Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heroku CI and Review App Secrets Compromised

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 98 posts

Re: Heroku CI and Review App Secrets Compromised

#71

Post by hthrowaway5 »

oxff wrote: post #57
pid-1 wrote: post #54

Earlier quoted context omitted.

I don't use Heroku, nor Render, and I definitely think anyone using Heroku should be moving out, but... Do you have any evidence Render actually takes security seriously? Not shitting on their platform, I actually never used it, I just think as an industry we should be way past the point we trust platforms by default.

I asked about this too. Everyone meme'ing these alt platforms essentially assumes they are safer than Heroku by virtue of the fact that Heroku had a pretty severe incident. I haven't actually seen these platforms prove that they're safer than Heroku, they could be as bad or worse in security.

I wouldn't move off of Heroku because of the incident. I would move off of them because of their response to the incident.

They plainly lied. Responses take weeks and are very incomplete. They have so few people they can't possibly run a secure, stable system anymore. They don't have a plan or backing from sfdc to get back to a solid foundation.

I can't speak to competitors but I can say with certainty that Heroku is simply not an option for you anymore. Whether that means you use another PaaS or fire up an EC2 instance yourself you must move away at this point.

Re: Heroku CI and Review App Secrets Compromised

#72

Post by bmulholland »

pid-1 wrote: post #54
hkhanna wrote: post #18

I spent the last two days migrating my company to Render from Heroku, and now I'm glad I did. Render is a little rough around the edges; Heroku is far more polished. But it's probably to Render's credit that, in my opinion, the most annoying thing about Render is that it's impossible to google about Render because "render" is such a common word in the tech world! Their support is good and responsive, and the develope…

I don't use Heroku, nor Render, and I definitely think anyone using Heroku should be moving out, but... Do you have any evidence Render actually takes security seriously? Not shitting on their platform, I actually never used it, I just think as an industry we should be way past the point we trust platforms by default.

I had to switch from Render to Heroku a year or so ago because Render had no security documentation at all. I asked them about it at the time and was told security docs were perhaps six months out. There's still none, so it's clear that demonstrating security is not something that's a priority.

Re: Heroku CI and Review App Secrets Compromised

#73

Post by itsmeste »

When Salesforce bought Heroku back in 2011, it was pretty clear Heroku would become yet another dead product that once was an absolute great piece of software.

Why? Commercialism.

Founders sell to the highest bidder to make their exit worthwhile for themselves, not caring about the future of the product (and customers).

It's a no-brainer that a commercial company like Salesforce (it's in their name!) doesn't have what it takes to build AAA software, but focuses on maximizing their profit. They drove away their best staff, focused on the wrong features, and are seemingly overwhelmed by maintaining their purchased software, all while probably not even realizing their demise.

We should all come to the agreement that takeovers of fundamental software by incompetent companies should be seen as a hostility towards every current user of said software.

Re: Heroku CI and Review App Secrets Compromised

#74

Post by swat535 »

hthrowaway5 wrote: post #9
colesantiago wrote: post #6

Earlier quoted context omitted.

I would like to move but there are really no good alternatives that are even close to Heroku.

Well hopefully once it's gone the competition will be able to get more market share to build quality product. Heroku has been starving the entire ecosystem for years. I don't have experience with any other PaaS's so I can't recommend one, but what you say is what I commonly hear.

So, just to be clear.

Your solution is: 1. move off to the competition who are offering a subpar service;

2. then wait until they eventually catch up in (how many years? who knows..);

3. then profit?

Heroku is around, because there is no other service that offers the ease and convenience. I looked at Fly.io and Render and they are nowhere close and mature to Heroku at the moment.

For example, here is Fly.io's "Solution" for Redis:

> Setting up Redis requires launching it as a separate app. ..

Or if you want something as commmon as Sidekiq.. have fun messing with configuraiton files: https://fly.io/docs/app-guides/multiple-processes/

Now let's compare this to the Heroku experience:

How to use Redis:

Step 1. Add a Redis addone

Step 2. There is no step 2.

How about Sidekiq?

Step 1. Add a worker

Step 2. Update your Procfile

Step 3. There is no step 3.

Fly.io tells me to "Just Use Bash"..

So while I kind of see where are you coming from, unfortunately all these alternatives fall short. Not to mention that Heroku has hundreds of integrations built-in.

Re: Heroku CI and Review App Secrets Compromised

#75

Post by I_dev_outdoors »

andrewflnr wrote: post #58
herodoturtle wrote: post #56

Earlier quoted context omitted.

Not sure I agree with this, hear me out please :-) People who don’t know about Render won’t be googling “render” - instead they’ll be googling something else (along the lines of what render offers), and then perhaps discover render in the results. And of course people who know about Render won’t ever need to google it, because of that “sexy .com” :-) Edit: perhaps you meant googling about Render’s features/docs/how-t…

I'm almost certain they were talking about googling docs etc as mentioned in your edit. That would definitely be my concern.

I agree with you, that's what they meant. Just like Go is referred to as golang by the community, maybe render can be referred to as rendercloud.

Re: Heroku CI and Review App Secrets Compromised

#76

Post by bslorence »

tarsinge wrote: post #59
krono wrote: post #26

Earlier quoted context omitted.

> At salesforce.com, inc., trust is our #1 value Their legal pages[1] are filled to the brim with those ridiculous statements. I never understood why they'd even bother making it sound nice, especially not for B2B. Customers won't trust the message and likely can't use them in court, and they themselves must surely know they're creating expectations that they can't guarantee to meet. [1] https://www.salesforce.com/co…

Regarding values I like to ask myself if another company would defend the opposite for smelling emptiness.

Reminds me of Jakob Nielsen's rule for writing a good "About" page. If you can insert a "not" into a sentence and get something that no other company would ever put on their own About page, the sentence is worthless.

Re: Heroku CI and Review App Secrets Compromised

#77

Post by hthrowaway5 »

swat535 wrote: post #74
hthrowaway5 wrote: post #9

Earlier quoted context omitted.

Well hopefully once it's gone the competition will be able to get more market share to build quality product. Heroku has been starving the entire ecosystem for years. I don't have experience with any other PaaS's so I can't recommend one, but what you say is what I commonly hear.

So, just to be clear. Your solution is: 1. move off to the competition who are offering a subpar service; 2. then wait until they eventually catch up in (how many years? who knows..); 3. then profit? Heroku is around, because there is no other service that offers the ease and convenience. I looked at Fly.io and Render and they are nowhere close and mature to Heroku at the moment. For example, here is Fly.io's "Soluti…

I'm simply telling you Heroku is not a stable platform that you can trust. It's up to you to figure out what to do. I haven't offered any solutions.

Just because it's a slick product to get going doesn't mean that you can trust it to be a reliable and secure host—or be around for the long-term.

I think it's obvious an ecosystem without a Heroku will help the upstarts. I understand that doesn't help you get a new host today. I'm not telling you to just go to another PaaS and expect them to be the next Heroku in a couple of years—chances are they won't be.

Re: Heroku CI and Review App Secrets Compromised

#78

Post by craigkerstiens »

ryanSrich wrote: post #63
eropple wrote: post #16

Earlier quoted context omitted.

YMMV, but I quite like Render for the sorts of things I'd have used Heroku for ~5 years ago. Plenty of folks I respect absolutely love fly.io--I have less hands-on experience there, but they've got a fantastic crew, too.

Who are you using for a database provider? Render doesn’t have auto backups and HA Postgres right? Those are table stakes for me.

We've had a number of folks migrate over to Crunchy Bridge [1] from Heroku, the only main feature we're missing at this point is dataclips which is coming. We can also help with pretty much no downtime migration even for larger databases. And the team over here is pretty much same team that built the original Heroku Postgres.

[1] https://www.crunchydata.com/products/crunchy-bridge

Re: Heroku CI and Review App Secrets Compromised

#79

Post by alx__ »

itsmeste wrote: post #73

When Salesforce bought Heroku back in 2011, it was pretty clear Heroku would become yet another dead product that once was an absolute great piece of software. Why? Commercialism. Founders sell to the highest bidder to make their exit worthwhile for themselves, not caring about the future of the product (and customers). It's a no-brainer that a commercial company like Salesforce (it's in their name!) doesn't have wha…

> When Salesforce bought Heroku back in 2011, it was pretty clear Heroku would become yet another dead product that once was an absolute great piece of software.

That feels like a angsty-tinted view. I recall the day it happened. The Ruby dev shop I was at was optimistically nervous. As Heroku had been a shiny new thing and only deployed Ruby. Acquisition allowed them to expand and support other languages. They didn't even have pipelines!

https://techcrunch.com/2010/12/08/breaking-salesforce-buys-h...

Re: Heroku CI and Review App Secrets Compromised

#80

Post by anurag »

ryanSrich wrote: post #63
eropple wrote: post #16

Earlier quoted context omitted.

YMMV, but I quite like Render for the sorts of things I'd have used Heroku for ~5 years ago. Plenty of folks I respect absolutely love fly.io--I have less hands-on experience there, but they've got a fantastic crew, too.

Who are you using for a database provider? Render doesn’t have auto backups and HA Postgres right? Those are table stakes for me.

Render has automatic Postgres backups, and you can also click a button to create new backup. We're working on HA (ETA late summer/early fall).
Post reply on HN