Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heroku Security Notification

status.heroku.com

Post reply on HN
Print view View original

91–100 of 123 posts

Re: Heroku Security Notification

#91

Post by kall »

heartbreak wrote: post #66
franciscop wrote: post #57

Earlier quoted context omitted.

I can confirm that ~2h ago my integration was working but now it's not, so it seems they automatically disconnected everyone. Not sure if "they" is Github or Heroku here, but my master branch is not autodeploying anymore and trying to reconnect results into an error.

My personal account audit log says “salesforce-revocation-bot” removed my Heroku Dashboard OAuth Application a few hours ago.

"Github System" removed the Heroku Dashboard key and a personal user account of someone that seems to work at neither GitHub nor Travis removed my Travis CI key (????)

Re: Heroku Security Notification

#92

Post by mtmail »

kall wrote: post #91
heartbreak wrote: post #66

Earlier quoted context omitted.

My personal account audit log says “salesforce-revocation-bot” removed my Heroku Dashboard OAuth Application a few hours ago.

"Github System" removed the Heroku Dashboard key and a personal user account of someone that seems to work at neither GitHub nor Travis removed my Travis CI key (????)

If you saw the user 'shairyar', he works at Travis based on linkedin profile page (but not based on github profile page). I was confused as well when I saw that.

Re: Heroku Security Notification

#93

Post by kall »

mtmail wrote: post #92
kall wrote: post #91

Earlier quoted context omitted.

"Github System" removed the Heroku Dashboard key and a personal user account of someone that seems to work at neither GitHub nor Travis removed my Travis CI key (????)

If you saw the user 'shairyar', he works at Travis based on linkedin profile page (but not based on github profile page). I was confused as well when I saw that.

I guess maybe, but this is incredibly badly communicated. Just now they showed up as a member of travis GitHub orgs, but the only member? https://github.com/orgs/travis-ci/people

It's very possible (likely) this is all fine, but done in a way that feels strange/fishy. I haven't even gotten an email from travis. They must be in fire-extinguishing mode.

Re: Heroku Security Notification

#94

Post by ezekg »

mariusz331 wrote: post #88
anon3949494 wrote: post #73

We're a small org with a github connected to heroku. All of our repos were cloned between April 8 and April 15 with the majority of them having no activity for several years. The audit logs don't show this, you can only see this information in the traffic graphs (/graphs/traffic). If you're seeing cloning of repos that you haven't touched in a while, you've likely been compromised.

For anyone not on a pro plan: I believe you can upgrade and still see the past two weeks of data. I cloned a few of my private repos last night to see how that affects my security logs and no logs appeared. I later upgraded to pro and visited / / /graphs/traffic and can see the clone counts from before I upgraded. I also can see visitor counts from about a week ago. These clones still don't appear in the security log…

I tried upgrading my org to a Team to check traffic, but the upgrade seemingly did nothing. I do have sponsorships, so maybe it’s waiting until my next billing cycle? Can’t figure it out.

Re: Heroku Security Notification

#95

Post by [deleted] »

buf wrote: post #38

This is as good a time as any to ask about Render. I've been eyeing it recently and I'm thinking about launching my next project with it. Does anyone have any takeaways from using Render vs Heroku?

[deleted]

Re: Heroku Security Notification

#96

Post by dharmab »

michaelbuckbee wrote: post #80
sandstrom wrote: post #75

Earlier quoted context omitted.

Thanks for clarifying. It would still be better if I didn't have to give read access to source code, but could still use the issues integration. But I agree it's not as a bad as write access to source code.

Most error monitoring services want this as they map errors to commits.

As a user it's nice to have the option of foregoing the feature.

Re: Heroku Security Notification

#97

Post by nijave »

couchand wrote: post #60
quickthrower2 wrote: post #52

Earlier quoted context omitted.

A forced push could introduce vulnerability into code in a years old commit that is hard to detect. I guess it will look dodgy when your next push is rejected.

It would not at all be "hard to detect", the SHAs of it and all subsequent commits would change, it would appear in the GitHub audit log, etc etc

Honestly should be pretty easy to just compare remote to someone's recent local copy and just spot check any new commits. Definitely a time sink, though

Re: Heroku Security Notification

#98

Post by nijave »

maccard wrote: post #48
samcheng wrote: post #26

This is a chance to reiterate best practices: Credentials and other secrets, like API keys, should never be hard-coded in the source code repo. Use some sort of secrets management or configuration for that kind of stuff.

at work thats fine, we use vault or secrets manager, but neither of those are really suitable for self hosting for toy apps. What do you tell someone using github's free tier and aws/gcp's free tier?

You can store them in the repo and encrypt them with Mozilla sops. You can use a cloud managed key like AWS KMS or a GPG key.

If you manage your own key, you can store it in a password manager or use a USB hardware key to store it

You could also use object/blob storage or your local filesystem to store a config file and optionally apply encryption to that

Re: Heroku Security Notification

#99

Post by anurag »

fourstar wrote: post #82
buf wrote: post #38

This is as good a time as any to ask about Render. I've been eyeing it recently and I'm thinking about launching my next project with it. Does anyone have any takeaways from using Render vs Heroku?

It’s alright but things are still flaky given they are smaller and newer. It hung on spinning up a postgres instance. Builds are slower as well.

(Render founder) Were you trying the free tier? Builds are significantly faster on paid plans. I'd certainly appreciate more context: email in profile.

Re: Heroku Security Notification

#100

Post by samcheng »

maccard wrote: post #48
samcheng wrote: post #26

This is a chance to reiterate best practices: Credentials and other secrets, like API keys, should never be hard-coded in the source code repo. Use some sort of secrets management or configuration for that kind of stuff.

at work thats fine, we use vault or secrets manager, but neither of those are really suitable for self hosting for toy apps. What do you tell someone using github's free tier and aws/gcp's free tier?

Most Heroku users are using environment variables for their secrets.
Post reply on HN