4 ms·

The irony of doing this on Heroku, when the push for encryption that surely influenced this work reached escape velocity from the same Snowden leaks that said "

The irony of doing this on Heroku, when the push for encryption that surely influenced this work reached escape velocity from the same Snowden leaks that said "oh, and anything at all that you store with AWS is open season to the NSA". So it's Heroku reacting to that push by encrypting inbound data, and then storing it in a cloud with zero privacy protection. Which, I don't mean to be cynical - it's way better than not encrypting at all, it's just a bit funny, in a sad, Orwellian way.

koolba 10y ago
> So it's Heroku reacting to that push by encrypting inbound data, and then storing it in a cloud with zero privacy protection. What data are they storing? I'm pretty sure they just pipe the inbound request to whatever process is running your app. They (Heroku) aren't saving every request or response body. It'd be an insane amount of traffic. Now someone could tap into that but none of this makes things less secure. They're just changing the way inbound SSL is handled by offering free SNI based SSL to everybody. That's a good thing, not a bad thing. The alternative is having a dedicated endpoint per application serving the exact certificate for that app (which is why the cost for it was non-free before).