6 ms·
> We’ve heard your feedback on our communications during this incident. You want more transparency, more in-depth information, and fewer “we are working on it”
by nomilk 5y ago
> We’ve heard your feedback on our communications during this incident. You want more transparency, more in-depth information, and fewer “we are working on it” posts.
Well, those, and:
1. Speed. It took days for heroku customers to be told about this.
2. Customers sign up at "heroku.com", the platform is called "Heroku", the CLI is "heroku", everything's heroku, so don't send emails from a parent company (Salesforce), send them from "Heroku".
3. Unambiguous info on what customers need to do. I had to guess based on HN comments whether config vars were accessed. Config vars are 100x more sensitive than code. Comms should be unambiguous and complete, and if incomplete for any reason, explain that (e.g. we don't know yet).
4. I still don't know whether having 1 Github Deploy on my Heroku account allowed unauthorized access to all heroku applications on my heroku account (i.e. those using other deploy methods, like `git push heroku main`). Were all my apps' repositories able to be accessed, or just the one(s) deployed via Github Deploys?
5. I still don't know whether unauthorized access was gained to all other GitHub respositories on my GitHub account, i.e. the repos that aren't heroku apps.
These said, I still really appreciate that security incidents happen and aren't easy to deal with, and there's no obligation for anyone at a profitable company to actually care about semi-captive customers, so thanks to Heroku for the efforts; it's genuinely appreciated.
- ev1 5y agore: 2 interestingly, when i log in or reauthenticate, or log in through the heroku cli, I get sent to https://verify.salesforce.com/v1/verify/ https://verify.salesforce.com/v1/verify/
- izzygonzalez 5y agoWhen I saw the Salesforce email I thought I was being spammed or phished or getting a job offer.
- booi 5y agoThose are all the same thing
- ralston3 5y agoWhen I got an email from Salesforce talking about Heroku I assumed phishing. Huge +1 on that 2nd point :)
- throwawa3238273 5y ago> 2. Customers sign up at "heroku.com", the platform is called "Heroku", the CLI is "heroku", everything's heroku, so don't send emails from a parent company (Salesforce), send them from "Heroku". They're working on something called "Project Periwinkle" that is intended to remove all Heroku branding and make everything Salesforce branded. Periwinkle being a colour between blue (salesforce) and purple (heroku). No more Heroku signups, you'll need a Salesforce account to use it. No more free tier either. Heroku has been in the process of being sunset for years now. New features have been banned for years. Only "keep the lights on" projects are allowed. Not that they could do anything with the skeleton crew they have running the platform. Bob Wise's LinkedIn doesn't even mention Heroku, only Salesforce. Lenora mentions the project here: https://www.lenoraporter.com/portfolio/salesforce https://www.lenoraporter.com/portfolio/salesforce Source: I'm a former employee that left in protest because of this project.
- ryantgtg 5y agoYouch. I have paid apps and free apps (staticman comment processing, and very simple apps I create while following learning tutorials). This project sounds bad! I’ve been slowly exploring alternatives, and was about to abandon my search due to demands on my time. Guess I need to keep exploring.
- neximo64 5y agoThe amount of Salesforce fluff in the post is quite palpable. There is a clear lack of control with the leaders in Heroku judging off this post because of the salesforce transition. This project Periwinkle sounds awful. Basically thats the end of using Heroku for us. If it remains like this its something to judge from.
- deleted 5y ago[deleted]
- throwawa3238273 5y agoThere really aren't any Heroku leaders anymore. I think anyone director level or higher is Salesforce—not Heroku. It's worth mentioning that this isn't a result of Salesforce acquiring Heroku. That happened 12 years ago when Heroku was next to nothing. Salesforce gets credit for investing in and making Heroku. Why they ultimately have decided to give up on it I have no idea. I hear it's because salespeople had a hard time understanding how to sell it which seems like a strange reason to give up entirely.
- zebraflask 5y agoThis all somehow seems unsurprising. If anyone has tried to use Heroku in easily the last year, the number of times you get failed builds over really trivial things is noticeable.
- ryantgtg 5y agoI haven’t experienced a failed build in a few years. I did try a heroku competitor recently and my builds failed. And there was no detailed log to show why. So I couldn’t troubleshoot it and I immediately gave up! As an aside, I was really hoping this post was going to be “we read that one competitor’s blog post last week clearly detailing all the areas where we can improve, and we HEAR you.”
- quassy 5y agoConsidering how badly Salesforce handled communication and bug fixing of log4shell in Tableau that's not really surprising.