Q&A highlight
Posted15 days ago
Key Takeaways
If I recall last week Mintlify wrote a blog post showcasing their impressive(ly complicated) caching architecture. Pretending like they were doing real engineering, when it turns out nobody there seems to know what they're doing, but they've managed to convince some big names to use them.
Man, it's like everything I hate about modern tech. Good job Eva for finding this one. Starting to think that every AI startup or company that is heavily using gen-ai for coding is probably extremely vulnerable to the simplest of attacks. Might be a way to make some extra spending money lol.
Is there any indication Mintify was "vibe coded"?
The challenge with security, as you know, is it's only as strong as it's weakest link. It only takes one ignorant/incompetent person in an entire organization to jeopordize the org.
https://kibty.town/blog/mintlify/
The first CVE here definitely sounds like they absolutely weren't thinking care security.
Yes, but the vulnerabilities reported in this collection of articles really smell like trash. Allowing untrusted code from your customers to be executed in a shared environment with no isolation is like, extremely amateurish.
Are you saying tho that 2.5k wouldhave been adequate in 2019? I expect 5k would have been on par then too. But idk
But it looks like Mintlify are using Vercel on the backend: https://vercel.com/blog/mintlify-scaling-a-powerful-document...
So it's just a Vercel wrapper?
The result? A static html with 500 ppl audience was billing a whooping 2k EUR a month, because that was the cost of that pre-approved architecture.
Best part - I was championing a company wide solution for that problem for over a year, which resulted in board level special operation with 100k budget only to get that budget snugged by people couple steps above the ladder.
We pwned X, Vercel, Cursor, and Discord through a supply-chain attack
What??
Not affiliated with Hacker News or Y Combinator. We simply enrich the public API with analytics.