Slightly off-topic, but can anyone tell me how you’d know that your database has been accessed by a threat actor? Should I be periodically reviewing all my logs for something unusual?
Heroku CI and Review App Secrets Compromised
51–60 of 98 posts
Re: Heroku CI and Review App Secrets Compromised
#52Still havent had any notification on this. A+ for Heroku
Re: Heroku CI and Review App Secrets Compromised
#53Slightly off-topic, but can anyone tell me how you’d know that your database has been accessed by a threat actor? Should I be periodically reviewing all my logs for something unusual?
Yep. Quick and dirty you could alert on large or slow queries, and check the logs periodically. I know it’s probably not effective but I grep logs and watch the terminal looking for aberrant shapes. I believe AWS offers a ML solution to watch your infra and alert for things that are out of the usual, and I’m sure (haven’t built it, but talked to people that worked in the systems) the big companies have sophisticated systems looking for threats that use everything above and far more.
Re: Heroku CI and Review App Secrets Compromised
#54I spent the last two days migrating my company to Render from Heroku, and now I'm glad I did. Render is a little rough around the edges; Heroku is far more polished. But it's probably to Render's credit that, in my opinion, the most annoying thing about Render is that it's impossible to google about Render because "render" is such a common word in the tech world! Their support is good and responsive, and the develope…
I don't use Heroku, nor Render, and I definitely think anyone using Heroku should be moving out, but...
Do you have any evidence Render actually takes security seriously?
Not shitting on their platform, I actually never used it, I just think as an industry we should be way past the point we trust platforms by default.
Re: Heroku CI and Review App Secrets Compromised
#5511 days ago they said "While we confirmed that the threat actor had access to encrypted Heroku customer secrets stored in config var, the secrets are encrypted at rest and the threat actor did not access the encryption key necessary to decrypt config var secrets." I guess that was a lie?!
the subsequent blog post (https://blog.heroku.com/we-heard-your-feedback) says:
> Additionally, we have no evidence that the attacker has accessed any customer accounts or decrypted customers’ environment variables.
which, as pointed out in its HN thread, means "we now know they got access to encrypted vars, and we don't know yet if they could have decrypted them." in BS-speak.
The title "We've Heard Your Feedback" is also a red herring, usually means "we know we fucked up bad and we still have no idea of the whole impact of the breach".
Re: Heroku CI and Review App Secrets Compromised
#56Earlier quoted context omitted.
(Render founder) Thank you for the support. You might have shared this with our support engineers already but I'd love to hear about what you missed from Heroku (email in profile). We're building Render for the very long term and every bit of feedback helps, even if we can't get to it right away.
The bit about the unfortunate name of the product should be taken more seriously. I understand you got that sexy .com domain, and you are here for the long run, but it is currently doing a disservice. My 2c :)
Not sure I agree with this, hear me out please :-)
People who don’t know about Render won’t be googling “render” - instead they’ll be googling something else (along the lines of what render offers), and then perhaps discover render in the results.
And of course people who know about Render won’t ever need to google it, because of that “sexy .com” :-)
Edit: perhaps you meant googling about Render’s features/docs/how-tos? Granted this might be trickier!
Re: Heroku CI and Review App Secrets Compromised
#57I spent the last two days migrating my company to Render from Heroku, and now I'm glad I did. Render is a little rough around the edges; Heroku is far more polished. But it's probably to Render's credit that, in my opinion, the most annoying thing about Render is that it's impossible to google about Render because "render" is such a common word in the tech world! Their support is good and responsive, and the develope…
I don't use Heroku, nor Render, and I definitely think anyone using Heroku should be moving out, but... Do you have any evidence Render actually takes security seriously? Not shitting on their platform, I actually never used it, I just think as an industry we should be way past the point we trust platforms by default.
I asked about this too. Everyone meme'ing these alt platforms essentially assumes they are safer than Heroku by virtue of the fact that Heroku had a pretty severe incident. I haven't actually seen these platforms prove that they're safer than Heroku, they could be as bad or worse in security.
Re: Heroku CI and Review App Secrets Compromised
#58Earlier quoted context omitted.
The bit about the unfortunate name of the product should be taken more seriously. I understand you got that sexy .com domain, and you are here for the long run, but it is currently doing a disservice. My 2c :)
Not sure I agree with this, hear me out please :-) People who don’t know about Render won’t be googling “render” - instead they’ll be googling something else (along the lines of what render offers), and then perhaps discover render in the results. And of course people who know about Render won’t ever need to google it, because of that “sexy .com” :-) Edit: perhaps you meant googling about Render’s features/docs/how-t…
I'm almost certain they were talking about googling docs etc as mentioned in your edit. That would definitely be my concern.
Re: Heroku CI and Review App Secrets Compromised
#59Earlier quoted context omitted.
> At Salesforce, we understand that the confidentiality, integrity, and availability of your data is vital to your business [...] Hey Bob, why didn't you tell your customers a month ago to rotate their creds just to be safe? This is flat out insulting.
> At salesforce.com, inc., trust is our #1 value Their legal pages[1] are filled to the brim with those ridiculous statements. I never understood why they'd even bother making it sound nice, especially not for B2B. Customers won't trust the message and likely can't use them in court, and they themselves must surely know they're creating expectations that they can't guarantee to meet. [1] https://www.salesforce.com/co…
Regarding values I like to ask myself if another company would defend the opposite for smelling emptiness.
Re: Heroku CI and Review App Secrets Compromised
#60Earlier quoted context omitted.
> At Salesforce, we understand that the confidentiality, integrity, and availability of your data is vital to your business [...] Hey Bob, why didn't you tell your customers a month ago to rotate their creds just to be safe? This is flat out insulting.
What's more - the public status page of this security incident ( https://status.heroku.com/incidents/2413 ) doesn't mention that these secrets were compromised. They chose to send this notification privately instead.
But… “We value transparency…”
Give me strength.