I'm simply telling you Heroku is not a stable platform that you can trust. It's up to you to figure out what to do. I haven't offered any solutions.
Just because it's a slick product to get going doesn't mean that you can trust it to be a reliable and secure host—or be around for the long-term.
I think it's obvious an ecosystem without a Heroku will help the upstarts. I understand that doesn't help you get a new host today. I'm not telling you to just go to another PaaS and expect them to be the next Heroku in a couple of years—chances are they won't be.
I wouldn't move off of Heroku because of the incident. I would move off of them because of their response to the incident.
They plainly lied. Responses take weeks and are very incomplete. They have so few people they can't possibly run a secure, stable system anymore. They don't have a plan or backing from sfdc to get back to a solid foundation.
I can't speak to competitors but I can say with certainty that Heroku is simply not an option for you anymore. Whether that means you use another PaaS or fire up an EC2 instance yourself you must move away at this point.
tl;dr: Heroku is taking customers away that if competitors had it: they would be able to receive more capital
It's not unlike Google Search. Google Search has atrophied over the years but because it's still the best in the market, it's used by almost everyone. Competition is hard to build because it has to be better than Google Search in order to bother using it.
Heroku competitors have struggled in part because Heroku is a fully featured platform. It's relatively easy to build a platform that ticks a couple of boxes really well but building something that matches Heroku in feature parity is a daunting task. In order for competition to get there they need customers and funding, and funding is way easier to get the more customers come in through the door.
Once Heroku dies (perhaps already since this incident) we'll start to see real competition in this space because their competition will be getting used. The PaaS space needs that oxygen Heroku is taking up.
> We value transparency and wanted to notify you of an issue affecting your account.
My guess is they sent it to users with pipelines that have env vars. It's funny since this sentence demonstrates they don't value transparency by not telling the other users more information about the hack.
They updated Heroku Status but surprisingly failed to mention anything about CI or pipelines.
Well hopefully once it's gone the competition will be able to get more market share to build quality product. Heroku has been starving the entire ecosystem for years.
I don't have experience with any other PaaS's so I can't recommend one, but what you say is what I commonly hear.
> We also wanted to address a question regarding impact to environment variables. While we confirmed that the threat actor had access to encrypted Heroku customer secrets stored in config var, the secrets are encrypted at rest and the threat actor did not access the encryption key necessary to decrypt config var secrets.
Nowhere in that did it clarify it was speaking of app but not pipeline env vars. They had plenty of time to author that post too. Make sure you rotate those app env vars anyways as this somehow appears to be getting worse by the week.
Yep, they outright lied about env vars. Incredible.
It pains me to see even occasional defenders of Heroku. They're not the company they were 10 years ago. They've been gutted and left for dead years ago but the product was so good nobody noticed until now.
They're not to be trusted as your platform. They simply don't have anywhere close to the manpower required to run such a platform. This was a when not if situation.
If you're still on it, make your plans to move away now. Time is ticking until a major outage or another security incident like this one. See my comment history and related threads for more. Specifically this summary: https://news.ycombinator.com/item?id=31374048
At one point (a very long time ago now) it was declared that Dogwood was the future and as a result Go would be the language of choice at Heroku and Erlang would be no more.
Trouble is that Erlang ran all the important Cedar code (it might still today) and the Erlang engineers didn't particularly like the news that Erlang code was essentially deprecated so they left and nobody knew how to maintain the stack. This definitely wasn't the only problem we had but it was a big one.
What do fellow Herokai think? Was Dogwood a fool's errand? Or did we just not get enough staff to build it properly?
As someone that was a very active Heroku user for years and then worked there for years: I wouldn't trust it as my host. There is nowhere near enough people maintaining it in order to have confidence it'll run without reliability or security issues. They aren't exactly in a position to retain or attract talent either.
I thought Cedar was going to fall over years ago but ironically I think people migrating off the platform are helping it stay alive.
You may not have been happy with pricing but it really wasn't our reason for failing. We made plenty of money, see our former CEO's comment here: https://news.ycombinator.com/item?id=31373300
I bet if we had 10x the revenue we still might've had the same outcome. When you're a relatively small part of a big corporation standard capitalism rules don't really apply.
The only way they're going to succeed is if sfdc quadruples (or more) their headcount. We were struggling with product development and maintenance with the skeleton crew we had back in 2015 and probably had 3x as many people then.
You support folks were absolutely stellar. Great at working with customers but also adept at coding enough to resolve an incredible amount of customer problems.
If anyone is ever in a position to hire support staff and you see "Heroku" on the resume, definitely consider that a strong positive signal.
Strange to me that you put Dropbox on here since they've really struggled to succeed on their own. I think Steve Jobs was right when he said it was a "feature, not a product." Selling to Google or Apple I think would've been the better move in hindsight.
Snapchat is probably a good example of a company that made the right move by not being acquired.
I agree with you. There is something about Salesforce in particular I feel people don't trust to be a good steward of acquired products.
I don't feel it's deserved even though I worked for an acquired company that certainly did fail because of their leadership—I think we were the exception though. For Mulesoft, Tableau, Quip: I don't think it's clear these would be successful companies on their own.
They paid a ton of money for Slack and need to protect that investment.
Is there a clear example of Salesforce failing at an acquisition? Or do people see the examples I gave above differently than I do?
Agreed. Heroku was an incredible success but using it in 2022 would be downright negligence.
(Although I would argue that Salesforce was also responsible for creating most of what we love about Heroku. That acquisition happened far earlier than people realize. They're also almost entirely responsible for its downfall.)
EDIT: Craig is right below (and he pretty much always is). When I said "created" I really meant in terms of giving them enough financial resources to keep building. SFDC exerted no influence in terms of product decisions early on (so far as I know). Re-reading my post I see that wasn't clear.
12 years ago! Heroku of 2010 was a success. Heroku of 2015 was a success. Heroku of 2022 is a zombie of its former self headed straight towards implosion.
* They seemingly can't recover from this GitHub debacle (it's been a month without GitHub Sync).
* They had a massive security breach where core-db was breached. Hashed user passwords and encrypted env vars were leaked. (And a hell of a lot more I bet—but they haven't admitted this)
* They're operating with probably 1/3 the staff they were at peak due to attrition with no backfill and a layoff.
Just because it's a slick product to get going doesn't mean that you can trust it to be a reliable and secure host—or be around for the long-term.
I think it's obvious an ecosystem without a Heroku will help the upstarts. I understand that doesn't help you get a new host today. I'm not telling you to just go to another PaaS and expect them to be the next Heroku in a couple of years—chances are they won't be.