Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heroku CI and Review App Secrets Compromised

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 98 posts

Re: Heroku CI and Review App Secrets Compromised

#41

Post by anurag »

ojame wrote: post #23
eropple wrote: post #16

Earlier quoted context omitted.

YMMV, but I quite like Render for the sorts of things I'd have used Heroku for ~5 years ago. Plenty of folks I respect absolutely love fly.io--I have less hands-on experience there, but they've got a fantastic crew, too.

One thing that I have really come to like with Heroku is the pipeline. fly.io doesn't have one (I don't think?) and render isn't the same; it rebuilds for different stages and there's no concept of 'promoting' the same slug.

We're planning to release the notion of build promotion on Render late summer/early fall.

Re: Heroku CI and Review App Secrets Compromised

#42

Post by yeskia »

hthrowaway5 wrote: post #17
bradleybuda wrote: post #5

Text of the email: At Salesforce, we understand that the confidentiality, integrity, and availability of your data is vital to your business, and we take the protection of your data very seriously. We value transparency and wanted to notify you of an issue affecting your account. Based on current progress, we plan to complete our investigation by May 30, 2022. We are continuing with remediation activities and plan to…

> At Salesforce, we understand that the confidentiality, integrity, and availability of your data is vital to your business [...] Hey Bob, why didn't you tell your customers a month ago to rotate their creds just to be safe? This is flat out insulting.

What's more - the public status page of this security incident (https://status.heroku.com/incidents/2413) doesn't mention that these secrets were compromised. They chose to send this notification privately instead.

Re: Heroku CI and Review App Secrets Compromised

#43

Post by bigDinosaur »

himeexcelanta wrote: post #3
mepiethree wrote: post #2

11 days ago they said "While we confirmed that the threat actor had access to encrypted Heroku customer secrets stored in config var, the secrets are encrypted at rest and the threat actor did not access the encryption key necessary to decrypt config var secrets." I guess that was a lie?!

HN with the quality security advice, with all the recommendations to rotate config vars just to be safe.

I can't think of a reason to not rotate credentials and variables the second you see a security incident of this scale even when it was in the very earliest stages. Better safe than sorry, and also a good time to review just how easy it is to update all the variables (is it automated & scripted, where are they stored and generated, etc.)

Re: Heroku CI and Review App Secrets Compromised

#44

Post by Rastonbury »

hkhanna wrote: post #18

I spent the last two days migrating my company to Render from Heroku, and now I'm glad I did. Render is a little rough around the edges; Heroku is far more polished. But it's probably to Render's credit that, in my opinion, the most annoying thing about Render is that it's impossible to google about Render because "render" is such a common word in the tech world! Their support is good and responsive, and the develope…

Mind sharing why you chose Render over other competitors? Considering the same

Re: Heroku CI and Review App Secrets Compromised

#45

Post by Rastonbury »

heartbreak wrote: post #35
rychco wrote: post #33

Earlier quoted context omitted.

I also intend to deploy some new services on render (having previously used Heroku). I was debating between render & fly, which I've also had my eye on and may still try for something else in the future.

I think Fly will be great, but it's not there yet. I migrated to Render.

I am considering moving, could you share why Fly wasn't adequate for you?

Re: Heroku CI and Review App Secrets Compromised

#46

Post by jchw »

hthrowaway5 wrote: post #17
bradleybuda wrote: post #5

Text of the email: At Salesforce, we understand that the confidentiality, integrity, and availability of your data is vital to your business, and we take the protection of your data very seriously. We value transparency and wanted to notify you of an issue affecting your account. Based on current progress, we plan to complete our investigation by May 30, 2022. We are continuing with remediation activities and plan to…

> At Salesforce, we understand that the confidentiality, integrity, and availability of your data is vital to your business [...] Hey Bob, why didn't you tell your customers a month ago to rotate their creds just to be safe? This is flat out insulting.

Is Salesforce potentially in violation of EU law regarding data breach notifications? It seems like they either knew the scope of the breach was likely to be much bigger (based on the fact that the investigation was ongoing) or flat out had evidence that it was already. But that said, I don’t know how that all works. So I’m genuinely curious if there’s a possibility this is illicit.

Re: Heroku CI and Review App Secrets Compromised

#47

Post by plant-ian »

colesantiago wrote: post #6
hthrowaway5 wrote: post #4

Yep, they outright lied about env vars. Incredible. It pains me to see even occasional defenders of Heroku. They're not the company they were 10 years ago. They've been gutted and left for dead years ago but the product was so good nobody noticed until now. They're not to be trusted as your platform. They simply don't have anywhere close to the manpower required to run such a platform. This was a when not if situatio…

I would like to move but there are really no good alternatives that are even close to Heroku.

I agree although I literally just started using heroku again after many years. I haven't seen alternatives that support the idea of multiple buildpacks. Which seems sort of a must have for any non-js backend because a frontend js stack is going to exist no matter what.

Re: Heroku CI and Review App Secrets Compromised

#48

Post by anurag »

plant-ian wrote: post #47
colesantiago wrote: post #6

Earlier quoted context omitted.

I would like to move but there are really no good alternatives that are even close to Heroku.

I agree although I literally just started using heroku again after many years. I haven't seen alternatives that support the idea of multiple buildpacks. Which seems sort of a must have for any non-js backend because a frontend js stack is going to exist no matter what.

All of Render's native environments include Node by default.

Re: Heroku CI and Review App Secrets Compromised

#49

Post by jacobsenscott »

vmception wrote: post #12

oh shit. I'm surprised we haven't heard about major services getting hacked to oblivion right now, so much is stored in environment variables are there any mystery hacks occurring yet? is this database known to have been spread anywhere?

Hopefully most people didn't have production creds stored in pipeline config. These vars were for review apps and ci.

Re: Heroku CI and Review App Secrets Compromised

#50

Post by lebaux »

anurag wrote: post #39
hkhanna wrote: post #18

I spent the last two days migrating my company to Render from Heroku, and now I'm glad I did. Render is a little rough around the edges; Heroku is far more polished. But it's probably to Render's credit that, in my opinion, the most annoying thing about Render is that it's impossible to google about Render because "render" is such a common word in the tech world! Their support is good and responsive, and the develope…

(Render founder) Thank you for the support. You might have shared this with our support engineers already but I'd love to hear about what you missed from Heroku (email in profile). We're building Render for the very long term and every bit of feedback helps, even if we can't get to it right away.

The bit about the unfortunate name of the product should be taken more seriously. I understand you got that sexy .com domain, and you are here for the long run, but it is currently doing a disservice. My 2c :)
Post reply on HN