4 ms·

If you have left your heroku app alone for 3 years, you are definitely at risk of getting rooted: https://blog.heroku.com/archives/2013/1/11/rails_security_vuln

• jdminhbg 14y ago
  You don't need to ssh into the box to take care of Rails vulnerabilities; just redeploy. Heroku is taking care of any vulnerabilities in the rest of the stack: Postgres, Nginx, SSH, etc.
  • grey-area 14y ago
    The thing is, that's actually the easy bit - use apt-get upgrade on say Ubuntu lts and you will very rarely see problems with your upgrade of software like Postgres, apache, ssh or nginx - it's so widely used that you're unlikely to run into issues, and upgrading takes a few minutes every few months. The thing you need to test then deploy are upgrades to your language and framework/app, and those present exactly the same problem on heroku or on say a vps. You can't just redeploy your app without testing on a new config, and deploys to heroku are no easier or harder than deploys to your own server once set up.
  • ghempton 14y ago
    You also don't need to ssh into the box with chef...
    • jaggederest 14y ago
      Technically you're both wrong - both chef and git use ssh as an underlying transport.
      • sandfox 14y ago
        Pedant time! ssh is just one of many transports that git can use.
        • jdminhbg 14y ago
          He's right though about Heroku, you use ssh as the transport to deploy via git.
• jaggederest 14y ago
  Who says it's a rails app? I run a couple raw-rack apps that hum along just fine with very, very occasional updates.