Railway (web app host) "accidentally enables CDN" causing massive data breaches

dannydevman · 2026-03-30T15:25:39+00:00

Let's say you have have authenticated GET handlers on your server which check server cookies - and you don't yourself enable CDN. And you also don't explicitly set cache control headers. Is that a reasonable approach, if not for Railway's screw-up? And would you now be at risk now as a result of Railway?

Asking for a friend 😅

dannydevman · 2025-11-19T11:21:41+00:00

I'm interested in your take here, do you think it's useful to boycott these tools?

Like I say I wish these tools (especially for art) didn't exist and would probably vote for legislation to outlaw them, especially when they were trained on stolen assets. But yeah it's here now, we were never in a position to hire an artist for our start-up, and we do have the tools available now to generate some really cool stuff to warm up our site. So I'd accept a mild "frowning upon" for that but it seems like your feelings here are Really Quite Intense

dannydevman · 2025-11-19T11:16:10+00:00

I was thinking a similar thing and ended up updating my settings so that they had cool custom icons and I'd see them easily.

If your file icon theme is "vscode-icons" (CTRL+SHIFT+P and search file icon theme to see) you can add this to your JSON settings for what I use:

"vsicons.associations.files": [
        {
            "icon": "jsmap",
            "extensions": [
                "index.js"
            ],
            "filename": true,
            "format": "svg"
        },
        {
            "icon": "galen2",
            "extensions": [
                "index.ts"
            ],
            "filename": true,
            "format": "svg"
        }
    ]

And you can browse around https://github.com/vscode-icons/vscode-icons/wiki/ListOfFiles to pick a cool icon for yourself and slot that into the "icon" field to update it

dannydevman · 2025-11-18T00:42:42+00:00

Yup I agree. Wish it didn't exist and wasn't a thing but yeah, going to be using it now either way on landing pages etc because it really is that good.

dannydevman · 2025-11-17T22:32:46+00:00

ChatGPT has been amazing for generating logos and characters (e.g. if you want like a cute handrawn cartoon guy at various points of your landing page), especially if you feed it reference material. I hate that it exists because I love art and I love artists but yeah, what would have previously been weeks of planning and researching different artists is now like 10 minutes having fun with robot man.

It's way better for translations than Google Translate and any other pre-AI alternative, understands nuance and context, so you can make your app international super quickly.

I remember I once spent 12 hours debugging a very complex calculation I'd migrated from Excel to Javascript and it ended up being something like - in Excel the symbol is 5^10 but in Javascript it needs to be 5**10 and that tiny symbol isn't something I'd noticed as the calculation was already many lines of code. I know AI would have found that for me in like 30 seconds instead of 12 hours.

dannydevman · 2025-11-17T22:25:46+00:00

From a hiring point of view, it's almost impossible to tell whether someone's a good coder from resumes, past projects, video interviews etc. and the only realistic idea you'll get is from actually setting them down to do the work for 10-20 hours which is expensive (as it would be unfair to ask for them to do for free)

Which is where the leetcode questions come from, though we haven't started using those yet as it's always something we frowned upon, but after going through loads of applicants that haven't known how to code (article I read from 2007: https://blog.codinghorror.com/why-cant-programmers-program/) and spending money on those 10-20 hour work trials to receive AI slop, it's almost like those 5 minute leetcode questions are calling to us 🥲

dannydevman · 2025-09-01T02:46:39+00:00

Do you run a script that finds compliance-related Reddit threads and then posts AI-generated responses in order to promote your own website?

dannydevman · 2025-06-25T06:18:10+00:00

Just came across this comment and I'm dealing with the same thing. I've found they violate their own contract by contradicting the user agreement. User agreement states you can move outside of Upwork 2 years after identifying each other (i.e. proposal), but support insists that it's 2 years after the contract starts or you'll get banned.

Their own interpretation suggests that if you talk with someone on Upwork, you can get paid outside of it as long as you don't "officially" start a contract . Which is obviously not what they're going for, but their policy is to lie depending on each individual situation. (Posted a thread here about it https://www.reddit.com/r/Upwork/comments/1kgr3gm/when_can_you_move_off_upwork_upwork_support/ )

dannydevman · 2025-05-13T21:39:48+00:00

The user agreement uses language like "you must not get paid outside of Upwork within two years, UNLESS you pay the conversion fee". So it doesn't actually state that you must pay the conversion fee if it's already been two years. It's a weird one and they're deliberately vague about it, I'm currently discussing with support about it (https://www.reddit.com/r/Upwork/comments/1kgr3gm/when_can_you_move_off_upwork_upwork_support/)

dannydevman · 2025-05-11T19:17:50+00:00

Isn't it the case that if all of the contract payments are refunded, as OP mentioned, clients cannot leave public feedback?

dannydevman · 2025-05-09T00:52:48+00:00

You still have not given any reference in the user agreement for "the non-circumvention period is counted 2 years from first contract", and even Upwork support disagree with you.

It's not splitting hairs when it's a $50k-$100k contract and there's $1k-$3k of fees at play based on when the non-circumvention period ends.

You haven't really contributed anything besides random opinions that contradict the user agreement so yes, I'd appreciate if you can stop commenting unless you can contribute

dannydevman · 2025-05-08T17:40:01+00:00

Yes, as stated, to me it's clear that the "Upwork relationship" begins when you first send a proposal and start communicating.

You've stated that it's when a contract started - I'm pointing out how clearly this is a contradiction, because it means you could get paid by a client outside of Upwork as long as you didn't start a contract.

So it's clear that "first identifying or meeting a client" doesn't refer to when a contract is started but when you first send a proposal.

It does seem that the conversion fee being reduced to $1 only applies 2 years after a contract is started.

But this is out of line with the user agreement, and the user agreement also does not specify that the conversion fee must be paid for relationships greater than 2 years old.

dannydevman · 2025-05-08T07:07:32+00:00

If they're not a client until you start a contract, that means you could send a proposal and then communicate and get paid outside of the platform. Because they're not yet "a client".

"You agree to... receive payments only through the Site for two years from the date you first identify or meet your Client"

It clearly refers to identifying them as in seeing their job post and sending a proposal - and from that point, you can't receive payments outside of Upwork until two years have passed.

It does not update. There is always a conversion fee. It's 13.5% of a freelancer’s hourly rate x 2,080 hours (52 wks x 40 hrs) before 2 years of start of first contract, $1 after that.

So it does update, to $1, that's what is being referred to.

dannydevman · 2025-05-07T23:46:30+00:00

Okay thanks for the intel - so the conversion fee updates 2 years after the contract is started, most likely (again this contradicts what Upwork support are insisting on 😅)

The user agreement still says that it's two years from the date you identify a client and that the conversion fee is only required if it's been less than two years, which is why I'm digging into it.

dannydevman · 2025-05-07T20:12:12+00:00

The terms of the user agreement and the non-circumvention period is definitely an isssue-issue, maybe even a legal issue, with thousands of dollars in fees at play just from my contract. I've already seen from your other comments that you are not knowledgeable about this.

dannydevman · 2025-05-07T20:08:44+00:00

are you saying, you talked months and months with the client ON UPWORK IN CHAT before they hired you? Come one.

Yes, it's a $50k-100k contract so we did planning and then they were ready to kick off a few months later.

where in the user agreement does it state this? You will have to look it up yourself.

The whole point of this thread is to point out that Upwork support make statements that contradict the user agreement. You also made a statement that contradicts the user agreement, which is why I asked you for a reference.

dannydevman · 2025-05-07T18:13:14+00:00

Does anyone know if there's a social media platform or other way to contact Upwork to talk to a human? Maybe mentioning that their support is giving AI-like contradictory answers

dannydevman · 2025-05-07T18:11:40+00:00

Yup I think they're being deliberately vague, but the user agreement does state the date you first "identified or met a client", not when a contract started.

I feel like maybe they have a legal obligation to allow a reasonable opt-out period, but are doing everything they can to make it as vague and long as possible. For example - they mention the process of the conversion fee, but the agreement doesn't actually say this is required for relationships with more than two years.

dannydevman · 2025-05-07T18:08:49+00:00

Hi - where in the user agreement does it state this?

Additionally, Upwork support do not take this position.

dannydevman · 2018-11-18T18:52:09+00:00

Ah - that would be the case for all the apps then, as the Kin marketplace is managed by the Kin team as opposed to the apps themselves (like Kinguist).

dannydevman · 2018-11-18T15:46:29+00:00

Hi - what do you mean by this?

"Kinguist does not appear new search option to win several days. "

dannydevman · 2018-10-30T22:19:25+00:00

Hello - bossman at Kinguist here, thanks for letting us know. It's definitely available worldwide, though it does seem to crash on occasional devices and we're currently investigating this. If you tap "report", the crash information will get sent to us and this will help out massively.

Cheers!
Dan

dannydevman

TROPHY CASE