Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heroku Security Notification

status.heroku.com

Post reply on HN
Print view View original

101–110 of 123 posts

Re: Heroku Security Notification

#101

Post by nijave »

jrochkind1 wrote: post #64

I have always wondered if putting confidential info in even private git repo was a good idea, although it seems to be a common practice? I feel like that question has been answered, for me anyway.

Definitely not a good idea. Source code gets sprinkled around a lot of locations with varying security

- it's stored locally (so any developer machine access could compromise secrets)

- it's stored on the build/CI machines (that might run untrusted code in the form of dependencies--possibly from unrelated repos)

- it can end up in build artifacts

Re: Heroku Security Notification

#103

Post by dangoor »

dangoor wrote: post #102

See also GitHub's post about this: https://github.blog/2022-04-15-security-alert-stolen-oauth-u... Travis-CI was also compromised here and that may actually affect more people than the Heroku side of this.

Discussion about GitHub's post is here: https://news.ycombinator.com/item?id=31046791

Re: Heroku Security Notification

#104

Post by jmarneweck »

kall wrote: post #93
mtmail wrote: post #92

Earlier quoted context omitted.

If you saw the user 'shairyar', he works at Travis based on linkedin profile page (but not based on github profile page). I was confused as well when I saw that.

I guess maybe, but this is incredibly badly communicated. Just now they showed up as a member of travis GitHub orgs, but the only member? https://github.com/orgs/travis-ci/people It's very possible (likely) this is all fine, but done in a way that feels strange/fishy. I haven't even gotten an email from travis. They must be in fire-extinguishing mode.

I would have expected that they would have used a known human rather than look like someone with unauthorised access was doing so.

I see he now has access to three travis-ci organisations on GitHub.

Re: Heroku Security Notification

#105

Post by fourstar »

anurag wrote: post #99
fourstar wrote: post #82

Earlier quoted context omitted.

It’s alright but things are still flaky given they are smaller and newer. It hung on spinning up a postgres instance. Builds are slower as well.

(Render founder) Were you trying the free tier? Builds are significantly faster on paid plans. I'd certainly appreciate more context: email in profile.

Hi -- yes this is on the free plan for clarification of the original comment. Good to know. I was testing out the free plans until I upgraded. https://render.com/docs/build-limits I don't see this mentioned anywhere. https://render.com/pricing should maybe show a row/column on the build speed for the different tiers.

Additionally, spinning up the postgres instance was on a paid tier. I contacted support but it self-resolved eventually after I blew away the instance and rebuilt. However, it was queued up for like 8+ hours on the first pass.

Re: Heroku Security Notification

#106

Post by anurag »

fourstar wrote: post #105
anurag wrote: post #99

Earlier quoted context omitted.

(Render founder) Were you trying the free tier? Builds are significantly faster on paid plans. I'd certainly appreciate more context: email in profile.

Hi -- yes this is on the free plan for clarification of the original comment. Good to know. I was testing out the free plans until I upgraded. https://render.com/docs/build-limits I don't see this mentioned anywhere. https://render.com/pricing should maybe show a row/column on the build speed for the different tiers. Additionally, spinning up the postgres instance was on a paid tier. I contacted support but it self-r…

Thanks. We'll add info around free plan build speeds in the dashboard and docs.

Re: Heroku Security Notification

#107

Post by orf »

dharmab wrote: post #96
michaelbuckbee wrote: post #80

Earlier quoted context omitted.

Most error monitoring services want this as they map errors to commits.

As a user it's nice to have the option of foregoing the feature.

Then just don’t link it to GitHub if you don’t want your errors tracked back to specific commits?

Re: Heroku Security Notification

#108

Post by Exuma »

uallo wrote: post #59

Instead of connecting to a Github repo, you can use https://github.com/heroku/heroku-builds . It allows to create a build locally and then deploy it to Heroku. From what I've read so far, this approach has not been impacted and it should still be possible to do deployments like that.

What about simply using the heroku CLI which is the default? I've used that for every heroku project, I didn't even think to connect to github. I suppose the main benefit is that it's automated.

Re: Heroku Security Notification

#109

Post by dharmab »

orf wrote: post #107
dharmab wrote: post #96

Earlier quoted context omitted.

As a user it's nice to have the option of foregoing the feature.

Then just don’t link it to GitHub if you don’t want your errors tracked back to specific commits?

I might want it linked to my issues but not my source code.

Re: Heroku Security Notification

#110

Post by aaronbrethorst »

akpa1 wrote: post #77
aaronbrethorst wrote: post #44

Earlier quoted context omitted.

I’ve been using Render since January, after switching from Heroku for a project of mine with about 10,000 direct users at present. The project is a Rails app that imports hundreds of thousands of rows of data from XLSX files and spits out PDFs on demand from those imported spreadsheets. I was worried that Heroku would end up costing me a small fortune as demand scaled. Plus the platform seemed to have stagnated. I co…

Render is really not a very good name from a SEO point of view. Took me three or four searches to find it.

Google: "render hosting"
Post reply on HN