Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heroku CI and Review App Secrets Compromised

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 98 posts

Re: Heroku CI and Review App Secrets Compromised

#11

Post by MobileVet »

colesantiago wrote: post #6
hthrowaway5 wrote: post #4

Yep, they outright lied about env vars. Incredible. It pains me to see even occasional defenders of Heroku. They're not the company they were 10 years ago. They've been gutted and left for dead years ago but the product was so good nobody noticed until now. They're not to be trusted as your platform. They simply don't have anywhere close to the manpower required to run such a platform. This was a when not if situatio…

I would like to move but there are really no good alternatives that are even close to Heroku.

We are looking to move to either fly.io or render. Leaning towards render currently but I haven’t spent a ton of time on the effort.

Re: Heroku CI and Review App Secrets Compromised

#13

Post by [deleted] »

hthrowaway5 wrote: post #8
bradleybuda wrote: post #7

Earlier quoted context omitted.

I would not say that they lied about the env vars. The stated line is still "env vars in apps were not compromised, but env vars in CI pipelines and review apps were". For some applications there may have been shared data in these vars - in our case (N=1) our CI pipeline and review apps had a dramatically smaller and less critical set of variables. It still sucks that they are parceling out the information, but the c…

The lie was: > We also wanted to address a question regarding impact to environment variables. While we confirmed that the threat actor had access to encrypted Heroku customer secrets stored in config var, the secrets are encrypted at rest and the threat actor did not access the encryption key necessary to decrypt config var secrets . https://status.heroku.com/incidents/2413 Nowhere in that did it clarify it was spea…

[deleted]

Re: Heroku CI and Review App Secrets Compromised

#16

Post by eropple »

colesantiago wrote: post #6
hthrowaway5 wrote: post #4

Yep, they outright lied about env vars. Incredible. It pains me to see even occasional defenders of Heroku. They're not the company they were 10 years ago. They've been gutted and left for dead years ago but the product was so good nobody noticed until now. They're not to be trusted as your platform. They simply don't have anywhere close to the manpower required to run such a platform. This was a when not if situatio…

I would like to move but there are really no good alternatives that are even close to Heroku.

YMMV, but I quite like Render for the sorts of things I'd have used Heroku for ~5 years ago.

Plenty of folks I respect absolutely love fly.io--I have less hands-on experience there, but they've got a fantastic crew, too.

Re: Heroku CI and Review App Secrets Compromised

#17

Post by hthrowaway5 »

bradleybuda wrote: post #5

Text of the email: At Salesforce, we understand that the confidentiality, integrity, and availability of your data is vital to your business, and we take the protection of your data very seriously. We value transparency and wanted to notify you of an issue affecting your account. Based on current progress, we plan to complete our investigation by May 30, 2022. We are continuing with remediation activities and plan to…

> At Salesforce, we understand that the confidentiality, integrity, and availability of your data is vital to your business [...]

Hey Bob, why didn't you tell your customers a month ago to rotate their creds just to be safe? This is flat out insulting.

Re: Heroku CI and Review App Secrets Compromised

#18

Post by hkhanna »

I spent the last two days migrating my company to Render from Heroku, and now I'm glad I did. Render is a little rough around the edges; Heroku is far more polished.

But it's probably to Render's credit that, in my opinion, the most annoying thing about Render is that it's impossible to google about Render because "render" is such a common word in the tech world!

Their support is good and responsive, and the developer experience was good enough. It has some warts, and there were definitely times I missed Heroku, but their speed of improvement gives me confidence in their future.

Sad to leave Heroku after almost a decade with them. They were far ahead of their time.

Re: Heroku CI and Review App Secrets Compromised

#19

Post by ubertaco »

Mandatum wrote: post #15

Sounds like a customer's canary token triggered this based on the current reporting. "Trust is our Number 1 value."

For folks employed by Salesforce, the phrase "Trust is our number 1 value" only comes up in two contexts:

1. company all-hands meetings, which are basically pep rallies with no actual content

2. when someone working at Salesforce brings up a glaring problem and says "if Trust is our number 1 value, why don't we do something about this huge problem?", which is usually met with either silence and bureaucratic obstacles or with excuses, usually something like "customers trust us to spend the money they pay us building the features and products they want", which is like...exactly not the definition used at any of the pep rallies.

Re: Heroku CI and Review App Secrets Compromised

#20

Post by hthrowaway5 »

ubertaco wrote: post #19
Mandatum wrote: post #15

Sounds like a customer's canary token triggered this based on the current reporting. "Trust is our Number 1 value."

For folks employed by Salesforce, the phrase "Trust is our number 1 value" only comes up in two contexts: 1. company all-hands meetings, which are basically pep rallies with no actual content 2. when someone working at Salesforce brings up a glaring problem and says "if Trust is our number 1 value, why don't we do something about this huge problem?", which is usually met with either silence and bureaucratic obstacles…

that and dreamforce (over and over again)
Post reply on HN