News for hackers. Stuff that matters.
Re:Heroku: We’ve Heard Your Feedback by nomilk on Friday May 06, 2022 @09:05PM (#31291244)
> We’ve heard your feedback on our communications during this incident. You want more transparency, more in-depth information, and fewer “we are working on it” posts.

Well, those, and:

1. Speed. It took days for heroku customers to be told about this.

2. Customers sign up at "heroku.com", the platform is called "Heroku", the CLI is "heroku", everything's heroku, so don't send emails from a parent company (Salesforce), send them from "Heroku".

3. Unambiguous info on what customers need to do. I had to guess based on HN comments whether config vars were accessed. Config vars are 100x more sensitive than code. Comms should be unambiguous and complete, and if incomplete for any reason, explain that (e.g. we don't know yet).

4. I still don't know whether having 1 Github Deploy on my Heroku account allowed unauthorized access to all heroku applications on my heroku account (i.e. those using other deploy methods, like `git push heroku main`). Were all my apps' repositories able to be accessed, or just the one(s) deployed via Github Deploys?

5. I still don't know whether unauthorized access was gained to all other GitHub respositories on my GitHub account, i.e. the repos that aren't heroku apps.

These said, I still really appreciate that security incidents happen and aren't easy to deal with, and there's no obligation for anyone at a profitable company to actually care about semi-captive customers, so thanks to Heroku for the efforts; it's genuinely appreciated.

Re:Heroku: We’ve Heard Your Feedback by throwawa3238273 on Friday May 06, 2022 @10:04PM (#31291549)
> 2. Customers sign up at "heroku.com", the platform is called "Heroku", the CLI is "heroku", everything's heroku, so don't send emails from a parent company (Salesforce), send them from "Heroku".

They're working on something called "Project Periwinkle" that is intended to remove all Heroku branding and make everything Salesforce branded. Periwinkle being a colour between blue (salesforce) and purple (heroku). No more Heroku signups, you'll need a Salesforce account to use it. No more free tier either.

Heroku has been in the process of being sunset for years now. New features have been banned for years. Only "keep the lights on" projects are allowed. Not that they could do anything with the skeleton crew they have running the platform.

Bob Wise's LinkedIn doesn't even mention Heroku, only Salesforce. Lenora mentions the project here: https://www.lenoraporter.com/portfolio/salesforce

Source: I'm a former employee that left in protest because of this project.

Re:Heroku: We’ve Heard Your Feedback by forkfork on Friday May 06, 2022 @11:43PM (#31291985)
I work for a non-Heroku tech vendor, and I have always spoken highly of Heroku to my customers from my past experience of going all-in on Heroku, and receiving a top quality of support from Heroku back in 2017-2019. I'm going to point folks to the recent Hacker News threads now.

It is difficult for me to understand why Salesforce is not aware of the strength of the Heroku brand among experienced technology workers, and how much they have destroyed that brand in the last 2-3 years.

Re:Heroku: We’ve Heard Your Feedback by neximo64 on Friday May 06, 2022 @10:19PM (#31291620)
The amount of Salesforce fluff in the post is quite palpable. There is a clear lack of control with the leaders in Heroku judging off this post because of the salesforce transition.

This project Periwinkle sounds awful. Basically thats the end of using Heroku for us. If it remains like this its something to judge from.

Re:Heroku: We’ve Heard Your Feedback by throwawa3238273 on Friday May 06, 2022 @10:57PM (#31291781)
There really aren't any Heroku leaders anymore. I think anyone director level or higher is Salesforce—not Heroku.

It's worth mentioning that this isn't a result of Salesforce acquiring Heroku. That happened 12 years ago when Heroku was next to nothing. Salesforce gets credit for investing in and making Heroku. Why they ultimately have decided to give up on it I have no idea. I hear it's because salespeople had a hard time understanding how to sell it which seems like a strange reason to give up entirely.

Re:Heroku: We’ve Heard Your Feedback by fossuser on Saturday May 07, 2022 @12:30AM (#31292152)
Salesforce is where good software goes to die (or at best become stagnant and lame). Same thing happened to quip and will happen to slack.
Re:Heroku: We’ve Heard Your Feedback by labster on Saturday May 07, 2022 @12:38AM (#31292178)
Oh no! I hope Slack doesn’t become slow and bloated, or go through unnecessary UX redesigns. /s
Re:Heroku: We’ve Heard Your Feedback by mustardo on Saturday May 07, 2022 @07:49AM (#31293793)
MS teams is proof slack could get a lot worse yet :-)
Re:Heroku: We’ve Heard Your Feedback by Aeolun on Saturday May 07, 2022 @03:51AM (#31292877)
Oh man, I somehow missed Slack had been acquired by Salesforce. So many things make sense now!
Re:Heroku: We’ve Heard Your Feedback by znpy on Tuesday May 10, 2022 @04:09AM (#31324699)
I didn't know Slack had been acquired by Salesforce.

That's sad, I guess.

Re:Heroku: We’ve Heard Your Feedback by Mandatum on Sunday May 08, 2022 @08:08PM (#31309202)
This happens after every single Salesforce acqusition. If you think you're different, compare how many new internal promotions there are, how many senior management have left and how many Salesforce transplants there are.

Everyone thought they were the darling child, at least for the first 18 months.

Re:Heroku: We’ve Heard Your Feedback by lloydatkinson on Monday May 09, 2022 @10:38AM (#31314577)
> because salespeople had a hard time understanding how to sell it which seems like a strange reason to give up entirely.

Yet unfortunately from my experience with large orgs and sales, the sales people get all the control and freely shit on the people actually making the software they sell.

Re:Heroku: We’ve Heard Your Feedback by dylan604 on Saturday May 07, 2022 @02:13AM (#31292533)
>I have no idea. I hear it's because

So you had an idea after all?

Re:Heroku: We’ve Heard Your Feedback by throwawaysfdc on Friday May 06, 2022 @11:53PM (#31292025)
Periwinkle never materialized. Neither did Shinrai, or a number of other projects that people brought up in hn threads about this incident. It’s clear that Heroku has lost a ton of great talent and momentum due to questionable business decisions but some of the most controversial fail to ever make it past codename status.
Re:Heroku: We’ve Heard Your Feedback by hthrowaway3 on Saturday May 07, 2022 @12:40AM (#31292190)
It's on ice. As you say it's also not the first time they've attempted something like this.

Eventually they'll get there, but customers should know that's the direction. They'll be users of "Compute Cloud" writing APEX instead of Procfiles someday.

Re:Heroku: We’ve Heard Your Feedback by Mandatum on Sunday May 08, 2022 @08:09PM (#31309208)
Remember when Salesforce was moving off of Oracle within 2 years? A decade ago..
Re:Heroku: We’ve Heard Your Feedback by rhizome on Friday May 13, 2022 @10:53PM (#31374697)
I wouldn't be surprised if Larry got them CIA/gov't contracts to avoid anything like that happening.
Re:Heroku: We’ve Heard Your Feedback by oxff on Friday May 06, 2022 @11:48PM (#31292008)
> [..] No more Heroku signups, you'll need a Salesforce account to use it. No more free tier either.

Guess I'm packing it up as I'm no longer seen as target audience (its my hobby project platform)

> New features have been banned for years. Only "keep the lights on" projects are allowed.

What???

Re:Heroku: We’ve Heard Your Feedback by jrochkind1 on Saturday May 07, 2022 @10:12AM (#31294619)
> New features have been banned for years. Only "keep the lights on" projects are allowed.

That's what it's looked like from the outside -- that no features were for whatever reason(s) no longer going to happen. But still dismaying to hear it from the inside in those terms.

Re:Heroku: We’ve Heard Your Feedback by hthrowaway3 on Saturday May 07, 2022 @10:44AM (#31294898)
You've gotta go way back on the Heroku Changelog to find anything that isn't a language version upgrade or feature removal: https://devcenter.heroku.com/changelog

I think the feature freeze happened in 2018

Re:Heroku: We’ve Heard Your Feedback by jrochkind1 on Saturday May 07, 2022 @01:43PM (#31296769)
The interesting thing is that heroku still is so at the top of what it does, as far as developer UX and ease and reliability. It's hard to describe exactly what i mean, but I know plenty of other people agree. Other things do other things better -- but it's only in the past year or two that some things have started to come close or equal.

I don't know what's going on exactly. Those who set up heroku for the first ~5 years somehow did such a good job that they could coast for another 5-10 and still stay on top of what they were on top of.

Re:Heroku: We’ve Heard Your Feedback by derefr on Friday May 06, 2022 @10:47PM (#31291737)
Any suggestions on a rival PaaS that has a similar engineering philosophy to the old Heroku?
Re:Heroku: We’ve Heard Your Feedback by pdwittig on Friday May 06, 2022 @11:03PM (#31291814)
I was a long time Heroku user/lover (~10 years) for both personal and company projects. I've recently moved to Render[1], and so far it's been great. I haven't been using them long enough to put it through it's paces, but I'd certainly say it's worth a look. Other alternatives I've heard good things about are Fly.io[2] and Porter[3].

[1] - https://render.com/

[2] - https://fly.io/

[3] - https://porter.run/

Re:Heroku: We’ve Heard Your Feedback by SonOfLilit on Saturday May 07, 2022 @12:44AM (#31292214)
Checked out render.com in the context of side projects that I want on the air but don't expect anyone to ever use (I have so many on heroku, who got rewarded for their generosity with many thousands of dollars of business from me), which means I'm willing to pay a few dollars but not to pay per-app. Looks great except that they delete your free databases after 90 days, making it completely useless for this use case. Their announcement blog post says they plan to remove this limitation "early 2022", but it hadn't happened yet.

I next looked at fly.io, which seem ok for the first two apps, assuming they use the same database. If I ever want more than two apps, it seems I will need to start hosting different apps together, which is the opposite of the headache-free experience I'm looking for.

Porter runs on my own cloud account, so I can't trust it to not cost too much.

Maybe I can get a Kubernetes cluster somewhere (DigitalOcean?) and deploy all my small apps to it, but it sounds like a headache.

I'm staying with heroku.

Re:Heroku: We’ve Heard Your Feedback by danjac on Monday May 09, 2022 @11:14AM (#31315161)
Dokku on top of a Digital Ocean droplet is a pretty cheap and easy option if you're OK with a single-server solution (i.e. small side project) and you're looking for something Heroku-like.
Re:Heroku: We’ve Heard Your Feedback by ryantgtg on Saturday May 07, 2022 @12:11PM (#31295833)
What about DO App Platform? I was thinking of trying that next. I’ve read a lot about slow build times and random build failures, but at the same time they at least seem to be actively developing the service.
Re:Heroku: We’ve Heard Your Feedback by SonOfLilit on Saturday May 07, 2022 @05:39PM (#31298848)
Elsewhere in this thread is a link to a blogpost comparing it to doing things manually with GCP and quickly dismissing it as extremely limited, so I didn't delve further.
Re:Heroku: We’ve Heard Your Feedback by nicoburns on Saturday May 07, 2022 @05:53PM (#31298942)
Heroku only gives you one free app too? Fly.io pricing is a lot cheaper. You can run a small service for $2/month whereas Heroku is $7 minimum.
Re:Heroku: We’ve Heard Your Feedback by 1propionyl on Friday May 06, 2022 @10:54PM (#31291766)
If you want a more minimal do-it-yourself option you could self-host something like Dokku[1].

[1] https://dokku.com/

Re:Heroku: We’ve Heard Your Feedback by jrochkind1 on Friday May 06, 2022 @11:39PM (#31291965)
I feel confident nobody using heroku is doing it because they want a more minimal do-it-yourself option.
Re:Heroku: We’ve Heard Your Feedback by slang800 on Friday May 06, 2022 @11:31PM (#31291931)
fly.io is an excellent alternative. I am slowly migrating all of my clients over.
Re:Heroku: We’ve Heard Your Feedback by denysvitali on Saturday May 07, 2022 @04:18AM (#31292972)
Cloud Foundry maybe? Some companies are offering it as a service (e.g: IBM Cloud Foundry)
Re:Heroku: We’ve Heard Your Feedback by realusername on Saturday May 07, 2022 @03:00AM (#31292704)
There's Clever Cloud which I use personally
Re:Heroku: We’ve Heard Your Feedback by ryantgtg on Saturday May 07, 2022 @12:03PM (#31295724)
Youch.

I have paid apps and free apps (staticman comment processing, and very simple apps I create while following learning tutorials). This project sounds bad! I’ve been slowly exploring alternatives, and was about to abandon my search due to demands on my time. Guess I need to keep exploring.

Re:Heroku: We’ve Heard Your Feedback by chillfox on Friday May 06, 2022 @11:51PM (#31292015)
Well, that’s sad. I guess it’s Fly or Digital Ocean for all future projects then.
Re:Heroku: We’ve Heard Your Feedback by oxff on Friday May 06, 2022 @11:53PM (#31292026)
There is some comparison of DO's App platform and Google's Cloud offerings here if you are interested (not my blog, just found it helpful: https://blog.verygoodsoftwarenotvirus.ru/posts/greener-cloud...)
Re:Heroku: We’ve Heard Your Feedback by gabereiser on Saturday May 07, 2022 @12:03AM (#31292072)
Don’t forget render.com
Re:Heroku: We’ve Heard Your Feedback by ralston3 on Friday May 06, 2022 @10:03PM (#31291543)
When I got an email from Salesforce talking about Heroku I assumed phishing. Huge +1 on that 2nd point :)
Re:Heroku: We’ve Heard Your Feedback by ev1 on Friday May 06, 2022 @09:30PM (#31291374)
re: 2

interestingly, when i log in or reauthenticate, or log in through the heroku cli, I get sent to https://verify.salesforce.com/v1/verify/

Re:Heroku: We’ve Heard Your Feedback by izzygonzalez on Friday May 06, 2022 @09:47PM (#31291456)
When I saw the Salesforce email I thought I was being spammed or phished or getting a job offer.
Re:Heroku: We’ve Heard Your Feedback by booi on Friday May 06, 2022 @10:00PM (#31291528)
Those are all the same thing
Re:Heroku: We’ve Heard Your Feedback by zebraflask on Friday May 06, 2022 @10:39PM (#31291714)
This all somehow seems unsurprising. If anyone has tried to use Heroku in easily the last year, the number of times you get failed builds over really trivial things is noticeable.
Re:Heroku: We’ve Heard Your Feedback by ryantgtg on Friday May 06, 2022 @11:06PM (#31291822)
I haven’t experienced a failed build in a few years.

I did try a heroku competitor recently and my builds failed. And there was no detailed log to show why. So I couldn’t troubleshoot it and I immediately gave up!

As an aside, I was really hoping this post was going to be “we read that one competitor’s blog post last week clearly detailing all the areas where we can improve, and we HEAR you.”

Re:Heroku: We’ve Heard Your Feedback by quassy on Saturday May 07, 2022 @05:19AM (#31293163)
Considering how badly Salesforce handled communication and bug fixing of log4shell in Tableau that's not really surprising.