nzadrozny

Perhaps telling that none of the Found team are still at Elastic, from what I can tell on LinkedIn. I pay attention to that kind of stuff because (full disclosure) I operate the _other_ small customer-focused managed Elasticsearch company (bonsai.io) that _didn't_ get acquired by Elastic back in 2015.

They would have to triple-quintuple-backflip-down on "open." So, maybe? It depends on how much value is being created besides the code, in squishier parts of the business like service, support, pricing models, marketing, and so on.

But it's moot, since Apache Lucene is part of the Apache Software Foundation and has much stronger promises about its licensing and governance. Which is not a small reason why Lucene is the de facto standard for search technology.

> I wonder why they don't tell that AWS is their service provider.

It's because Heroku's choice of vendors shouldn't matter to their customers. They see it as an implementation detail, and their responsibility to manage.

So I don't think that's an obfuscation. The people I know at Heroku all have an attitude of, "The buck stops here."

And a high bar, too, which is good for everyone.

> Can add-ons be launched inside a private space?

Addon provider here: haven't heard anything official from Heroku on this, so this is my own personal speculation based on the current public Provider API. It seems that Heroku Postgres and Redis are available, and while they're _technically_ addons, they naturally have access to somewhat privileged APIs and architectural information that other addons do not have.

Currently, when an addon is provisioned, we're given a region identifier for the US East and EU public regions. My uninformed guess is that Private Spaces amounts to "your dynos run on servers in a private VPC." IF the Postgres and Redis integrations were "quick 'n dirty," they could very well get provisioned within the same VPC. However, it also seems plausible that AWS VPC peering can be used for other addons to provide their own Private Spaces support.

So it seems to me the question comes down to whether Heroku can (and/or _wants_ to) support VPC pairing with addons via their Provider API, so that other providers can provide their own private spaces.

Seems that "S3 offline" is the AWS equivalent of a datacenter falling into the ocean. Gotta wonder how many services are using S3 as a faux message queue?

Hmm. Considering Heroku dynos start at $0/mo for development, that may be an apples and oranges comparison here ;)

In the context of reasonable hobby/development costs, I our $10/mo plan fits well for that and is pretty popular. Pricing wise it compares well to a $7 dyno or $9 Postgres instance. And addons are prorated to the second, just like dynos.

Relevant to my interests. Founder of ES host Bonsai.io.

Echoing mrkurt, ES is indeed hefty to run.

Elasticsearch is going to require a hundred+ megs of RAM just to run an empty node. And then you'll want enough heap and CPU that you're not GCing yourself to death while importing data, or while churning through filter and caches. And then enough memory to run those fancy aggregations in Kibana. Times the number of nodes you want for redundancy, and for your master-role quorum.

It's possible to do long-tail low-volume ES hosting for hobby development. But to do so you need to dig in and consider ES hosting as a holistic system. We've worked hard at Bonsai to build a hobbyist-friendly hosting system. Our approach is to fork ES itself to introduce native multi-tenancy. That means everyone in the cluster is amortizing the overhead of all that JVM memory (and redundant data nodes, and master-node quorum, a load balancer and authenticating reverse proxy, and analytics... etc...)

The problem remains that ES, while easy to spin up, is still a pretty heavy system to manage at scale. So it's generally a lot easier to chuck some extra resources at it, maximize your isolation, and eat the higher entry cost.

Seems like the closest we've got is OAuth with your Google/Facebook/GitHub/Twitter account.

> He did not say web or browser. He said nodejs.

Indeed; more generally, I said CLI. TLDR of the previous link: it's an interesting general-purpose take on using ssh public/private keys (and methods) to sign and authenticate HTTP requests.

It wasn't a management console compromise, it was an old API key that got leaked.

Hey all, Bonsai cofounder here.

It was an old API access key that got leaked, not our account credentials. We're still investigating how and where the key got leaked, but bottom line, it should have been revoked ages ago.

2FA is great, but it doesn't cover API keys. Rotate your API keys!

Probably an SEO/branding move for Algolia.