141–150 of 162 posts
Earlier quoted context omitted.
Render.com
Stuff like this worries me - https://community.render.com/t/genuine-question-why-does-ren...
Why am I hearing about this on checks the fucking date on May 5th instead of, like, month ago.
https://www.heavybit.com/library/video/every-minute-counts-c...
A lot has changed at Heroku in the past 8 years since I left, particularly in the direction of being subsumed into the greater Salesforce org. My working assumption is that everything left there is being done "the Salesforce way" at this point. Take that to mean what you will, but it seems pretty clear we're long past the days of openly communicating with customers as quickly as you have relevant/important information to share with them.
Earlier quoted context omitted.
Salesforce has been unable to attract or retain security talent. When they acquire a company, they close down the department that does security for that company - and then move everyone into the Salesforce Trust team. Unlike engineering who they typically leave alone (unless they're integrating or rebranding). In doing so, they typically lose everyone that setup the SIEM and run the SecOps center. Everything "securit…
>bad wrap https://www.merriam-webster.com/words-at-play/usage-bad-rap-...
Earlier quoted context omitted.
What was the problem with Cloud66? I looked at Render but they move data out of the chosen region (so out of EU) and that is a huge issue for our clients. They also proxy through Cloudflare which is another big problem when you are dealing with sensitive data.
Re: Render + Cloudflare, all data is encrypted all the way to Render. What is the specific issue you're referring to?
However some of our clients (for example in health or financial industry) would be concerned that data is proxied through a third-party, doesn't matter if it is encrypted (also it's unclear to me how keys etc are managed and what data Cloudflare can access).
btw: Render looks awesome but at the current offering is it not an option for us.
What are some good Heroku alternatives these days?
Lots of awesome products here, I'd argue that only replit is a true 10x change from the Heroku innovations in terms of providing a next-gen developer experience.
I'm the cofounder of a new company called Coherence, that we think creates a new direction and offers a better platform for the next leap forward. By integrating from dev to prod and capturing the whole SDLC, as well as by operating in your own cloud, we're focused on delivering the best developer experience possible, without compromising anywhere else. Check us out at https://www.withcoherence.com. We're in an early closed beta so not yet a fit for all teams, but feedback is welcome!
Earlier quoted context omitted.
We moved basically everything but username into an entirely different db, went so far as to hash the username column so we don’t even know what’s it is until you log in.
> hash the username column Is this giving you any real security benefit? (I'd assume the usernames are indexed elsewhere and that it's a reasonable assumption that whoever gains access to this hashed data has access to the username list as well, making a lookup trivial - or are these not safe assumptions?)
There's going to be a question about the expected probability of this across cloud service providers. I've done security work for multiple cloud service providers and know a lot of people in the industry. I'm not really privy to give details. I can say: dev teams face limits on what they can build securely, platform teams face limits on what secure by default and monitoring features they have time to implement, secur…
> dev teams face limits on what they can build securely, platform teams face limits on what secure by default and monitoring features they have time to implement, security operations teams have a lot of data points to look at, and in theory even changes in personnel in a couple of teams can have an impact on the threat posture for a given set of a company.
I couldn't agree more. It's too bad, because I believe most companies should be solving this by building on a battle-tested platform that provides a safe path for devs. In theory, platforms like Heroku improve cloud security by reducing margin for error. In practice though (as we're seeing), these platforms can introduce new security vulnerabilities in the layer they introduce on top of IaaS.
I also very much appreciate your comment about having a better way to evaluate the security of platforms without relying on public breach reports, or implicitly trusting what platforms say. I think the best thing is for platforms to be 100% transparent in how they implement security, namely by:
1. Running alongside IaaS services instead of layering a black box on top of them (coordinating, not fully abstracting)
2. Providing clear accountability for security defaults: every security default enforced by the platform should be represented in a validation that end users can view (if not alter)
Earlier quoted context omitted.
Re: Render + Cloudflare, all data is encrypted all the way to Render. What is the specific issue you're referring to?
The main problem is that data is transferred out of EU, it is simply not acceptable for a EU company regardless of any DPA (history have shown here that any such DPA would be invalid in the near future). However some of our clients (for example in health or financial industry) would be concerned that data is proxied through a third-party, doesn't matter if it is encrypted (also it's unclear to me how keys etc are man…
Earlier quoted context omitted.
That email made it clear that Heroku lacks fundamental knowledge about security. I’m sure they lost some enterprise customers, I know I don’t open accounts on websites with silly password complexity requirements.
Google allowed 6 character passwords for a while, and didn't expire them when they increased minimum to 8 for google workspace accounts. This has been fantastic, as users can remember their password forever even if its higher complexity (google does a password strength eval). No rotations either. I'm pretty confident google will pick-up someone trying to brute force a 6 character password. That google will notice con…