theden

Glad they're not changing the API! I'm hopeful things will get better with them regaining their independence.

Shameless plug: We run https://songstitch.art/ for collage generation.

For those that don't know, Erin Patterson (the mushroom murderer in Australia) allegedly used iNaturalist to find the poisonous mushrooms

https://www.abc.net.au/news/science/2025-07-10/inaturalist-d...

https://www.sydney.edu.au/news-opinion/news/2025/05/09/the-c...

We do indeed have a staging environment as mentioned previously. The issue arose in the rollout to production as mentioned previously.

You may have misunderstood, I said staged release, i.e., I'm referencing the rollout

I've gone ahead and added the surrogate key mention into the post mortem. We initially got in trouble for having it be too technical centric and not enough on the user impact. It's a delicate balance; apologies. As I mention, we are open to critical feedback here.

You can do both. If you have different audiences, have two separate posts and mutually link to redirect audiences. Ask your sec staff instead of relying on paying customers to give post-hoc feedback on your dodgy disclosure practices. If I have ping a platform company to correct and clarify info about their security disclosure, I'm out.

I'm sorry, but there's a lot of spin here. Basically you guys handled this terribly, and your reliability has tanked recently, hence why customers that need reliability in production are leaving or have already migrated.

We went deep on them, tested them prior, and then when rubber met road in production we ran into cases we didn't see in testing. The large issue, and mentioned in the blogpost, is that we didn't have a mechanism to to a staged release.

Honestly for a production-grade _platform_ company, that also does compliance (SOC2/3, HIPAA etc.), not having a staged release is negligent, and how you guys are handling this is a huge red flag. I've done such changes myself in production envs, for deployments that don't have the stakes you guys have. I'm normally more sympathetic on incidents, but the lack of transparency thus far from railway leaves me doubting more than anything.

Our initial post definitely could have been more clear, and we revised it the moment we got customer feedback to do so.

Please read the room, there's still a lot of confusion about the blog post in this thread (https://news.ycombinator.com/item?id=47582295). The technical detail isn't there, we only know it about the surrogate keys from the status incident (https://status.railway.com/incident/X0Q39H56) which is not linked in the post. The blog post reads like PR compared to the initial incident status report, and the resolved timestamp does not match which is sloppy. Your little edit to the title only made it from a bad post to a slightly less bad post.

We notified customers even before we did a wide release, as is process for anything security related. You create space for as much disclosure area as possible, and then follow up with a public disclosure

Emailing only affected users isn't working out, because affected people aren't yet emailed (I know one personally). Just check the post on your own forum (https://station.railway.com/questions/data-getting-cached-or... did you actually read it?) and see the list of people affected still not emailed, and left on read. You guy should email everyone, this is a security incident not a service interruption. There's a lot of loss trust by your customers now, i.e., if you guys can't figure out who to email, what else are you doing wrong?

Do you have any specifics here? We're scaling the system at 100x YoY growth right now, working 24/7 to scale the entire thing. Again, all ears on if you have specific crits as we're always open to receiving feedback on how we can do things better!

https://x.com/JustJake/status/2038806338915152350

Again, it's not an excuse if you're a _platform_ company that customers pay a lot of money to be reliable. You can't just keep saying you're open to feedback and being transparent as vanity. There's plenty of feedback on here, your twitter, your forum, and feedback is people are telling you to focus on reliability, because railway keeps breaking their deployments. If you don't care about reliability and prefer to scale with features, be honest about it. Railway's poor uptime does not lie.

There are team members in that thread linked, are you certain you linked the right thread? Happy to have a look at anything you believe we're missing!

Did you read the thread? Yes, only _one_ employee commented 5 hours after my HN comment. Still almost everyone left of read, unanswered questions etc.

By way that's only one forum post, there are many that are just ignored, one where a user mentioned they're reporting railway to ICO for a GDPR breach, rightfully.

I'm kinda shocked (yet not surprised) at how bad railway has been with this:

- Why were they making CDN changes in prod? With their 100M funding recently they could afford a separate env to test CDN changes. Did their engineering team even properly understand surrogate keys to feel confident to roll out a change in prod? I don't think they're beating the AI allegations to figure out CDN configs, a human would not be this confident to test surrogate keys in prod.

- During and post-incident, the comms has been terrible. Initial blog post buried the lede (and didn't even have Incident Report in the title). They only updated this after negative feedback from their customers. I still get the impression they're trying to minimise this, it's pretty dodgy. As other comments mentioned, the post is vague.

- They didn't immediately notify customers about the security incident (people learned from their users). The apparently have emailed affected customers only, many hours after. Some people that were affected that still haven't been emailed, and they seem to be radio silent lately.

- Their founder on twitter keeps using their growth as an excuse for their shoddy engineering, especially lately. Their uptime for what's supposed to be a serious production platform is abysmal, they've clearly prioritised pushing features over reliability https://status.railway.com/ and the issues I've outlined here have little to do with growth, and more to do with company culture.

Honestly, I don't think railway is cut out for real production work (let alone compliance deployments), at least nothing beyond hobby projects.

Their forum is also getting heated, customers have lost revenue, had medical data leaked etc., with no proper followup from the railway team

https://station.railway.com/questions/data-getting-cached-or...

So the solution is to use a proprietary password manager instead? No thanks

This happened to me and I finally ditched time machine for BorgBackup https://www.borgbackup.org/

Not as nice UI-wise, but at least it's stable

Personal site: https://theden.sh/

Blog: https://thoughts.theden.sh/

Kinda funny that a lot of devs accepted that LLMs are basically doing RCE on their machines, but instead of halting from using `--dangerously-skip-permissions` or similar bad ideas, we're finding workarounds to convince ourselves it's not that bad

Way back when I was young and broke, I played through Half Life 2 and the episodes on a ThinkPad T420 using an ExpressCard/34 PCMCIA to PCI with a graphics card I borrowed and an old crappy PSU I pulled from a business Dell desktop.

Managed to complete the games with decent graphics and framerate at the time. It wasn't an ideal setup, but I didn't care. In fact, I thought it was a cool hack to play games at the time without forking out a lot of money to build a gaming PC.

Maybe there are probably better options now to game than attaching a dedicated GPU with whatever hardware you already have, but I can verify that external GPUs are really cool and useful (though a 5090 is definitely not needed). You also don't have to care about cooling the GPU, since it's "atmosphere" cooled (though headphones and/or ANC are a must).

I must be out of the loop, I didn't know people were actually doing this in their workflow. When I do use LLMs, it's in a separate app, where I can cherry pick what I input and output at my own pace.

Maybe I'm naive, but the ever-increasing tradeoffs for even more velocity does not seem worth it.

People underestimate how much our socially and culturally constructed gender roles impact interests and/or career paths. People have different tolerances with respect to conformity, and at different stages in their lives.

It's a shame something as fundamental as computing is seen as a "boy" thing by many, often fatalistically, and I think we've been worse off for it.

Pretty cool! You can force a miss by setting these vars in the console

  scoreMinute += 1

  forceMissPaddle = rightPaddle; // or leftPaddle

My minor suggestion would be to not to use `COPY . .` as it could slow down the build process if it has to copy everything in the context that's not needed. Also a potential privacy/sec risk if private/secret data is copied the final docker image, but probably not applicable in a multi-stage builds where it's in an aux stage.

If you don't want to have multiple `COPY`s, you can add a `.dockerignore` file (https://docs.docker.com/build/concepts/context/#dockerignore...) with the `COPY . .` directive and effectively configure an allowlist of paths, e.g.,

  *
  !src/
  !requirements.txt

In the HTML there's a cool comment

      <!-- Hello this is Theo. Yes I know how to do web design. -->
      <!-- You have found my secret message. -->
      <!-- It is a coin emoticon picture. -->
      <!--
                     ______________
        __,.,---'''''              '''''---..._
     ,-'                                       '`-.
    |                      ONE                     |
    |                    THNICKEL                  ,
    |'-.._                                    __,,-
    |      ''`---.....______________.....---''     |
    |                                              |
    |                                              |
    |                                              |
    |                                              |
    |                                              |
    |                                              |
    |                                              |
    |                                              |
    |                                              |
     '-.._                                   __,,-`
          ''`---.....______________.....---''
    -->

I'm working on https://catmatch.theden.sh/ as a fun way for people to adopt rescue cats

Also https://github.com/007revad/Synology_M2_volume for NVMe M.2 drives (some synology models only allow NVMe drives to be used as read/write caches without this script)

Like the adjacent comment mentioned it's mountable in linux, so I wouldn't call it a lock-in in the normal way https://zarino.co.uk/post/synology-shr-raid-1-ubuntu/

Not sure why people are saying SHR is proprietary in some of the comments I read, it's effectively a wrapper for mdadm — though I suppose the GUI itself could be called proprietary.

going to use this for my bank account password

Never liked LMGTFY because it was always used in a snarky manner. But at least it somewhat was useful in that it mostly showed results as a springboard for the user to (hopefully) start learning how to parse information on the web.

This is taking it a step further to some form of intellectual learned helplessness.

I agree with you, and the reference _is_ politically loaded (https://en.wikipedia.org/wiki/Thin_blue_line):

The thin blue line U.S. flag has been banned by some police departments in the United States for its associations with ideologies described as "undemocratic, racist, and bigoted."

According to a 2018 law review article, "thin blue line" also refers to an unwritten code of silence used to cover up police misconduct, also known as the blue wall of silence, a term dating back to 1978

I like it, but raw HTML doesn't mean it has to look like it's from the 90s. He could centre the text with CSS, add some whitespace, specify system fonts, rather than just Times Roman etc.

An example of what I mean: http://bettermotherfuckingwebsite.com/

A more flashy example: https://thebestmotherfucking.website/

Wonder what the expected battery life is given the hardware (including it being x86)

I've done development on a Nokia n900, but with an external keyboard — can't imagine using an on-screen keyboard, or even a tiny physical one!

Funny thing is, I don't know if some high sec work envs are much better, where developers have to nest remote through machines (of different OSes) just to get a terminal...

Honestly this would be good for infra diagrams, miro boards, wireframes etc. — sometimes a laptop screen can feel claustrophobic

I actually liked it, a bit fiddly, but being able to reorder and resize as well as have multiple screens is better IMO. Not perfect, but I think my control centre is better than before

Sign me up!

Same energy is needed for the kernel-level anti-cheat software, which ought to be a dealbreaker for Helldivers IMO

Anyone know an app that does this for mobile devices? Specifically iphones

- With a friend we created SongStitch (https://songstitch.art/) because I wasn't satisfied with the performance and optimisations of existing last.fm collage generators. I embed a last.fm collage on my website, and previous generators didn't resizing, didn't compress well, and were slow causing me to be kicked out of the 250kb club—so it was good enough motivation to build SongStitch (https://github.com/nkoehring/250kb-club/issues/337). We also developed it as open source from the start https://github.com/SongStitch/song-stitch

- I created `gcopy` (https://github.com/TheDen/gcopy) because I wanted to extend `pbcopy` to copy nontext data from the terminal to the clipboard, so I could quickly paste such data in Slack (or as email attachments)—I got tried to having to find it the specific file in Finder to copy or drag it to an app. I've since aliased `pbcopy` to `gcopy` since it's a drop-in replacement.

- Also created `galvani` (https://theden.mmm.page/galvani) to show and change the the power mode status on MacOS from the menubar