Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plans to Re-enable the GitHub Integration

blog.heroku.com

Post reply on HN
Print view View original

21–30 of 40 posts

Re: Plans to Re-enable the GitHub Integration

#21

Post by danmur »

abathur wrote: post #12
wlll wrote: post #6

I'd still love to get a response to the comment I made on my submission ( https://news.ycombinator.com/item?id=31450100 ) > I'd love to hear from someone at GitHub (anonymously or not) what they've done to be satisfied with action Heroku have taken that would allow the integration to be turned back on. My confidence in Heroku to give me accurate information on this is low. As far as I can tell from Heroku's communica…

It's nitpick, but I'll note that it follows that you wouldn't know if the attacker has access if you don't know how they gained it.

They could use the access again without revealing how they got it. Double nitpick!

Re: Plans to Re-enable the GitHub Integration

#23

Post by tr1ll10nb1ll »

jrochkind1 wrote: post #9

> Currently, when you authenticate with GitHub using OAuth, we request repo scope… As GitHub OAuth integration is designed, it provides us with greater access than we need to get the integration working. > In an effort to improve the security model of the integration, we are exploring additional enhancements in partnership with GitHub… Github permissions possibilities continually confuse me, but integrations are alwa…

Currently facing issues with this. I'm having to ask for more permissions than I need. For instance, to access:

  read:org
(need this to list all repos of an org user is in/has created), I need the-

  admin:org
scope which gives me access to, "fully manage the organization and its teams, projects, and memberships."

So yes, definitely not fine-grained permissions I'd say. Useful in recklessly adding more features just because you have access to more data tho haha.

Re: Plans to Re-enable the GitHub Integration

#24

Post by rurban »

ChrisArchitect wrote: post #2

957 hours. Pretty crazy. Can't think of another 'outage' with that kind of length on it in awhile or ever.

Only the github connect was broken, automatic deploy. Just push to heroku also, when you push to github.

I just re-enabled the Github connect, re-enabled Automatic Deploy, and removed the `git push heroku` line. 1min.

Re: Plans to Re-enable the GitHub Integration

#25

Post by spondyl »

As someone who works at a company that used Heroku (I shut down our relatively dormant account) and Travis CI, this was a fun exercise.

This is not exactly related to the topic but in the course of this wider fiasco, we actually uncovered a bug in Github's audit logging.

The Travis CI app was removed at an org level by a Travis employee in the Middle East and to my knowledge, this wasn't publicised in advance so at first glance, it seemed kind of concerned.

Anyway, that org level event didn't actually propogate up to the enterprise/umbrella level. That is, you can have an umbrella consisting of multiple Github orgs and the audit logs are supposed to roll up into the umbrella audit log.

Anyway, we got confirmation a couple of days ago that it should be fixed now but worth a note if you used Github audit logs to respond to the Heroku incident or the Travis CI one

Re: Plans to Re-enable the GitHub Integration

#26

Post by yowlingcat »

We were already moving off of Heroku anyways and this just accelerated it. Sad to see what was once a giant (really two giants, if you consider the Heroku + GH integration) fall.

I wonder what the real root cause is, organizationally? Is it corporate apathy as Heroku was swallowed up by Salesforce, and GitHub by Microsoft, or something else? I wish I had a bird's eye view inside the org. For now though, I guess all I can do is move the workload to AWS.

Re: Plans to Re-enable the GitHub Integration

#27

Post by nicoburns »

rurban wrote: post #24
ChrisArchitect wrote: post #2

957 hours. Pretty crazy. Can't think of another 'outage' with that kind of length on it in awhile or ever.

Only the github connect was broken, automatic deploy. Just push to heroku also, when you push to github. I just re-enabled the Github connect, re-enabled Automatic Deploy, and removed the `git push heroku` line. 1min.

Sure, but that means deploying was broken for a large number of people, and that they had to spend a non-trivial amount of time setting up an alternative deployment method. For us it wasn't too bad as we already had external CI pipelines (but it still took me most of a day to sort it out). But if you were using heroku for CI then it would have been a much bigger issue.

Re: Plans to Re-enable the GitHub Integration

#28

Post by nicoburns »

yowlingcat wrote: post #26

We were already moving off of Heroku anyways and this just accelerated it. Sad to see what was once a giant (really two giants, if you consider the Heroku + GH integration) fall. I wonder what the real root cause is, organizationally? Is it corporate apathy as Heroku was swallowed up by Salesforce, and GitHub by Microsoft, or something else? I wish I had a bird's eye view inside the org. For now though, I guess all I…

It's a Heroku issue. Salesforce has basically gutted the team, and put a freeze on new development (source: previous HN threads). Github is just fine.

Re: Plans to Re-enable the GitHub Integration

#29

Post by __alexs »

tflinton wrote: post #3

I'm actually impressed that Heroku despite so much backlash refused to enable it until they were certain it was secure. Even if it took forever and no doubt probably lost them significant customers. My armchair guess is whatever method someone used to gain access more than likely took an architectural change to fix.

It's not entirely clear that they do know it's secure given they don't seem to know how the attacker gained access in the first place.
Post reply on HN