41–50 of 123 posts
Ughh here I was at 1:30AM after a hard week, checking the news one last time before going to bed, and see this. I hate this dang industry and regret ever becoming a tech lead. I know the Heroku engineers have it worse and all, but just venting.
To me, this reads like someone got read access to all the source code on Heroku, so if you have any credentials hardcoded in there, now's the time to change them, too. I wonder if the hackers were kids who got bored around Easter holiday - meaning Heroku's security is shit - or if Heroku deliberately waited to announce this during Easter holiday to minimize the attention it gets - meaning they are as deceitful as all…
RE kids or misdirection: as with all things, it's probably somewhere in the middle -- a somewhat-sophisticated attacker and a slow, evolving investigation unfortunately coinciding with a holiday weekend. They say the report was received 3 days ago (on April 13) from GitHub after they noticed suspicious activity on April 9.
https://github.blog/2022-04-15-security-alert-stolen-oauth-u...
This is as good a time as any to ask about Render. I've been eyeing it recently and I'm thinking about launching my next project with it. Does anyone have any takeaways from using Render vs Heroku?
I was worried that Heroku would end up costing me a small fortune as demand scaled. Plus the platform seemed to have stagnated.
I contemplated switching to AWS, but didn’t want to deal with the extra hassle of it. By chance, I saw someone mention Render on here, checked it out, and couldn’t be happier.
It’s a bit harder to get up and running with Render than Heroku, but orders of magnitude easier than with AWS. And once you’re operational, it’s a cinch.
And way, way, way cheaper.
Ughh here I was at 1:30AM after a hard week, checking the news one last time before going to bed, and see this. I hate this dang industry and regret ever becoming a tech lead. I know the Heroku engineers have it worse and all, but just venting.
This is a chance to reiterate best practices: Credentials and other secrets, like API keys, should never be hard-coded in the source code repo. Use some sort of secrets management or configuration for that kind of stuff.
Earlier quoted context omitted.
I see a heap of "downloaded a zip of repository" but I suspect that's Heroku CI or other CI tool running.
Yeah I see lots of the same. They seem to correspond with Heroku deploys? Anyone know if that happens when a valid heroku deploy occurs? Do they download a zip? I've reached out to Heroku support to ask.
FYI looks like the stolen Heroku OAuth tokens are already being used: https://github.blog/2022-04-15-security-alert-stolen-oauth-u...