News for hackers. Stuff that matters.
Re:Heroku CI and Review App Secrets Compromised by hkhanna on Tuesday May 17, 2022 @10:16PM (#31418560)
I spent the last two days migrating my company to Render from Heroku, and now I'm glad I did. Render is a little rough around the edges; Heroku is far more polished.

But it's probably to Render's credit that, in my opinion, the most annoying thing about Render is that it's impossible to google about Render because "render" is such a common word in the tech world!

Their support is good and responsive, and the developer experience was good enough. It has some warts, and there were definitely times I missed Heroku, but their speed of improvement gives me confidence in their future.

Sad to leave Heroku after almost a decade with them. They were far ahead of their time.

Re:Heroku CI and Review App Secrets Compromised by anurag on Tuesday May 17, 2022 @11:19PM (#31418894)
(Render founder) Thank you for the support. You might have shared this with our support engineers already but I'd love to hear about what you missed from Heroku (email in profile). We're building Render for the very long term and every bit of feedback helps, even if we can't get to it right away.
Re:Heroku CI and Review App Secrets Compromised by lebaux on Wednesday May 18, 2022 @01:55AM (#31419652)
The bit about the unfortunate name of the product should be taken more seriously. I understand you got that sexy .com domain, and you are here for the long run, but it is currently doing a disservice. My 2c :)
Re:Heroku CI and Review App Secrets Compromised by herodoturtle on Wednesday May 18, 2022 @03:46AM (#31420238)
Not sure I agree with this, hear me out please :-)

People who don’t know about Render won’t be googling “render” - instead they’ll be googling something else (along the lines of what render offers), and then perhaps discover render in the results.

And of course people who know about Render won’t ever need to google it, because of that “sexy .com” :-)

Edit: perhaps you meant googling about Render’s features/docs/how-tos? Granted this might be trickier!

Re:Heroku CI and Review App Secrets Compromised by andrewflnr on Wednesday May 18, 2022 @04:46AM (#31420534)
I'm almost certain they were talking about googling docs etc as mentioned in your edit. That would definitely be my concern.
Re:Heroku CI and Review App Secrets Compromised by I_dev_outdoors on Wednesday May 18, 2022 @10:04AM (#31422914)
I agree with you, that's what they meant. Just like Go is referred to as golang by the community, maybe render can be referred to as rendercloud.
Re:Heroku CI and Review App Secrets Compromised by ryantgtg on Wednesday May 18, 2022 @08:12PM (#31429175)
I'm not a power user but including the string "render.com" instead of "render" seems to help. I noticed that because I saw some youtube vid titles referring to it that way.
Re:Heroku CI and Review App Secrets Compromised by ryantgtg on Wednesday May 18, 2022 @08:22PM (#31429223)
(Not parent) I started my migration last night. Overall, great experience! The heroku addon worked great. I was very impressed that the build succeeded and I had my site working in a very short time, with sendgrid and all that working. Only minor misstep for me was when pg_restore didn't work because by default Access Control has no entries and the migration doc didn't mention having to add one.

The much more significant issue for me is that I honestly have no real clue what to make of Jobs. In Heroku I use Scheduler to run rake tasks. And in Render there's an API Explorer (and my rake tasks fail when I attempt to run them through that) and then I'm supposed to add crons to... my repo (?), and the Jobs I create go... somewhere. I am very confused. I've read the Jobs and Cron Jobs docs like 40 times.

Re:Heroku CI and Review App Secrets Compromised by anurag on Friday May 20, 2022 @04:23PM (#31452093)
Good to hear you liked Render, and sorry for the confusion between Jobs and Cron Jobs (we have an open task to improve docs for both).

Heroku Scheduler = Cron Jobs on Render. Would you mind emailing me (see profile) or [email protected] with details on your Rake tasks so we can take a look?

Re:Heroku CI and Review App Secrets Compromised by ryantgtg on Saturday May 21, 2022 @12:31AM (#31455247)
I emailed support and Alan was super helpful. I think I'm all set (or at least close).

For me, the key was discovering that while both my native and docker builds fail, my Dockerfile.render builds (which use the heroku buildpack) magically work AND I could use that Dockerfile.render build for the Cron Job (I don't think I would have figured out that I could just plop in that Dockerfile Path in the Advanced section).

I have no experience with Docker (someone set up docker-compose stuff for us like 4 years ago as a student project, but I haven't used it). So it was a little overwhelming for me when the Render migration tool thrust Docker on me.

Still testing out some things before configuring my DNS. I'm sure in a week you'll never hear from me again (because things will just work). I enjoy how snappy the Render interface is. Maybe more of a walkthrough (with screenshots) on the cron jobs doc?

Re:Heroku CI and Review App Secrets Compromised by anurag on Sunday May 22, 2022 @04:01PM (#31472139)
We should definitely add more tutorial/walkthrough type docs.
Re:Heroku CI and Review App Secrets Compromised by alx__ on Wednesday May 18, 2022 @01:23PM (#31425321)
I haven't had any issues finding docs via Google

e.g. "render postgres" or whatever specific thing I'm looking for

It's possible my google search is now biased because I've clicked on links for render?

Re:Heroku CI and Review App Secrets Compromised by anurag on Wednesday May 18, 2022 @12:53PM (#31424979)
That's fair. The current workaround is to use the search in our docs, or add 'render.com' to Google queries. Of course, I'd love examples of frustrating searches.
Re:Heroku CI and Review App Secrets Compromised by dbbk on Wednesday May 18, 2022 @06:57AM (#31421248)
I love the look of everything about Render, except its native lack of PHP support. I really don't want to have to use Docker. Do you have any ETA when that will be available?
Re:Heroku CI and Review App Secrets Compromised by anurag on Wednesday May 18, 2022 @12:48PM (#31424924)
No immediate native PHP plans, but we're actively hiring to move faster on all axes.
Re:Heroku CI and Review App Secrets Compromised by pid-1 on Wednesday May 18, 2022 @03:05AM (#31420001)
I don't use Heroku, nor Render, and I definitely think anyone using Heroku should be moving out, but...

Do you have any evidence Render actually takes security seriously?

Not shitting on their platform, I actually never used it, I just think as an industry we should be way past the point we trust platforms by default.

Re:Heroku CI and Review App Secrets Compromised by oxff on Wednesday May 18, 2022 @03:50AM (#31420256)
I asked about this too. Everyone meme'ing these alt platforms essentially assumes they are safer than Heroku by virtue of the fact that Heroku had a pretty severe incident. I haven't actually seen these platforms prove that they're safer than Heroku, they could be as bad or worse in security.
Re:Heroku CI and Review App Secrets Compromised by hthrowaway5 on Wednesday May 18, 2022 @08:23AM (#31421868)
I wouldn't move off of Heroku because of the incident. I would move off of them because of their response to the incident.

They plainly lied. Responses take weeks and are very incomplete. They have so few people they can't possibly run a secure, stable system anymore. They don't have a plan or backing from sfdc to get back to a solid foundation.

I can't speak to competitors but I can say with certainty that Heroku is simply not an option for you anymore. Whether that means you use another PaaS or fire up an EC2 instance yourself you must move away at this point.

Re:Heroku CI and Review App Secrets Compromised by bmulholland on Wednesday May 18, 2022 @08:30AM (#31421947)
I had to switch from Render to Heroku a year or so ago because Render had no security documentation at all. I asked them about it at the time and was told security docs were perhaps six months out. There's still none, so it's clear that demonstrating security is not something that's a priority.
Re:Heroku CI and Review App Secrets Compromised by anurag on Wednesday May 18, 2022 @02:06PM (#31425800)
I agree we haven't focused on demonstrating security, but obviously, internally, we are quite paranoid about it. Still, this comment is well-deserved because as much as we'd like them to, our customers can't simply read our minds.
Re:Heroku CI and Review App Secrets Compromised by anurag on Sunday May 22, 2022 @10:34PM (#31474852)
Update: we now have https://render.com/security
Re:Heroku CI and Review App Secrets Compromised by duckmysick on Wednesday May 18, 2022 @07:13AM (#31421339)
> I just think as an industry we should be way past the point we trust platforms by default.

That's a great point and I fully agree.

I'm struggling to come up with reliable ways of checking security of the companies I'm not familiar with. It's not like I can rely on their landing page. And they are likely not on the market long enough to see how they responded to past security incidents.

The only thing I can think of is checking how they handle registration and logins - but it's not that strong of a signal anyway. Does anyone have other ideas?

Re:Heroku CI and Review App Secrets Compromised by anurag on Wednesday May 18, 2022 @02:14PM (#31425885)
(Render founder) Security and uptime are the only two existential threats to Render, so you can imagine we lose enough sleep over it. We regularly fill out security questionnaires that lead to successful migrations. Still, we can do a better job explaining and documenting our security posture publicly.
Re:Heroku CI and Review App Secrets Compromised by tdfx on Tuesday May 17, 2022 @10:21PM (#31418601)
We just started planning our transition, as well. This was handled so poorly I can't imagine anyone would ever plan to start a new project on their platform.
Re:Heroku CI and Review App Secrets Compromised by wlll on Tuesday May 17, 2022 @10:46PM (#31418724)
What happened?
Re:Heroku CI and Review App Secrets Compromised by PKop on Tuesday May 17, 2022 @10:50PM (#31418750)
Re:Heroku CI and Review App Secrets Compromised by wlll on Wednesday May 18, 2022 @07:16AM (#31421359)
Oh, sorry, I thought the comment was about how the transition was handled poorly. I’m well aware of the slow-motion train crash that is the Heroku incident!
Re:Heroku CI and Review App Secrets Compromised by gault8121 on Tuesday May 17, 2022 @10:38PM (#31418688)
How did the pricing compare? What was the Render server needed to match what you were using with the Heroku Dyno? I run a high-traffic nonprofit edtech app that runs on 3-5 Heroku L Dynos, and I'm curious how well Render will perform at this level.
Re:Heroku CI and Review App Secrets Compromised by hkhanna on Tuesday May 17, 2022 @10:47PM (#31418736)
Off the top of my head, I'd say Render is a little more expensive at the lower tiers and less expensive at the higher tiers.
Re:Heroku CI and Review App Secrets Compromised by rychco on Tuesday May 17, 2022 @10:48PM (#31418746)
I also intend to deploy some new services on render (having previously used Heroku).

I was debating between render & fly, which I've also had my eye on and may still try for something else in the future.

Re:Heroku CI and Review App Secrets Compromised by heartbreak on Tuesday May 17, 2022 @10:57PM (#31418795)
I think Fly will be great, but it's not there yet. I migrated to Render.
Re:Heroku CI and Review App Secrets Compromised by Rastonbury on Wednesday May 18, 2022 @12:08AM (#31419136)
I am considering moving, could you share why Fly wasn't adequate for you?
Re:Heroku CI and Review App Secrets Compromised by Rastonbury on Wednesday May 18, 2022 @12:08AM (#31419135)
Mind sharing why you chose Render over other competitors? Considering the same