Railway Security Disclosure: Wednesday October 21st

25 points by veverkap a day ago on lobsters | 10 comments

pims | a day ago

This is really bad.

abathur | a day ago

Seems so. Fair number of people in the HN equivalent thread reporting activity on their pilfered keys.

kwas | a day ago

I don't know if marketing/UX is ontopic, but I really despise the name they've picked for the company. (Physical) security issues with railways are currently bit too common where I live, and this just pollutes the commons.

JulianSildenLanglo | a day ago

I sympathise with them as it's really damn hard to come up with a good company name.

tinsmith | a day ago

I find it fun! Some friends and I will banter about this on Discord now and then after we accidentally come up with an idea (usually impractical or absurd, but an idea none the less!) that someone should be making money on.

Dumb as the ideas are, the names work because we tend to capture two core elements:

  1. A good understanding of the product and how people will use it

  2. A good understanding of the English language and how people use it

I posit that companies with bad names (such as Railway) either wanted to force an image of their product that users don’t share or didn’t think through how the name fits into a conversation/feed, resulting in confusion or frustration for another reader.

danlamanna | a day ago

Railway also had quite a bad security issue 6 months ago that went under the radar (https://lobste.rs/s/j6rmdz/railway_incident_report_authenticated), including a blog post that downplayed the whole thing and a forum thread that went off the.. rails.

pestaa | a day ago

How do you even begin to restore your reputation after this?

mitsuhiko | a day ago

You probably just wait. There will be more cases like this against other companies so you won't look quite as bad in a few weeks.

0xajr | a day ago

There have been worse ones already this week. I hate how right you are about that.

https://fulcrumsec.vg/pingcap/

adrien | a day ago

With all the intrinsic issues of AI agents, I hadn't started thinking about issues caused by a compromission of their infrastructure.