Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heroku CI and Review App Secrets Compromised

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 98 posts

Re: Heroku CI and Review App Secrets Compromised

#21

Post by tdfx »

hkhanna wrote: post #18

I spent the last two days migrating my company to Render from Heroku, and now I'm glad I did. Render is a little rough around the edges; Heroku is far more polished. But it's probably to Render's credit that, in my opinion, the most annoying thing about Render is that it's impossible to google about Render because "render" is such a common word in the tech world! Their support is good and responsive, and the develope…

We just started planning our transition, as well. This was handled so poorly I can't imagine anyone would ever plan to start a new project on their platform.

Re: Heroku CI and Review App Secrets Compromised

#22

Post by heartbreak »

I completely stopped getting their update emails when I deleted all of my running apps. This is the second one I've seen on HN that I haven't received (though I received the others).

Is the impact limited to specific customer accounts, or are they just not updating me anymore?

Re: Heroku CI and Review App Secrets Compromised

#23

Post by ojame »

eropple wrote: post #16
colesantiago wrote: post #6

Earlier quoted context omitted.

I would like to move but there are really no good alternatives that are even close to Heroku.

YMMV, but I quite like Render for the sorts of things I'd have used Heroku for ~5 years ago. Plenty of folks I respect absolutely love fly.io--I have less hands-on experience there, but they've got a fantastic crew, too.

One thing that I have really come to like with Heroku is the pipeline. fly.io doesn't have one (I don't think?) and render isn't the same; it rebuilds for different stages and there's no concept of 'promoting' the same slug.

Re: Heroku CI and Review App Secrets Compromised

#24

Post by Ozzie_osman »

heartbreak wrote: post #22

I completely stopped getting their update emails when I deleted all of my running apps. This is the second one I've seen on HN that I haven't received (though I received the others). Is the impact limited to specific customer accounts, or are they just not updating me anymore?

I think it's specific to apps with Review Apps or Heroku CI (specifically the Config Vars). If you didn't have those, based on this email, you may not be impacted.

Re: Heroku CI and Review App Secrets Compromised

#25

Post by hthrowaway5 »

heartbreak wrote: post #22

I completely stopped getting their update emails when I deleted all of my running apps. This is the second one I've seen on HN that I haven't received (though I received the others). Is the impact limited to specific customer accounts, or are they just not updating me anymore?

From the email:

> We value transparency and wanted to notify you of an issue affecting your account.

My guess is they sent it to users with pipelines that have env vars. It's funny since this sentence demonstrates they don't value transparency by not telling the other users more information about the hack.

They updated Heroku Status but surprisingly failed to mention anything about CI or pipelines.

Re: Heroku CI and Review App Secrets Compromised

#26

Post by krono »

hthrowaway5 wrote: post #17
bradleybuda wrote: post #5

Text of the email: At Salesforce, we understand that the confidentiality, integrity, and availability of your data is vital to your business, and we take the protection of your data very seriously. We value transparency and wanted to notify you of an issue affecting your account. Based on current progress, we plan to complete our investigation by May 30, 2022. We are continuing with remediation activities and plan to…

> At Salesforce, we understand that the confidentiality, integrity, and availability of your data is vital to your business [...] Hey Bob, why didn't you tell your customers a month ago to rotate their creds just to be safe? This is flat out insulting.

> At salesforce.com, inc., trust is our #1 value

Their legal pages[1] are filled to the brim with those ridiculous statements. I never understood why they'd even bother making it sound nice, especially not for B2B.

Customers won't trust the message and likely can't use them in court, and they themselves must surely know they're creating expectations that they can't guarantee to meet.

[1] https://www.salesforce.com/company/legal

Re: Heroku CI and Review App Secrets Compromised

#28

Post by gault8121 »

hkhanna wrote: post #18

I spent the last two days migrating my company to Render from Heroku, and now I'm glad I did. Render is a little rough around the edges; Heroku is far more polished. But it's probably to Render's credit that, in my opinion, the most annoying thing about Render is that it's impossible to google about Render because "render" is such a common word in the tech world! Their support is good and responsive, and the develope…

How did the pricing compare? What was the Render server needed to match what you were using with the Heroku Dyno? I run a high-traffic nonprofit edtech app that runs on 3-5 Heroku L Dynos, and I'm curious how well Render will perform at this level.

Re: Heroku CI and Review App Secrets Compromised

#29

Post by heartbreak »

Ozzie_osman wrote: post #24
heartbreak wrote: post #22

I completely stopped getting their update emails when I deleted all of my running apps. This is the second one I've seen on HN that I haven't received (though I received the others). Is the impact limited to specific customer accounts, or are they just not updating me anymore?

I think it's specific to apps with Review Apps or Heroku CI (specifically the Config Vars). If you didn't have those, based on this email, you may not be impacted.

I had both of those, and I had config vars for my pipeline apps.

Re: Heroku CI and Review App Secrets Compromised

#30

Post by ezekg »

hthrowaway5 wrote: post #9
colesantiago wrote: post #6

Earlier quoted context omitted.

I would like to move but there are really no good alternatives that are even close to Heroku.

Well hopefully once it's gone the competition will be able to get more market share to build quality product. Heroku has been starving the entire ecosystem for years. I don't have experience with any other PaaS's so I can't recommend one, but what you say is what I commonly hear.

Heroku hasn’t been starving the ecosystem. They simply haven’t had real competition on their caliber of (zero-)devops.
Post reply on HN