but the security story isn’t so clear cut as that. Encrypted at rest really just means that if you yank the disk out of the server, an adversary can’t read it. But if it’s a system that is online serving a database and you gain access to the application reading from the database, encryption at rest doesn’t save you. It’s obvious the application server must be able to read the decrypted data. If an adversary breaches the application, they get the data.

>How do we even know which credit card is affected by this if we want to cancel it?

"If you have additional questions, contact the dedicated call center at +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m. Central European Time."

Maybe the Cursor IDE compromise? It might be what got Binance. And it made a lot devs machines backdoored between Wednesday 28th Oct and whenever people decide to remove the backdoor from their machines.

The exploit is called AI (or LLMs)

I guess this is the new normal.

As far as I know this is a relic from the PG days. It was done to keep the focus on URL based submissions, and avoid people using the platform as a text/blogging platform (at the time, Reddit was rising, and self posts there were already very common.) URLs were dark, text was meant to support the URL and was lighter.

I think the color actually got lightened a few times.

(@dang doesn't work - but someone emailed this to hn@ycombinator.com)

It's nothing so sophisticated - I've just been reluctant to change things for a bunch of reasons, some perhaps better than others.

I still have the idea of letting users upload their own preferred CSS to make HN look how they prefer. Perhaps little projects like this will become more feasible as AI tools are flattening the development curve. Is this something people would consider helpful?

Was the text light grey before you clicked the comments? Typically the link turns from almost black to light grey after you visit the site, just like a normal link will turn from blue to purple after you click the link to indicate you have visited the site. In this post for example the link goes to the 'Tell HN:' so the link goes directly to the comments. Could it be you did not pay attention until you had visited the comments once already??

It’s way, way too low contrast.

Edit: “@dang” apparently doesn’t ‘work’, but emailed this to hn@ycombinator.com

I always assumed it was the down arrow affecting it, but I have always giggled at the fact that people with sharp eyes have to endure the bad posts while others do not