TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Heroku CI and Review App Secrets Compromised

249 点作者 himeexcelanta将近 3 年前
Just got an email from Salesforce: &quot;Action Required: Heroku security notification&quot;.<p>Looks like the database that stores pipeline-level config variables for both Review Apps and Heroku CI were compromised.<p>Per Heroku, &quot;...any secrets you set in Review Apps and Heroku CI config may have been compromised and should be rotated&quot;.<p>This...is really messed up :&#x2F;

16 条评论

bradleybuda将近 3 年前
Text of the email:<p>At Salesforce, we understand that the confidentiality, integrity, and availability of your data is vital to your business, and we take the protection of your data very seriously. We value transparency and wanted to notify you of an issue affecting your account. Based on current progress, we plan to complete our investigation by May 30, 2022. We are continuing with remediation activities and plan to publish additional information about the incident once it’s resolved.<p>As reported on status.heroku.com, on April 7, 2022, a threat actor obtained access to a Heroku database and downloaded stored customer GitHub integration OAuth tokens. On that same day, the threat actor downloaded data from another database that stores pipeline-level config vars for Review Apps and Heroku CI. This was identified on May 16, 2022, after further forensic investigation. We have no evidence of any unauthorized access to Heroku systems since April 14, 2022.<p>As a result, any secrets you set in Review Apps and Heroku CI config vars may have been compromised and should be rotated. In addition, any Heroku tokens stored in these pipeline config vars would potentially have allowed access to your Heroku account between April 7, 2022 and May 5, 2022, when your passwords were reset, invalidating all Heroku tokens as a result.<p>Please note, these pipeline-level config vars are different from standard app config vars. App config vars were not stored in this database and we have no evidence to suggest app config vars were compromised.
评论 #31418528 未加载
hkhanna将近 3 年前
I spent the last two days migrating my company to Render from Heroku, and now I&#x27;m glad I did. Render is a little rough around the edges; Heroku is far more polished.<p>But it&#x27;s probably to Render&#x27;s credit that, in my opinion, the most annoying thing about Render is that it&#x27;s impossible to google about Render because &quot;render&quot; is such a common word in the tech world!<p>Their support is good and responsive, and the developer experience was good enough. It has some warts, and there were definitely times I missed Heroku, but their speed of improvement gives me confidence in their future.<p>Sad to leave Heroku after almost a decade with them. They were far ahead of their time.
评论 #31418894 未加载
评论 #31420001 未加载
评论 #31418601 未加载
评论 #31418688 未加载
评论 #31418746 未加载
评论 #31419135 未加载
hthrowaway5将近 3 年前
Yep, they outright lied about env vars. Incredible.<p>It pains me to see even occasional defenders of Heroku. They&#x27;re not the company they were 10 years ago. They&#x27;ve been gutted and left for dead years ago but the product was <i>so good</i> nobody noticed until now.<p>They&#x27;re not to be trusted as your platform. They simply don&#x27;t have anywhere close to the manpower required to run such a platform. This was a <i>when</i> not <i>if</i> situation.<p>If you&#x27;re still on it, make your plans to move away now. Time is ticking until a <i>major</i> outage or another security incident like this one. See my comment history and related threads for more. Specifically this summary: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=31374048" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=31374048</a>
评论 #31418214 未加载
评论 #31418212 未加载
mepiethree将近 3 年前
11 days ago they said &quot;While we confirmed that the threat actor had access to encrypted Heroku customer secrets stored in config var, the secrets are encrypted at rest and the threat actor did not access the encryption key necessary to decrypt config var secrets.&quot;<p>I guess that was a lie?!
评论 #31420217 未加载
评论 #31418069 未加载
zevir将近 3 年前
For those looking for a great alternative to Review Apps - Livecycle is great (<a href="https:&#x2F;&#x2F;livecycle.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;livecycle.io&#x2F;</a>). It offers the automated per-PR ephemeral environment and much more. It also includes a rich layer of built-in collaboration and annotation tools that allow all collaborators to join the PR review and leave their comments visually, on top of the product UI. The comments are maintained in Livecycle and also synced back to Git as review comments so that developers can see the issues faster, understand them better and address them sooner. There are setup templates that make it easy to simply copy over your docker file and get started within a few minutes. And the team is eager to help if you have any questions or issues.
itsmeste将近 3 年前
When Salesforce bought Heroku back in 2011, it was pretty clear Heroku would become yet another dead product that once was an absolute great piece of software.<p>Why? Commercialism.<p>Founders sell to the highest bidder to make their exit worthwhile for themselves, not caring about the future of the product (and customers).<p>It&#x27;s a no-brainer that a commercial company like Salesforce (it&#x27;s in their name!) doesn&#x27;t have what it takes to build AAA software, but focuses on maximizing their profit. They drove away their best staff, focused on the wrong features, and are seemingly overwhelmed by maintaining their purchased software, all while probably not even realizing their demise.<p>We should all come to the agreement that takeovers of fundamental software by incompetent companies should be seen as a hostility towards every current user of said software.
评论 #31424442 未加载
nameless912将近 3 年前
Yup, that&#x27;s game, set, and match. I really feel bad for all the herokai still left holding the line, but damn am I glad I got out when I did.
jamespetercook将近 3 年前
Slightly off-topic, but can anyone tell me how you’d know that your database has been accessed by a threat actor? Should I be periodically reviewing all my logs for <i>something</i> unusual?
评论 #31419990 未加载
Mandatum将近 3 年前
Sounds like a customer&#x27;s canary token triggered this based on the current reporting.<p>&quot;Trust is our Number 1 value.&quot;
评论 #31418564 未加载
gault8121将近 3 年前
Has anyone done a load test comparison for Heroku vs. Render.com? The &quot;Pro Ultra&quot; on Render is $450&#x2F;month for 32 GB RAM + 8 CPU. The Heroku Performance L Dyno is $500 a month for 14 GB RAM. The Render server seems like a much better offering.
评论 #31418825 未加载
kaycebasques将近 3 年前
Any guesses as to how the &quot;threat actor&quot; got access to the databases? I understand most guesses would be conjecture (unless someone here has an inside scoop). Just curious about how stuff like this <i>usually</i> gets compromised.
daudmalik06将近 3 年前
This is why we at vulert.com never access the customer&#x27;s codebase or any installation, who doesn&#x27;t know vulert, it&#x27;s a service that notifies you for security issues in your software dependencies.
heartbreak将近 3 年前
I completely stopped getting their update emails when I deleted all of my running apps. This is the second one I&#x27;ve seen on HN that I haven&#x27;t received (though I received the others).<p>Is the impact limited to specific customer accounts, or are they just not updating me anymore?
评论 #31418637 未加载
评论 #31418634 未加载
boesboes将近 3 年前
Still havent had any notification on this. A+ for Heroku
vmception将近 3 年前
oh shit. I&#x27;m surprised we haven&#x27;t heard about major services getting hacked to oblivion right now, so much is stored in environment variables<p>are there any mystery hacks occurring yet?<p>is this database known to have been spread anywhere?
评论 #31419432 未加载
oxff将近 3 年前
My sides, what a shitshow.