Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heroku CI and Review App Secrets Compromised

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 98 posts

Re: Heroku CI and Review App Secrets Compromised

#81

Post by anurag »

dbbk wrote: post #65
anurag wrote: post #39

Earlier quoted context omitted.

(Render founder) Thank you for the support. You might have shared this with our support engineers already but I'd love to hear about what you missed from Heroku (email in profile). We're building Render for the very long term and every bit of feedback helps, even if we can't get to it right away.

I love the look of everything about Render, except its native lack of PHP support. I really don't want to have to use Docker. Do you have any ETA when that will be available?

No immediate native PHP plans, but we're actively hiring to move faster on all axes.

Re: Heroku CI and Review App Secrets Compromised

#82

Post by anurag »

lebaux wrote: post #50
anurag wrote: post #39

Earlier quoted context omitted.

(Render founder) Thank you for the support. You might have shared this with our support engineers already but I'd love to hear about what you missed from Heroku (email in profile). We're building Render for the very long term and every bit of feedback helps, even if we can't get to it right away.

The bit about the unfortunate name of the product should be taken more seriously. I understand you got that sexy .com domain, and you are here for the long run, but it is currently doing a disservice. My 2c :)

That's fair. The current workaround is to use the search in our docs, or add 'render.com' to Google queries. Of course, I'd love examples of frustrating searches.

Re: Heroku CI and Review App Secrets Compromised

#83

Post by alx__ »

lebaux wrote: post #50
anurag wrote: post #39

Earlier quoted context omitted.

(Render founder) Thank you for the support. You might have shared this with our support engineers already but I'd love to hear about what you missed from Heroku (email in profile). We're building Render for the very long term and every bit of feedback helps, even if we can't get to it right away.

The bit about the unfortunate name of the product should be taken more seriously. I understand you got that sexy .com domain, and you are here for the long run, but it is currently doing a disservice. My 2c :)

I haven't had any issues finding docs via Google

e.g. "render postgres" or whatever specific thing I'm looking for

It's possible my google search is now biased because I've clicked on links for render?

Re: Heroku CI and Review App Secrets Compromised

#84

Post by plant-ian »

anurag wrote: post #48
plant-ian wrote: post #47

Earlier quoted context omitted.

I agree although I literally just started using heroku again after many years. I haven't seen alternatives that support the idea of multiple buildpacks. Which seems sort of a must have for any non-js backend because a frontend js stack is going to exist no matter what.

All of Render's native environments include Node by default.

I read this when looking at migrating: "We are working on supporting migration of Heroku apps that use multiple buildpacks." -- https://render.com/docs/migrate-from-heroku#fnref-2

I guess I would need to place the extra node steps and python build steps into a single build file and then point the render.yaml at that custom script? I wanted to tell from the docs if it was possible before even starting on a prototype to demo it. Is there an example app that fulfills this. Thanks for your time.

Re: Heroku CI and Review App Secrets Compromised

#85

Post by anurag »

bmulholland wrote: post #72
pid-1 wrote: post #54

Earlier quoted context omitted.

I don't use Heroku, nor Render, and I definitely think anyone using Heroku should be moving out, but... Do you have any evidence Render actually takes security seriously? Not shitting on their platform, I actually never used it, I just think as an industry we should be way past the point we trust platforms by default.

I had to switch from Render to Heroku a year or so ago because Render had no security documentation at all. I asked them about it at the time and was told security docs were perhaps six months out. There's still none, so it's clear that demonstrating security is not something that's a priority.

I agree we haven't focused on demonstrating security, but obviously, internally, we are quite paranoid about it. Still, this comment is well-deserved because as much as we'd like them to, our customers can't simply read our minds.

Re: Heroku CI and Review App Secrets Compromised

#86

Post by anurag »

pid-1 wrote: post #54
hkhanna wrote: post #18

I spent the last two days migrating my company to Render from Heroku, and now I'm glad I did. Render is a little rough around the edges; Heroku is far more polished. But it's probably to Render's credit that, in my opinion, the most annoying thing about Render is that it's impossible to google about Render because "render" is such a common word in the tech world! Their support is good and responsive, and the develope…

I don't use Heroku, nor Render, and I definitely think anyone using Heroku should be moving out, but... Do you have any evidence Render actually takes security seriously? Not shitting on their platform, I actually never used it, I just think as an industry we should be way past the point we trust platforms by default.

(Render founder) Security and uptime are the only two existential threats to Render, so you can imagine we lose enough sleep over it. We regularly fill out security questionnaires that lead to successful migrations. Still, we can do a better job explaining and documenting our security posture publicly.

Re: Heroku CI and Review App Secrets Compromised

#87

Post by anurag »

plant-ian wrote: post #84
anurag wrote: post #48

Earlier quoted context omitted.

All of Render's native environments include Node by default.

I read this when looking at migrating: "We are working on supporting migration of Heroku apps that use multiple buildpacks." -- https://render.com/docs/migrate-from-heroku#fnref-2 I guess I would need to place the extra node steps and python build steps into a single build file and then point the render.yaml at that custom script? I wanted to tell from the docs if it was possible before even starting on a prototype t…

Exactly, you can use any command or script to build your app, and you would select Python as the native Render environment and run your Node build as part of your build script. Here's a quick example: https://render.com/docs/deploy-django#create-a-build-script

Re: Heroku CI and Review App Secrets Compromised

#88

Post by anurag »

ryanSrich wrote: post #64
oxff wrote: post #37

Earlier quoted context omitted.

Has anyone done a security review of Heroku alternatives? I see lots of comments about moving there and using them instead of Heroku because of this incident. But that's hardly a justifiable reason alone, since those new platforms are probably worse off in security.

Is render SOC 2 certified? ISO 27001? Those are fairly standard. If they don’t have either it’s going to be a hard time getting any serious business to migrate.

Render will have these certifications late summer (we're currently being audited for both).

Re: Heroku CI and Review App Secrets Compromised

#89

Post by ryantgtg »

I_dev_outdoors wrote: post #75
andrewflnr wrote: post #58

Earlier quoted context omitted.

I'm almost certain they were talking about googling docs etc as mentioned in your edit. That would definitely be my concern.

I agree with you, that's what they meant. Just like Go is referred to as golang by the community, maybe render can be referred to as rendercloud.

I'm not a power user but including the string "render.com" instead of "render" seems to help. I noticed that because I saw some youtube vid titles referring to it that way.

Re: Heroku CI and Review App Secrets Compromised

#90

Post by ryantgtg »

lebaux wrote: post #50
anurag wrote: post #39

Earlier quoted context omitted.

(Render founder) Thank you for the support. You might have shared this with our support engineers already but I'd love to hear about what you missed from Heroku (email in profile). We're building Render for the very long term and every bit of feedback helps, even if we can't get to it right away.

The bit about the unfortunate name of the product should be taken more seriously. I understand you got that sexy .com domain, and you are here for the long run, but it is currently doing a disservice. My 2c :)

(Not parent) I started my migration last night. Overall, great experience! The heroku addon worked great. I was very impressed that the build succeeded and I had my site working in a very short time, with sendgrid and all that working. Only minor misstep for me was when pg_restore didn't work because by default Access Control has no entries and the migration doc didn't mention having to add one.

The much more significant issue for me is that I honestly have no real clue what to make of Jobs. In Heroku I use Scheduler to run rake tasks. And in Render there's an API Explorer (and my rake tasks fail when I attempt to run them through that) and then I'm supposed to add crons to... my repo (?), and the Jobs I create go... somewhere. I am very confused. I've read the Jobs and Cron Jobs docs like 40 times.

Post reply on HN