5 ms·

I'm curious to know why it is that AWS can operate its API with a much higher degree of reliability than Heroku. They clearly have superior design and processes

I'm curious to know why it is that AWS can operate its API with a much higher degree of reliability than Heroku. They clearly have superior design and processes given the large difference in reliability. Having been a heroku user for quite a while in the past I'm not surprised, these sorts of issues are sadly common with heroku.

grandalf 12y ago
Heroku has lots of single points of failure in its architecture. Heroku also has no transparency into its architecture, which is why no site on Heroku will be able to be PCI compliant after Jan 2015. I'm not optimistic about Heroku's ability to continue to be a leading PaaS.
- cschmidt 12y ago
  > no site on Heroku will be able to be PCI compliant after Jan 2015 do you have a reference for that?
  - grandalf 12y ago
    Read the PCI DSS 3.0 SAQ A-EP documentation (and some of the blog posts people have written about it). Heroku has never been able to pass a PCI Level 1 or Level 2 audit, but as of Jan 2014 it will also no longer pass level 3 or level 4 SAQs.
    - spitfire 12y ago
      What in particular is Heroku missing to pass level 3 and 4? Hit and run comments aren't really useful. Some detail and if possible some suggestions for improvement really help. Even if they can't be implemented for some reason.
      - grandalf 12y ago
        > What in particular is Heroku missing to pass level 3 and 4? It's mostly documentation. If Heroku has built a secure system and documented it adequately, then it would easily pass SAQ A-EP. One easy example: Maybe Heroku keeps logs of all HTTP requests that include params containing credit card numbers. Nobody knows.
opendais 12y ago
I think its experience. They built MWS first, which imo, isn't significantly better than Heroku's API in terms of reliability/transparency.
m0th87 12y ago
Heroku builds on AWS, so they're affected both by AWS downtime and by issues in their own infrastructure.

grandalf 12y ago

Heroku has lots of single points of failure in its architecture. Heroku also has no transparency into its architecture, which is why no site on Heroku will be able to be PCI compliant after Jan 2015. I'm not optimistic about Heroku's ability to continue to be a leading PaaS.

cschmidt 12y ago
> no site on Heroku will be able to be PCI compliant after Jan 2015 do you have a reference for that?
- grandalf 12y ago
  Read the PCI DSS 3.0 SAQ A-EP documentation (and some of the blog posts people have written about it). Heroku has never been able to pass a PCI Level 1 or Level 2 audit, but as of Jan 2014 it will also no longer pass level 3 or level 4 SAQs.
  - spitfire 12y ago
    What in particular is Heroku missing to pass level 3 and 4? Hit and run comments aren't really useful. Some detail and if possible some suggestions for improvement really help. Even if they can't be implemented for some reason.
    - grandalf 12y ago
      > What in particular is Heroku missing to pass level 3 and 4? It's mostly documentation. If Heroku has built a secure system and documented it adequately, then it would easily pass SAQ A-EP. One easy example: Maybe Heroku keeps logs of all HTTP requests that include params containing credit card numbers. Nobody knows.

opendais 12y ago

I think its experience. They built MWS first, which imo, isn't significantly better than Heroku's API in terms of reliability/transparency.

m0th87 12y ago

Heroku builds on AWS, so they're affected both by AWS downtime and by issues in their own infrastructure.