Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heroku Security Notification

status.heroku.com

Post reply on HN
Print view View original

131–140 of 162 posts

Re: Heroku Security Notification

#131

Post by mathstuf »

wlll wrote: post #101
photon12 wrote: post #62

There's going to be a question about the expected probability of this across cloud service providers. I've done security work for multiple cloud service providers and know a lot of people in the industry. I'm not really privy to give details. I can say: dev teams face limits on what they can build securely, platform teams face limits on what secure by default and monitoring features they have time to implement, secur…

Unrelated to your main point, "I'm not really privy to give details.", that's not how you use privy. If you have the details but aren't allowed to share them then you are privy to the details, but you can't share them. Privy means "sharing in the knowledge of (something secret or private)", but it has nothing to do with sharing that knowledge with others .

The phrase to use would be "I'm not at liberty to give details".

Re: Heroku Security Notification

#132

Post by anurag »

samwillis wrote: post #68

Well, it only seems to be getting worse on this one. I’m keen to get off Heroku, but waiting for one of the newer alternatives (Render/Fly+others) to implement WAL point in time restore for Postgres. It’s the only thing keeping me on Heroku now, but is indispensable. Anyone here from them have any update on when we could see that feature made available?

We are actively working on Postgres HA and PITR at Render and hope to have them both available this summer.

Re: Heroku Security Notification

#133

Post by anurag »

sleepyhead wrote: post #109
henryaj wrote: post #75

Obviously Heroku have handled this horribly - but are any small startups out there considering replatforming? Still seems like a lot of hassle and the competition I've tried (Cloud66, excid3's thing) haven't been as good.

What was the problem with Cloud66? I looked at Render but they move data out of the chosen region (so out of EU) and that is a huge issue for our clients. They also proxy through Cloudflare which is another big problem when you are dealing with sensitive data.

Re: Render + Cloudflare, all data is encrypted all the way to Render. What is the specific issue you're referring to?

Re: Heroku Security Notification

#134

Post by anyfactor »

I have seen nothing but bad news about Heroku recently. Albeit nothing provides that much ease to use on a free or affordable tier when you have minimum computing demands. I use it as my fundamental cloud provider for proof of concept stuff, so does many people.

Salesforce is doing a terrible job managing this lucrative platform. I have no idea why muck up a good service like that. They have some plugins and a postgres connector but the drive to innovate, the drive to even care stops there. All these news act as a reminder that I should move my code to a "real" cloud provider.

Re: Heroku Security Notification

#135

Post by Rastonbury »

nameless912 wrote: post #111
adrr wrote: post #106

Earlier quoted context omitted.

Because Heroku/Salesforce doesn't have real security. Requiring special characters in passwords and sending out emails that have http and not https links to a password reset page. Their security is a joke.

As a former Herokai, let me color this a bit: Heroku _used_ to have their own security team which was quite good and had some scary talented people on it. However, over the last 3 years or so Salesforce has been forcing Heroku to adopt Salesforce's operations practices, and this has not only wrecked productivity but completely destroyed morale and caused many, many of those talented people to quit. I for one decided…

At this point, I'm not sure why SFDC even bought Heroku.. Is there major overlap between CRM users/buyer (salespeople) and Heroku's who are mainly devs, hobbyists and startups (i'm guessing)? Surely they didn't try to buy hero to compete with the big 3 cloud providers?

Re: Heroku Security Notification

#136

Post by lovelearning »

sfdcsecthrow wrote: post #125
lovelearning wrote: post #49

> On April 7, 2022, a threat actor obtained access...GitHub identified the activity on April 12, 2022, and notified Salesforce on April 13, 2022, at which time we began our investigation. Can some experienced security professionals weigh in on the cultural and organizational factors that allow this kind of major breach to go unnoticed for a week, that too in a reputed company like Heroku? I'm not asking this rhetoric…

Throwaway for obvious reasons. But in my experience Salesforce security org is plagued with incompetent leaders who chase arbitrary metrics that does not improve security at all. At one point in time, security team at Salesforce was stellar and did some awesome work. Dont get me wrong, there are many many smart security engineers still around but their population has been dwindling. This all started when a bunch of n…

Thanks for the insight!

Re: Heroku Security Notification

#137

Post by nameless912 »

Rastonbury wrote: post #135
nameless912 wrote: post #111

Earlier quoted context omitted.

As a former Herokai, let me color this a bit: Heroku _used_ to have their own security team which was quite good and had some scary talented people on it. However, over the last 3 years or so Salesforce has been forcing Heroku to adopt Salesforce's operations practices, and this has not only wrecked productivity but completely destroyed morale and caused many, many of those talented people to quit. I for one decided…

At this point, I'm not sure why SFDC even bought Heroku.. Is there major overlap between CRM users/buyer (salespeople) and Heroku's who are mainly devs, hobbyists and startups (i'm guessing)? Surely they didn't try to buy hero to compete with the big 3 cloud providers?

Welcome to the existential question of Heroku from the inside :) No one knew what the point of the product was anymore. My vibe is that SFDC's goal was to use Heroku as their cloud provider for everything, and when that didn't work (more due to lack of focus than technical issues), they tried to shoehorn Heroku into the Salesforce platform as a tack on feature. It was all very weird, no one knew what we were doing, and everyone was upset about it. I originally joined the org because I was really excited to help the early startup/small business/hobbyist/student sector, and SFDC writ large just did not care about those customers IMO.

Re: Heroku Security Notification

#138

Post by bobx11 »

jeromegv wrote: post #124
srinathkrishna wrote: post #37

Earlier quoted context omitted.

I feel for the team working on this at this time. I hope this doesn't end up accelerating the culling off of Heroku by Salesforce. One of the smartest and nicest bunch of folks I've worked with.

Heroku is heavily connected with Salesforce now with Heroku Connect, I doubt this is part of the plan.

There was already a plan by salesforce to kill it and make it into salesforce functions. Someone else here called it project periwinkle.

Re: Heroku Security Notification

#139

Post by srinathkrishna »

sfdcsecthrow wrote: post #125
lovelearning wrote: post #49

> On April 7, 2022, a threat actor obtained access...GitHub identified the activity on April 12, 2022, and notified Salesforce on April 13, 2022, at which time we began our investigation. Can some experienced security professionals weigh in on the cultural and organizational factors that allow this kind of major breach to go unnoticed for a week, that too in a reputed company like Heroku? I'm not asking this rhetoric…

Throwaway for obvious reasons. But in my experience Salesforce security org is plagued with incompetent leaders who chase arbitrary metrics that does not improve security at all. At one point in time, security team at Salesforce was stellar and did some awesome work. Dont get me wrong, there are many many smart security engineers still around but their population has been dwindling. This all started when a bunch of n…

I do remember the whole debacle that happened at DEFCON and people got fired for presenting something on stage.

Agreed, there's a lot of interesting stuff that came out of the Security (or related orgs) at Salesforce. Red team tools, chaos tools and JA3 which we use at my current work as well for SSL/TLS fingerprinting.

Re: Heroku Security Notification

#140

Post by ryanmcbride »

jeromegv wrote: post #124
srinathkrishna wrote: post #37

Earlier quoted context omitted.

I feel for the team working on this at this time. I hope this doesn't end up accelerating the culling off of Heroku by Salesforce. One of the smartest and nicest bunch of folks I've worked with.

Heroku is heavily connected with Salesforce now with Heroku Connect, I doubt this is part of the plan.

Salesforce has been holding heroku further and further out over a ledge they're definitely not planning on supporting it for much longer.

Edit: I only had one project left on heroku and I migrated it to Render a few months ago.

Post reply on HN