Incident Response at Heroku (opens in new tab)

(blog.heroku.com)

83 pointsfomb11y ago9 comments

9 comments

And that's why I pay for Heroku. They let me sleep at night instead of worrying about keeping my stack up to date. I can't afford a dedicated engineer to keep things 'kosher' on my boxes, so Heroku is fantastic in that regard.

I have a pet project up and running on DigitalOcean but my god, it's duct-taped to hell. I don't even know how to apply Nginx patches as they come out without bringing down the website. :(

Thanks Heroku for sharing!

dperfect11y ago

> They let me sleep at night instead of worrying about keeping my stack up to date

I'm not sure what kind of stack you're running on Heroku, but if it happens to be Ruby, Heroku won't do anything (AFAIK) to update gems specified in your Gemfile.lock file when vulnerabilities are found. That's still up to you, and security issues in gems appear to be far more common than those in parts of the infrastructure that Heroku does keep up-to-date.

thinkbohemian11y ago

Generally if it's a large enough security incident and the fix is in gem land, we send out emails. At the end of the day, you're still responsible for security of your own code (and libraries), but we try to help.

andrewvc11y ago

Well, as a former heroku user, I disagree. Sure, your stack is up to date, but then heroku has downtime related to issues with its own architecture from time to time.

Sure, they have a better, larger, ops team than most orgs, but they also need to run a much more complex product. I think its a wash IMHO.

thinkbohemian11y ago

When did you last use Heroku? Have you seen https://status.heroku.com/uptime? It's not five nines, but it's more than most places I've worked :)

1 more reply

j / k navigate · click thread line to collapse

9 comments

sergiotapia11y ago

I have a pet project up and running on DigitalOcean but my god, it's duct-taped to hell. I don't even know how to apply Nginx patches as they come out without bringing down the website. :(

Thanks Heroku for sharing!

dperfect11y ago

> They let me sleep at night instead of worrying about keeping my stack up to date

thinkbohemian11y ago

andrewvc11y ago

Well, as a former heroku user, I disagree. Sure, your stack is up to date, but then heroku has downtime related to issues with its own architecture from time to time.

Sure, they have a better, larger, ops team than most orgs, but they also need to run a much more complex product. I think its a wash IMHO.

thinkbohemian11y ago

When did you last use Heroku? Have you seen https://status.heroku.com/uptime? It's not five nines, but it's more than most places I've worked :)

1 more reply

j / k navigate · click thread line to collapse