As someone who has helped to secure critical national infrastructure several years ago, I can say that it was a mess to disclose the vulnerabilities I identified, and in some cases it took years to patch them. Some of these vulnerabilities were RCEs and mass PII leaks. It's simply not worth the risk for most people - who aren't in the USA - to bother doing this sort of security research. However, if you are in the USA, there are provisions in the CFAA that enable good-faith security research to take place (https://www.justice.gov/archives/opa/pr/department-justice-a...), so to the best of my understanding, you're able to do good-faith research without being charged or prosecuted, and you should take advantage of this if you have the skills or models to do so. I am not based in the USA, and there are no laws in my country that guarantee me zero jail time for simply trying to do the right thing, so I am not incentivized to continue finding vulnerabilities in my country's infrastructure.

Edit: If other countries don't catch up and include similar provisions in their laws, they'll simply fall behind and put their citizens at risk. I'm sure every country has individuals willing to help that currently feel unsafe - look at the large amount of bug bounty hunters worldwide who, I'm sure, wouldn't mind practicing their skills by securing their country's infrastructure.

It is absolutely happening, paid by your taxpayer dollars (if you’re American).

Most major countries have this kind of programs. Those could probably be bigger and they will always miss obvious stuff but they exist, at least for CNI.

Don't worry - Siri is on it - that's actually why they've been so lacklustre. Just too busy hacking for the good guys

> I'd feel a lot better if I knew some red team security researchers were going hard trying to break into critical national infrastructure

They are. Most critical infrastructure providers worldwide have in house or contract red teams. Every western government has an agency dedicated to cyber defense and they all have red team programs.

imagine if we just turned off 90% of the non-critical internet for two weeks, hardened up in an absolute mad dash where everyone has access to top tier cyber models, and then afterwards we go back to business as usual. it’d be a disaster short-term but long-term would it be worse than the years of slow drip we’re about to go through? idk! I kinda think it’d be interesting to find out!

Regular people are often bad guys too, you know. If the reality was "bad guys will have it. Should regular people too?" The entire core dilemma would be entirely eliminated lol.

The email received is a rehash of the linked article, nice find.

>Why not tell all customers at once, especially if payment information was involved?

Answered in the article!

“Q: Am I affected? How will I be notified?

A: We are sending notices to affected individuals in phases, so not everyone has received theirs yet“

And also..

"Q: Where can I find the latest updates?

A: The latest updates regarding the incident will be made available on this page.“

..."Updated October 01, 2026 19:29"

For a site where you find data, they are completely devoid of any useful data on their own incident and redirecting everyone to phone calls where data cannot easily be shared.

[dead]

>How do we even know which credit card is affected by this if we want to cancel it?

"If you have additional questions, contact the dedicated call center at +1-877-361-9887. Hours of operation are Monday-Friday, 11:00 a.m.-11:00 p.m. Central European Time."

> We detected that an unauthorized third party may have gained access to certain user data in one of our systems. After investigating this activity, we found that the third party may have accessed your email address and the following of your information: last 4 digits of your credit card and country, credit card issuer, credit card expiry date.

No one has ever been safe. I would rephrase it as: "More and more people are becoming aware of their exposure".

Hide yo apps, hide yo websites, hide yo hosts

> I don't see any email like this in my inbox.

They stated that they're doing a staggered rollout for email notifications which states at the beginning of October with other users reporting receiving the email yesterday[0].

0 https://news.ycombinator.com/item?id=50313006

This is a common sentiment, but the security story isn’t so clear cut as that. Encrypted at rest really just means that if you yank the disk out of the server, an adversary can’t read it. But if it’s a system that is online serving a database and you gain access to the application reading from the database, encryption at rest doesn’t save you. It’s obvious the application server must be able to read the decrypted data. If an adversary breaches the application, they get the data.

Maybe the Cursor IDE compromise? It might be what got Binance. And it made a lot devs machines backdoored between Wednesday 28th Oct and whenever people decide to remove the backdoor from their machines.

The exploit is called AI (or LLMs)

> I just ignore it in my searches and just find the pdf elsewhere.

In retrospect, this was the correct way to proceed.

The docs I found were content, but nothing that could be used for its original purpose. Splurging a monthly subscription to find out sucked, but being breached and getting my info stolen is a kick in the ass.

As far as I know this is a relic from the PG days. It was done to keep the focus on URL based submissions, and avoid people using the platform as a text/blogging platform (at the time, Reddit was rising, and self posts there were already very common.) URLs were dark, text was meant to support the URL and was lighter.

I think the color actually got lightened a few times.

Was the text light grey before you clicked the comments? Typically the link turns from almost black to light grey after you visit the site, just like a normal link will turn from blue to purple after you click the link to indicate you have visited the site. In this post for example the link goes to the 'Tell HN:' so the link goes directly to the comments. Could it be you did not pay attention until you had visited the comments once already??

It’s way, way too low contrast.

Edit: “@dang” apparently doesn’t ‘work’, but emailed this to hn@ycombinator.com

I always assumed it was the down arrow affecting it, but I have always giggled at the fact that people with sharp eyes have to endure the bad posts while others do not

Geez, I know nobody here clicks through and reads articles before commenting, but are we not even reading the posts now?

>we found that the third party may have accessed your email address... last 4 digits of your credit card and country, credit card issuer, credit card expiry date, payment history

I don't even think they actually pirated book pdfs. Just previews to get you to sign up that lead to no where