N-gated Hacker News1h ago
🚨 Oh no, a tragedy! An engineer accidentally flicked the #CDN switch and now everyone's lunch orders have been publicly cached for 52 whole minutes. 🍕 But don't worry, only 0.05% of the internet knows you like extra anchovies. Move along, folks, nothing to see here except some spicy user data! 🔍💾
https://blog.railway.com/p/incident-report-march-30-2026-accidental-cdn-caching #tragedy #disaster #userdata #technews #privacyconcerns #HackerNews #ngated
Incident Report: March 30th, 2026 — Authenticated user data cached

Railway experienced an incident where CDN features were accidentally enabled for some domains without users enabling them.

Railway Blog
Hacker News1h ago

Incident March 30th, 2026 – Accidental CDN Caching

https://blog.railway.com/p/incident-report-march-30-2026-accidental-cdn-caching

#HackerNews #IncidentReport #CDN #Caching #March2026 #TechNews #Railway #Blog

Incident Report: March 30th, 2026 — Authenticated user data cached

Railway experienced an incident where CDN features were accidentally enabled for some domains without users enabling them.

Railway Blog
OTX Bot20h ago

EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons

Pulse ID: 69ca1c1315c96fd0b4101d4c
Pulse Link: https://otx.alienvault.com/pulse/69ca1c1315c96fd0b4101d4c
Pulse Author: Tr1sa111
Created: 2026-03-30 06:45:39

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CDN #CyberSecurity #EtherHiding #InfoSec #OTX #OpenThreatExchange #RAT #bot #Tr1sa111

LevelBlue - Open Threat Exchange

Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

LevelBlue Open Threat Exchange
Show threadAlterego_Midshipman1d ago

@visuallyperfect MAX как кейс: типичные баги, архитектурные провалы и почему это закономерно

Если отбросить маркетинг и смотреть на MAX как на инженерный продукт, то картина довольно прозрачная: перед нами типичный “быстро собранный мессенджер”, который пытаются масштабировать раньше, чем он стал устойчивым.

Разберём по слоям.

---

1. Доставка сообщений: не гарантия, а вероятность

Симптоматика знакома: — сообщения приходят пачками
— дублируются
— часть переписки просто исчезает

Это классический признак плохо настроенной eventual consistency. Судя по поведению, backend не обеспечивает строгую гарантию доставки (at-least-once / exactly-once), а плавает где-то между retry-логикой и race conditions.

Что это значит на практике: — повторная отправка → дубликаты
— сбой на клиенте → рассинхрон
— reconnect → “догоняющие” сообщения

Если система не умеет детерминированно разрешать конфликты — это не баг, это следствие архитектуры.

---

2. Push-уведомления: рассинхрон между слоями

Типичный кейс: — пуш пришёл → сообщения нет
— сообщение есть → пуша нет
— всё приходит через 10–15 минут

Основной подозреваемый — интеграция с Firebase Cloud Messaging.

Но проблема глубже: — нет единого источника истины (source of truth)
— пуш и сообщение живут в разных транзакционных контекстах
— отсутствует нормальная idempotency

В нормальной системе push — это просто триггер, а не отдельная сущность с собственной логикой.

---

3. Клиент: UI как узкое место

Фризы, дерганый скролл, зависания — это не “мелкие баги”, это сигнал:

— список сообщений плохо виртуализирован
— перерасчёт layout идёт на основном потоке
— есть memory leaks

Типичный стек-проблем: — RecyclerView захлёбывается на больших чатах
— битмапы не освобождаются
— кеширование сделано “на глаз”

В результате: UI начинает быть bottleneck быстрее, чем сеть.

---

4. Медиа: слабое место всех “быстрых” мессенджеров

Симптомы: — фото не уходят
— видео ломается
— загрузка зависает

Это почти всегда: — нестабильный upload (chunking / retry)
— проблемы на CDN
— отсутствие контроля целостности

Если нет нормального pipeline: encode → upload → verify → deliver
— медиа будет ломаться системно.

---

5. Сессии и авторизация

Самый раздражающий класс багов: — выкидывает из аккаунта
— слетает история
— “переавторизуйтесь”

Это почти гарантированно: — проблемы с токенами
— гонки при обновлении сессии
— рассинхрон между клиентом и сервером

Если auth не атомарен — вся система начинает вести себя хаотично.

---

6. Краши и память

Если приложение: — падает при отправке файлов
— жрёт RAM
— умирает в фоне

значит: — lifecycle не контролируется
— ресурсы не освобождаются
— тестирование на edge-кейсах отсутствует

Это не “надо допилить” — это долг на уровне архитектуры клиента.

---

7. Безопасность: отсутствие ясной модели

Ключевой вопрос — не “есть ли шифрование”, а: кто контролирует ключи и где происходит дешифровка?

Если нет прозрачной end-to-end модели, как у Signal, то: — сервер потенциально видит всё
— безопасность декларативная

Даже Telegram с его спорной моделью MTProto выглядит более зрелым решением на фоне MAX.

---

8. Масштабирование: система не держит нагрузку

Периодические “падения” — это не случайность.

Это означает: — нет горизонтального масштабирования
— нет нормального load balancing
— система не тестировалась под реальную нагрузку

Типичная ошибка: сначала релиз → потом попытка масштабировать → потом firefighting.

---

Итог

MAX — не “глючный мессенджер”.

MAX — это: — backend без строгих гарантий
— клиент без оптимизации
— инфраструктура без запаса прочности

Все наблюдаемые баги — не случайные. Они логично следуют из архитектурных решений.

---

Почему это важно

Такие системы создают ложное ощущение стабильности: пока нагрузка низкая — “вроде работает”.

Но при росте: — баги становятся нормой
— доверие падает
— продукт превращается в технический долг

---

Коротко

Если описать одной строкой:

MAX сейчас — это не продукт уровня production-grade мессенджера, а MVP, который по ошибке выпустили в массовое использование.

---

Если нужно, могу разобрать: — как бы выглядела нормальная архитектура такого мессенджера
— или сравнить MAX с WhatsApp / Signal / Telegram на уровне протоколов и backend-дизайна

#MAX
#Мессенджеры
#Инженерия
#SoftwareEngineering
#Backend
#DistributedSystems
#EventualConsistency
#MessageQueues
#PushNotifications
#FCM
#AndroidDev
#MobileDev
#UX
#Performance
#MemoryLeaks
#Scalability
#Reliability
#HighLoad
#DevOps
#Microservices
#CDN
#Security
#EndToEndEncryption
#Signal
#Telegram
#ITАнализ

OTX Bot4d ago

EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons

EtherRAT, a Node.js-based backdoor linked to a North Korean APT group, was detected in a retail customer's environment. It allows arbitrary command execution, extensive system information gathering, and asset theft. The malware uses 'EtherHiding' to store C2 addresses in Ethereum smart contracts, making infrastructure resilient to takedowns. It communicates using CDN-like beaconing to blend with normal traffic. Initial access varied, including ClickFix and IT Support scams via Microsoft Teams. A SYS_INFO module performs comprehensive host fingerprinting for target selection. The malware checks for CIS languages and self-destructs if found. It collects detailed system information, including hardware, software, and network details.

Pulse ID: 69c5a04382b357bdc81343b4
Pulse Link: https://otx.alienvault.com/pulse/69c5a04382b357bdc81343b4
Pulse Author: AlienVault
Created: 2026-03-26 21:08:19

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#BackDoor #CDN #CyberSecurity #ELF #EtherHiding #InfoSec #Korea #Malware #Microsoft #MicrosoftTeams #Nodejs #NorthKorea #OTX #OpenThreatExchange #RAT #bot #AlienVault

LevelBlue - Open Threat Exchange

Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

LevelBlue Open Threat Exchange
Reel Tubes4d ago
Plongez dans HyperOpen‑X : démo claire des HLS interstitials pour manipuler des playlists dans le cloud et insérer des publicités personnalisées. Idéal pour ingénieurs streaming et ops vidéo enthousiastes ! #HLS #CDN #AdInsertion #cloud #streaming #video #Ateme #HyperOpen #French
https://video.app.nexedi.net/videos/watch/ec434015-a47a-41e0-b709-bbf4b0d475ee
HyperOpen-X - hyper_cdn - video Ateme

PeerTube
knoppix5d ago

Cloudflare’s latest Transparency Report shows a 9x increase in 'geoblocking' requests, targeting pirated sites across various regions. 🌍
Geoblocking measures surged in countries like France, the UK, and South Korea, raising concerns over user access and privacy. 🔒

🔗 https://gigazine.net/gsc_news/en/20260324-cloudflare-geo-block/

#TechNews #Cloudflare #Privacy #Geoblocking #DigitalFreedom #Regulation #CDN #Security #Control #Censorship #Compliance #Piracy #TechPolicy #DataProtection #Transparency #Report #France #UK #SouthKorea

Cloudflare's Transparency Report reveals that it has increased its use of 'geoblocking,' which blocks access to pirated websites and other sensitive content from specific regions, ninefold compared to the same period last year.

Cloudflare has released its transparency report for the second half of 2025. According to the report, Cloudflare has seen a surge in cases of 'geoblocking,' which blocks access to pirated websites from specific regions, with the number of cases being increased more than ninefold compared to the same period last year. Cloudflare Transparency Report | Cloudflare https://www.cloudflare.com/transparency/ Cloudflare Reports Surge in Geo-Blocked Pirate Site Domains * TorrentFreak https://torrentfreak.com/cloudflare-reports-surge-in-geo-blocked-pirate-site-domains/ According to Cloudflare's transparency report, Cloudflare received 121,681 copyright infringement complaints related to hosting in the second half of 2025. Other complaints included 23,280 trademark infringement cases, 182 child sexual abuse content (CSAM), 195 non-consensual explicit sexual images (NCSEI), 176 threats (such as bomb threats), and 258,592 phishing scams. The table below compares the first and second halves of 2025. While copyright infringement complaints were about 3,000 more in the first half, the number of cases handled increased by approximately 13,000 in the second half, and trademark infringement and phishing scam cases surged. Cloudflare attributes this increase in handling cases to automated processing implemented in the second half of 2025. In addition, 'geoblocking' measures may be taken to prohibit access from certain regions based on legal requests from national governments and courts. In the first half of 2025, geoblocking was applied to 33 domains in Italy, 80 domains in Belgium, 13 domains in the UK, and 662 domains in France, showing an increasing trend. In the second half of 2025, the number of geoblocking applications surged, with 1,238 in France, 457 in the UK, and 1,002 in South Korea. The total number of domain names subject to geoblocking in the second half of 2025 was 2,791, a significant increase of nearly nine times compared to 308 in the same period of the previous year. Cloudflare had previously received an order to block access to pirated services from the public DNS resolver '1.1.1.1,' but refused, arguing that 'filtering would also slow down service speeds for legitimate users worldwide.' As a result, Italian regulators decided to fine Cloudflare €14,247,698 (approximately 2.6 billion yen) for failing to comply with necessary anti-piracy measures. Cloudflare has appealed this ruling, but has also indicated that it will use geoblocking to comply with '1.1.1.1' blocking orders from specific countries' regulators without affecting legitimate users worldwide. Cloudflare faces a 2.6 billion yen fine from Italian regulators for refusing to block pirated websites with its public DNS resolver '1.1.1.1' - GIGAZINE According to Torrentfreak, which covers copyright news, geo-blocking measures vary greatly from country to country. For example, in the UK, Cloudflare has been taking voluntary measures against sites that have not been directly ordered by the High Court, based on past High Court orders against ISPs in which it was not a party, which may explain the large number of blocked sites. In Belgium and France, Cloudflare complies with orders issued against it, but in Belgium, geo-blocking is applied not only to pirated sites but also to illegal gambling sites. Furthermore, recent legal regulations in South Korea have required CDN providers to restrict access to certain illegal sites via domestic servers, resulting in hundreds of sites being blocked in the latter half of 2025. However, Cloudflare explains that the blocking in South Korea is not in the traditional sense, but rather restricts access to specific sites through equipment physically installed within South Korea.

GIGAZINE
Turbo Learn PHP5d ago

CDN Purge Throttle

Rate-limit purge storms during deploys.

#php #python #cdn #purge #ratelimiting #deploy #backendsafety #reliability #performance #viralcoding

https://www.youtube.com/watch?v=HHEN2KqLYgg

CDN Purge Throttle #cdn

YouTube
Giménez Silva Germán AlbertoMar 20

Need image dimensions from S3 or a CDN? Don't download the whole file. FastImage reads the header—1-16KB instead of megabytes. 5-199x faster.

Pure Ruby. Zero dependencies. Done.

https://rubystacknews.com/2026/03/20/fastimage-overview/

#OpenSource #DeveloperTools #TechTools
#ImageProcessing #CDN #S3 #AWS #Ruby

FastImage Overview

FastImage Overview March 20, 2026 The Gem: Fetch image dimensions and type without downloading the entire file. The Problem Your app needs image dimensions from remote URLs (S3, CDN, etc.). Downloa…

Linking Ruby knowledge from the most remote places in the world.
Dan QMar 19

A Random List of Silly Things I Hate:

1. Websites that are just blank pages if the #JavaScript doesn’t load from the #CDN.

2. The misunderstanding that LLMs can somehow be a route to #AGI.

3. Computer systems that say my name is too short or my #password is too long.

4. People being unwilling to discuss their wild claims later using the lack of discussion as evidence of widespread acceptance.

5. When people balance the new #toiletRoll one atop the old one’s tube.

6. #Shellfish. Why would you eat that!?

7. People assuming my interest in computers and technology means I want to talk to them about #cryptocurrency.

8. Websites that nag you to install their shitty #app. (I know you have an app. I’m choosing to use your website. Stop with the banners!)

9. People who seem to only be able to drive at one speed.

10. The assumption that the fact I’m “sharing” my partner is some kind of compromise on my part; a concession; something that I’d “wish away” if I could. (It’s very much not.) #polyamory

11. #Brexit.

🔗 More detail: https://danq.me/random-silly-things-i-hate

A Random List of Silly Things I Hate

Just a list of eleven random silly things that I hate, to various degrees.

Dan Q