jarcoal
Joined 15 years ago
Joined 15 years ago
I used the "Instructions" field to indicate he is only a child and to interact with him appropriately, and overall it does a decent job keeping the language somewhat simple when chatting with him.
I remember using both of those clients.
This whole operation could be wildly profitable with a team of 50-100 people and no major investors to appease.
Instead they read the room wrong, or just didn't care, and now we're here.
2. Are people excited about my thing? Am I excited about it?
3. Have I made the wrong life choices?
4. This makes me feel uncomfortable.
5. If I can defend my life choices I can feel good again.
6. I will downplay this thing, that will resolve my uncomfortable feelings.
Assuming that's true, it should be trivial for GitHub to tell them which third party integration the token was associated with.
> A statement that confirms whether or not config variables and secrets were accessed, or that you're not sure, needs to be sent out.
To which they replied:
> We currently have no evidence that Heroku customers’ secrets stored in config Var were accessed. If we find any evidence of unauthorized access to customer secrets, we will notify affected customers without undue delay.
Take that as you will, but it doesn't fill me with confidence.
For those of you that haven't been following, Heroku has been adding non-update updates to this security thread over the last couple of weeks, which began with the announcement that some (or maybe all) of their GitHub granted access tokens had been compromised: https://status.heroku.com/incidents/2413
Now, weeks later, we're hearing that all account passwords are being reset, and for some reason if you have been using an HTTPS-style log drain that you should reset any secrets related to it as well.
Heroku needs to come out and clearly state what they know about this situation, and more importantly what they don't know -- which is starting to sound like the answer is "a lot". It's not even clear they know how this all happened -- whatever door was left open might still be open. So if you've gone and rotated all of your application secrets (which you probably should do), be prepared to rotate them again when this is all over.