Why am I hearing about this on checks the fucking date on May 5th instead of, like, month ago.
I first received word about this on 4/15 via an email from Salesforce.
[deleted]
Heroku Security Notification
31–40 of 162 posts
Re: Heroku Security Notification
#32Always interesting to me with events like this that the actions or intentions of the "threat actor" are never discussed. The conversation is always finding tiny holes in the victim's systems and admonishing them for not being prepared.
Re: Heroku Security Notification
#33What are some good Heroku alternatives these days?
Cloud 66
Re: Heroku Security Notification
#34Why am I hearing about this on checks the fucking date on May 5th instead of, like, month ago.
I first received word about this on 4/15 via an email from Salesforce.
Salesforce informed you that their entire DB was compromised, and not just the Github OAuth tokens, as they've been saying for weeks? The first indication that anything except a Github specific DB was compromised was Tuesday, when they started telling people that seemingly-all non-DB non-addon credentials were going to roll.
Re: Heroku Security Notification
#35I reset my password and then closed my Heroku account today. What a sad end for something that was once a model for software deployment and developer experience.
Re: Heroku Security Notification
#36What are some good Heroku alternatives these days?
Aptible (though geared more towards Healthcare/Compliance space). ^ Note: I use to work for Aptible. Great company. Great people. Now working for one of their spin outs.
This is super cool. I think you just saved me a massive headache, as I plan to roll out a healthcare app with PHI in the next few months.
Re: Heroku Security Notification
#37"a Heroku database" was what was known as core-db internally for the longest time. I'm not sure if still the case or not today. But at one point was the source of everything for Heroku. Over time things were moved out, so this isn't an everything that exists has been leaked, but it is not a guarantee that attacker didn't move from one area to another. As someone with some apps on Heroku, having worked there, but no k…
I feel for the team working on this at this time. I hope this doesn't end up accelerating the culling off of Heroku by Salesforce. One of the smartest and nicest bunch of folks I've worked with.
Re: Heroku Security Notification
#38Earlier quoted context omitted.
We moved basically everything but username into an entirely different db, went so far as to hash the username column so we don’t even know what’s it is until you log in.
> hash the username column Is this giving you any real security benefit? (I'd assume the usernames are indexed elsewhere and that it's a reasonable assumption that whoever gains access to this hashed data has access to the username list as well, making a lookup trivial - or are these not safe assumptions?)
Not GP, but one architecture where there would be a difference is there's a distinct identity provider, responsible solely for exchanging the user's long-lived username/password credentials for a short-lived ticket.
Re: Heroku Security Notification
#39Why not just say hacker ? Know we are on hacker news and hence it is semantically not exactly right. But threat actor … sound more like threaten actor. Just a movie star or drama queen. If one say Heroku was hacked or just sales force … I know one want to manage but somehow the title is not exact right. Too pr.
Threat actor is industry standard terminology for a malevolent or blackhat brand of hacker.
Not all hackers are threat actors.
Re: Heroku Security Notification
#40"a Heroku database" was what was known as core-db internally for the longest time. I'm not sure if still the case or not today. But at one point was the source of everything for Heroku. Over time things were moved out, so this isn't an everything that exists has been leaked, but it is not a guarantee that attacker didn't move from one area to another. As someone with some apps on Heroku, having worked there, but no k…
I feel for the team working on this at this time. I hope this doesn't end up accelerating the culling off of Heroku by Salesforce. One of the smartest and nicest bunch of folks I've worked with.
Completely agree, heart goes out to the team. No harsh judgement of all the engineering team there, not a fun situation and hope they know a lot of folks in their corner.