Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heroku CI and Review App Secrets Compromised

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 98 posts

Re: Heroku CI and Review App Secrets Compromised

#61

Post by glenngillen »

hthrowaway5 wrote: post #9
colesantiago wrote: post #6

Earlier quoted context omitted.

I would like to move but there are really no good alternatives that are even close to Heroku.

Well hopefully once it's gone the competition will be able to get more market share to build quality product. Heroku has been starving the entire ecosystem for years. I don't have experience with any other PaaS's so I can't recommend one, but what you say is what I commonly hear.

This makes no sense. Heroku have had no competition because nobody has built a better product. They’ve not been starving anyone or anything. Given the biggest and most common complaint most lay against Heroku is that it’s too expensive, if anything the lack of innovation for years has created a huge window for a competitor. And yet here we are. Still.

Re: Heroku CI and Review App Secrets Compromised

#62

Post by imdsm »

glenngillen wrote: post #60
yeskia wrote: post #42

Earlier quoted context omitted.

What's more - the public status page of this security incident ( https://status.heroku.com/incidents/2413 ) doesn't mention that these secrets were compromised. They chose to send this notification privately instead.

But… “We value transparency…” Give me strength.

The true masterstroke though is shutting down Heroku so that the negative press of this doesn't affect it. "What is dead may never die!"

Re: Heroku CI and Review App Secrets Compromised

#63

Post by ryanSrich »

eropple wrote: post #16
colesantiago wrote: post #6

Earlier quoted context omitted.

I would like to move but there are really no good alternatives that are even close to Heroku.

YMMV, but I quite like Render for the sorts of things I'd have used Heroku for ~5 years ago. Plenty of folks I respect absolutely love fly.io--I have less hands-on experience there, but they've got a fantastic crew, too.

Who are you using for a database provider? Render doesn’t have auto backups and HA Postgres right? Those are table stakes for me.

Re: Heroku CI and Review App Secrets Compromised

#64

Post by ryanSrich »

oxff wrote: post #37
gault8121 wrote: post #27

Has anyone done a load test comparison for Heroku vs. Render.com? The "Pro Ultra" on Render is $450/month for 32 GB RAM + 8 CPU. The Heroku Performance L Dyno is $500 a month for 14 GB RAM. The Render server seems like a much better offering.

Has anyone done a security review of Heroku alternatives? I see lots of comments about moving there and using them instead of Heroku because of this incident. But that's hardly a justifiable reason alone, since those new platforms are probably worse off in security.

Is render SOC 2 certified? ISO 27001? Those are fairly standard. If they don’t have either it’s going to be a hard time getting any serious business to migrate.

Re: Heroku CI and Review App Secrets Compromised

#65

Post by dbbk »

anurag wrote: post #39
hkhanna wrote: post #18

I spent the last two days migrating my company to Render from Heroku, and now I'm glad I did. Render is a little rough around the edges; Heroku is far more polished. But it's probably to Render's credit that, in my opinion, the most annoying thing about Render is that it's impossible to google about Render because "render" is such a common word in the tech world! Their support is good and responsive, and the develope…

(Render founder) Thank you for the support. You might have shared this with our support engineers already but I'd love to hear about what you missed from Heroku (email in profile). We're building Render for the very long term and every bit of feedback helps, even if we can't get to it right away.

I love the look of everything about Render, except its native lack of PHP support. I really don't want to have to use Docker. Do you have any ETA when that will be available?

Re: Heroku CI and Review App Secrets Compromised

#66

Post by hthrowaway5 »

glenngillen wrote: post #61
hthrowaway5 wrote: post #9

Earlier quoted context omitted.

Well hopefully once it's gone the competition will be able to get more market share to build quality product. Heroku has been starving the entire ecosystem for years. I don't have experience with any other PaaS's so I can't recommend one, but what you say is what I commonly hear.

This makes no sense. Heroku have had no competition because nobody has built a better product. They’ve not been starving anyone or anything. Given the biggest and most common complaint most lay against Heroku is that it’s too expensive, if anything the lack of innovation for years has created a huge window for a competitor. And yet here we are. Still.

tl;dr: Heroku is taking customers away that if competitors had it: they would be able to receive more capital

It's not unlike Google Search. Google Search has atrophied over the years but because it's still the best in the market, it's used by almost everyone. Competition is hard to build because it has to be better than Google Search in order to bother using it.

Heroku competitors have struggled in part because Heroku is a fully featured platform. It's relatively easy to build a platform that ticks a couple of boxes really well but building something that matches Heroku in feature parity is a daunting task. In order for competition to get there they need customers and funding, and funding is way easier to get the more customers come in through the door.

Once Heroku dies (perhaps already since this incident) we'll start to see real competition in this space because their competition will be getting used. The PaaS space needs that oxygen Heroku is taking up.

Re: Heroku CI and Review App Secrets Compromised

#67

Post by duckmysick »

pid-1 wrote: post #54
hkhanna wrote: post #18

I spent the last two days migrating my company to Render from Heroku, and now I'm glad I did. Render is a little rough around the edges; Heroku is far more polished. But it's probably to Render's credit that, in my opinion, the most annoying thing about Render is that it's impossible to google about Render because "render" is such a common word in the tech world! Their support is good and responsive, and the develope…

I don't use Heroku, nor Render, and I definitely think anyone using Heroku should be moving out, but... Do you have any evidence Render actually takes security seriously? Not shitting on their platform, I actually never used it, I just think as an industry we should be way past the point we trust platforms by default.

> I just think as an industry we should be way past the point we trust platforms by default.

That's a great point and I fully agree.

I'm struggling to come up with reliable ways of checking security of the companies I'm not familiar with. It's not like I can rely on their landing page. And they are likely not on the market long enough to see how they responded to past security incidents.

The only thing I can think of is checking how they handle registration and logins - but it's not that strong of a signal anyway. Does anyone have other ideas?

Re: Heroku CI and Review App Secrets Compromised

#68

Post by wlll »

PKop wrote: post #34
wlll wrote: post #31

Earlier quoted context omitted.

What happened?

https://hn.algolia.com/?dateRange=pastMonth&page=0&prefix=fa...

Oh, sorry, I thought the comment was about how the transition was handled poorly. I’m well aware of the slow-motion train crash that is the Heroku incident!

Re: Heroku CI and Review App Secrets Compromised

#69

Post by Jgrubb »

colesantiago wrote: post #6
hthrowaway5 wrote: post #4

Yep, they outright lied about env vars. Incredible. It pains me to see even occasional defenders of Heroku. They're not the company they were 10 years ago. They've been gutted and left for dead years ago but the product was so good nobody noticed until now. They're not to be trusted as your platform. They simply don't have anywhere close to the manpower required to run such a platform. This was a when not if situatio…

I would like to move but there are really no good alternatives that are even close to Heroku.

Take a look at platform.sh

Re: Heroku CI and Review App Secrets Compromised

#70

Post by [deleted] »

oxff wrote: post #37
gault8121 wrote: post #27

Has anyone done a load test comparison for Heroku vs. Render.com? The "Pro Ultra" on Render is $450/month for 32 GB RAM + 8 CPU. The Heroku Performance L Dyno is $500 a month for 14 GB RAM. The Render server seems like a much better offering.

Has anyone done a security review of Heroku alternatives? I see lots of comments about moving there and using them instead of Heroku because of this incident. But that's hardly a justifiable reason alone, since those new platforms are probably worse off in security.

[deleted]
Post reply on HN