Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heroku Security Notification

status.heroku.com

Post reply on HN
Print view View original

71–80 of 123 posts

Re: Heroku Security Notification

#71

Post by gtirloni »

macintux wrote: post #68
samwillis wrote: post #46

Disappointed that the GitHub security log doesn’t show access for personal accounts. Would be rather nice if they temporarily made that available for a short period of time so we can see if any of our repositories have been cloned/downloaded.

I've been disappointed with GitHub's auditing capabilities. I noticed that some members of my team were committing changes to our enterprise repositories with poorly-configured clients, so it was impossible to tell who made the commit or performed the push. I understand that git itself doesn't have any protections against this, but GitHub knows who pushed it; why isn't that metadata available?

GitHub Enterprise has push logs.

https://docs.github.com/en/enterprise-server@3.2/admin/monit...

Re: Heroku Security Notification

#72

Post by macintux »

gtirloni wrote: post #71
macintux wrote: post #68

Earlier quoted context omitted.

I've been disappointed with GitHub's auditing capabilities. I noticed that some members of my team were committing changes to our enterprise repositories with poorly-configured clients, so it was impossible to tell who made the commit or performed the push. I understand that git itself doesn't have any protections against this, but GitHub knows who pushed it; why isn't that metadata available?

GitHub Enterprise has push logs. https://docs.github.com/en/enterprise-server@3.2/admin/monit...

Do you know whether that's available via GitHub proper? I'd like the user identity for commits to be accessible through the API, but last I checked it wasn't.

(Updated for clarification: user identity is available via the API, but only the identity embedded in git itself, not the GitHub authenticated user.)

Re: Heroku Security Notification

#73

Post by anon3949494 »

We're a small org with a github connected to heroku. All of our repos were cloned between April 8 and April 15 with the majority of them having no activity for several years. The audit logs don't show this, you can only see this information in the traffic graphs (/graphs/traffic). If you're seeing cloning of repos that you haven't touched in a while, you've likely been compromised.

Re: Heroku Security Notification

#74

Post by ethbr0 »

whelton wrote: post #69
jrochkind1 wrote: post #63

Earlier quoted context omitted.

For a while now I've been worried about this -- either integrations asking for full read/write access for a service that might seem to need only read. Or maybe worse, integrations asking for access to anything my account has access to, when I only want to grant it to one repo or organization, or only to public repos and not private ones. Whenever I've reached out to inquire/complain about this, I've been told that gi…

I've been looking into this as I'm building similar per resource scoping for conjure.so's API. GitHub has 'OAuth Apps' and 'GitHub Apps' [0]. The former's scopes do not permit such granularity (eg the `repo` scope gives access to all repos of the account [1]). The latter is much more granular, allowing the user to select specific repos to grant permission [2]. The 'GitHub App' owner can see their installations and al…

Ironically, Slack seems to have really homed in on granularity of integration access as a key feature as well.

Which makes sense... but then so many companies don't do that.

Re: Heroku Security Notification

#75

Post by sandstrom »

the_mitsuhiko wrote: post #58
sandstrom wrote: post #51

This is a much bigger problem than Heroku. There are countless SaaS applications asking for full-repo access to Github (all the source code, with write access). - Productboard - Bugsnag - Sentry - Skylight - Percy - CodeTree - Databox There are heaps of others, these are just some on top the of my mind. A ticking supply chain attack waiting to happen, since these companies make themselves into alluring hacking target…

> There are countless SaaS applications asking for full-repo access to Github (all the source code, with write access). Sentry does not request write access to source code. It requests read/write access to issues and read access to source code. You can also see this on the documentation for the GitHub enterprise integration which lists the exact permissions required: https://docs.sentry.io/product/integrations/source…

Thanks for clarifying.

It would still be better if I didn't have to give read access to source code, but could still use the issues integration. But I agree it's not as a bad as write access to source code.

Re: Heroku Security Notification

#76

Post by rosndo »

mepiethree wrote: post #22

Ughh here I was at 1:30AM after a hard week, checking the news one last time before going to bed, and see this. I hate this dang industry and regret ever becoming a tech lead. I know the Heroku engineers have it worse and all, but just venting.

But why do you care? Not your company, not your problem.

Re: Heroku Security Notification

#77

Post by akpa1 »

aaronbrethorst wrote: post #44
buf wrote: post #38

This is as good a time as any to ask about Render. I've been eyeing it recently and I'm thinking about launching my next project with it. Does anyone have any takeaways from using Render vs Heroku?

I’ve been using Render since January, after switching from Heroku for a project of mine with about 10,000 direct users at present. The project is a Rails app that imports hundreds of thousands of rows of data from XLSX files and spits out PDFs on demand from those imported spreadsheets. I was worried that Heroku would end up costing me a small fortune as demand scaled. Plus the platform seemed to have stagnated. I co…

Render is really not a very good name from a SEO point of view. Took me three or four searches to find it.

Re: Heroku Security Notification

#78

Post by all-the-lights »

heartbreak wrote: post #65
domh wrote: post #32

Earlier quoted context omitted.

Yeah I see lots of the same. They seem to correspond with Heroku deploys? Anyone know if that happens when a valid heroku deploy occurs? Do they download a zip? I've reached out to Heroku support to ask.

Normal Heroku usage doesn’t download a zip because it uses git directly, but I’ve seen plenty of CI tools download zips.

Including Heroku CI? We don't use an external CI tool (or really any other integrations except GH), but I do see these download logs.

Re: Heroku Security Notification

#79

Post by SnowHill9902 »

frays wrote: post #7

> Additionally, we recommend disconnecting Heroku from your GitHub repositories. I have respect for the Heroku/Salesforce Security team for willing to ask users to perform this action. Many companies would be too worried about losing customers or having users not reconnect it afterwards. My thoughts are with the team working on responding to this incident on Easter Friday.

Internet applications have become dangerously correlated.

Re: Heroku Security Notification

#80

Post by michaelbuckbee »

sandstrom wrote: post #75
the_mitsuhiko wrote: post #58

Earlier quoted context omitted.

> There are countless SaaS applications asking for full-repo access to Github (all the source code, with write access). Sentry does not request write access to source code. It requests read/write access to issues and read access to source code. You can also see this on the documentation for the GitHub enterprise integration which lists the exact permissions required: https://docs.sentry.io/product/integrations/source…

Thanks for clarifying. It would still be better if I didn't have to give read access to source code, but could still use the issues integration. But I agree it's not as a bad as write access to source code.

Most error monitoring services want this as they map errors to commits.
Post reply on HN