Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Heroku CI and Review App Secrets Compromised

news.ycombinator.com

Post reply on HN
Print view View original

91–98 of 98 posts

Re: Heroku CI and Review App Secrets Compromised

#91

Post by anurag »

ryantgtg wrote: post #90
lebaux wrote: post #50

Earlier quoted context omitted.

The bit about the unfortunate name of the product should be taken more seriously. I understand you got that sexy .com domain, and you are here for the long run, but it is currently doing a disservice. My 2c :)

(Not parent) I started my migration last night. Overall, great experience! The heroku addon worked great. I was very impressed that the build succeeded and I had my site working in a very short time, with sendgrid and all that working. Only minor misstep for me was when pg_restore didn't work because by default Access Control has no entries and the migration doc didn't mention having to add one. The much more signifi…

Good to hear you liked Render, and sorry for the confusion between Jobs and Cron Jobs (we have an open task to improve docs for both).

Heroku Scheduler = Cron Jobs on Render. Would you mind emailing me (see profile) or support@render.com with details on your Rake tasks so we can take a look?

Re: Heroku CI and Review App Secrets Compromised

#92

Post by ryantgtg »

anurag wrote: post #91
ryantgtg wrote: post #90

Earlier quoted context omitted.

(Not parent) I started my migration last night. Overall, great experience! The heroku addon worked great. I was very impressed that the build succeeded and I had my site working in a very short time, with sendgrid and all that working. Only minor misstep for me was when pg_restore didn't work because by default Access Control has no entries and the migration doc didn't mention having to add one. The much more signifi…

Good to hear you liked Render, and sorry for the confusion between Jobs and Cron Jobs (we have an open task to improve docs for both). Heroku Scheduler = Cron Jobs on Render. Would you mind emailing me (see profile) or support@render.com with details on your Rake tasks so we can take a look?

I emailed support and Alan was super helpful. I think I'm all set (or at least close).

For me, the key was discovering that while both my native and docker builds fail, my Dockerfile.render builds (which use the heroku buildpack) magically work AND I could use that Dockerfile.render build for the Cron Job (I don't think I would have figured out that I could just plop in that Dockerfile Path in the Advanced section).

I have no experience with Docker (someone set up docker-compose stuff for us like 4 years ago as a student project, but I haven't used it). So it was a little overwhelming for me when the Render migration tool thrust Docker on me.

Still testing out some things before configuring my DNS. I'm sure in a week you'll never hear from me again (because things will just work). I enjoy how snappy the Render interface is. Maybe more of a walkthrough (with screenshots) on the cron jobs doc?

Re: Heroku CI and Review App Secrets Compromised

#93

Post by anurag »

ryantgtg wrote: post #92
anurag wrote: post #91

Earlier quoted context omitted.

Good to hear you liked Render, and sorry for the confusion between Jobs and Cron Jobs (we have an open task to improve docs for both). Heroku Scheduler = Cron Jobs on Render. Would you mind emailing me (see profile) or support@render.com with details on your Rake tasks so we can take a look?

I emailed support and Alan was super helpful. I think I'm all set (or at least close). For me, the key was discovering that while both my native and docker builds fail, my Dockerfile.render builds (which use the heroku buildpack) magically work AND I could use that Dockerfile.render build for the Cron Job (I don't think I would have figured out that I could just plop in that Dockerfile Path in the Advanced section).…

We should definitely add more tutorial/walkthrough type docs.

Re: Heroku CI and Review App Secrets Compromised

#94

Post by anurag »

bmulholland wrote: post #72
pid-1 wrote: post #54

Earlier quoted context omitted.

I don't use Heroku, nor Render, and I definitely think anyone using Heroku should be moving out, but... Do you have any evidence Render actually takes security seriously? Not shitting on their platform, I actually never used it, I just think as an industry we should be way past the point we trust platforms by default.

I had to switch from Render to Heroku a year or so ago because Render had no security documentation at all. I asked them about it at the time and was told security docs were perhaps six months out. There's still none, so it's clear that demonstrating security is not something that's a priority.

Update: we now have https://render.com/security

Re: Heroku CI and Review App Secrets Compromised

#95

Post by njp77 »

oxff wrote: post #37
gault8121 wrote: post #27

Has anyone done a load test comparison for Heroku vs. Render.com? The "Pro Ultra" on Render is $450/month for 32 GB RAM + 8 CPU. The Heroku Performance L Dyno is $500 a month for 14 GB RAM. The Render server seems like a much better offering.

Has anyone done a security review of Heroku alternatives? I see lots of comments about moving there and using them instead of Heroku because of this incident. But that's hardly a justifiable reason alone, since those new platforms are probably worse off in security.

Aptible has always prioritized security, and is a competitive alternative. https://www.aptible.com/heroku-alternative/

Re: Heroku CI and Review App Secrets Compromised

#96

Post by njp77 »

colesantiago wrote: post #6
hthrowaway5 wrote: post #4

Yep, they outright lied about env vars. Incredible. It pains me to see even occasional defenders of Heroku. They're not the company they were 10 years ago. They've been gutted and left for dead years ago but the product was so good nobody noticed until now. They're not to be trusted as your platform. They simply don't have anywhere close to the manpower required to run such a platform. This was a when not if situatio…

I would like to move but there are really no good alternatives that are even close to Heroku.

Have you explored Aptible? https://www.aptible.com/heroku-alternative/

Re: Heroku CI and Review App Secrets Compromised

#98

Post by zevir »

For those looking for a great alternative to Review Apps - Livecycle is great (https://livecycle.io/). It offers the automated per-PR ephemeral environment and much more. It also includes a rich layer of built-in collaboration and annotation tools that allow all collaborators to join the PR review and leave their comments visually, on top of the product UI. The comments are maintained in Livecycle and also synced back to Git as review comments so that developers can see the issues faster, understand them better and address them sooner. There are setup templates that make it easy to simply copy over your docker file and get started within a few minutes. And the team is eager to help if you have any questions or issues.
Post reply on HN