Heroku Security Notification

Post by dev_tty01 » Sat, May 07, 2022, 5:30 PM UTC

heartbreak wrote: post #156

dev_tty01 wrote: post #155

Earlier quoted context omitted.

Which credentials are you referring to? They reported the loss of OAuth tokens on April 15. What am I missing? https://status.heroku.com/incidents/2413 "On April 13, 2022, Salesforce Security was notified by GitHub that a subset of Heroku’s GitHub private repositories, including some source code, was downloaded by a threat actor on April 9, 2022. Based on Salesforce’s initial investigation, it appears that unauthoriz…

You’re missing the 5/3 update about username and password credentials. > our investigation also revealed that the same compromised token was leveraged to gain access to a database and exfiltrate the hashed and salted passwords for customers’ user accounts. From the link we are commenting on.

Got it. Thanks.

Post by josevalerio » Sun, May 08, 2022, 2:57 AM UTC

ojame wrote: post #84

staindk wrote: post #82

Earlier quoted context omitted.

I'd maybe use this as an opportunity to prioritise moving everything over to AWS. I'm sure for some it may be an unwieldy amount of work but for others (depending on tech stack etc.) it ought to be fairly doable. In the long run it'll save money too.

I’m interested in peoples experience with this and if it’s relatively true. We (like many others I assume) pay more for Heroku than AWS as it allows us to “outsource” our dev ops. We are a small team (sub 15) with a decent sized, decade old app. We’ve had it on AWS before (and used platforms like BuildKite) but both required much more overhead (in terms of employee salary). Anecdotally I’ve heard the same from friend…

AWS isn’t that bad when you use IaC like CDK. Clicking around in the console and trying to reproduce those steps when you have a new project or API is what will kill you

Re: Heroku Security Notification

Re: Heroku Security Notification