6 ms·

TO: ANY DIGITAL-OCEAN USER, This is an absolutely terrible response from DO. If I had anything hosted here, I'd move away ASAP. Seriously, do it.

sattoshi 10y ago
I should leave the most reliable host I had to date because someone was messing around with things he shouldn't be? DO knows people can do this, but they don't want people to do it. Remembering 2 recurring DNS servers is easier for bulk management than a bunch of different ones. You don't test services like that, it can negatively affect other users. Response wasn't perfect but it was reasonable.
- timv 10y ago
  > Response wasn't perfect but it was reasonable I'm sorry, "We aware that we make it easy for about 20k domains to be directed to a malicious host, but we're not going to do anything about it" is reasonable? But of course, it's because Matt "was messing around with things he shouldn't be". It's all solved - we just need everyone to stop doing things that DO "don't want people to do".
  - MichaelGG 10y ago
    Meh the owners of the domains gave up control by pointing to someone else's nameservers.
    - Dylan16807 10y ago
      You've just condemned 99% of domains. You really think that's reasonable?
      - ZoF 10y ago
        I do think it's reasonable. If the domain is added to the account there is no PoC, it's only for domains that have been removed from accounts but still have the nameserver values(meaning the domain is not being used at this point, there's no zone file if it isn't added to an account). So this is mostly only going to affect currently derelict domains. I'm not saying it isn't something to worry about, but I do think it's a reasonable solution.
        Dylan16807 10y ago
        What you just described as reasonable is not the scenario I asked about, which is just "pointing to someone else's nameservers".
      - MichaelGG 10y ago
        Huh? 99% of domains point to some nameserver they aren't contracting service? That is, 99% have invalid NS? (Obviously when I say somebody else's NS I mean a NS they have zero reason to think would respond with correct records. Obviously not talking about outsourcing DNS hosting.)
      - quacker 10y ago
        If I buy a domain from a registrar, I can point the registrar at Digital Ocean's nameservers (or AWS, CloudFlare, etc) for my domain (by adding NS records at the registrar). Then I need to go to Digital Ocean and add my domain and records to their nameservers (via their control panel or api). If I remove my domain from Digital Ocean, it's my responsibility to then go to the registrar and point the registrar away from DigitalOcean's nameservers. (I own the domain, so I'm the only one the registrar allows to do this. Digital Ocean cannot do this.) Now, your suggestion is that Digital Ocean goes and verifies that I'm the one who owns that domain. But how would they do this (legitimate question)? I imagine manual verification of ownership of every domain upon creation isn't feasible for their scale. Digital Ocean could query DNS, and see NS records pointing to Digital Ocean, but this only tells them someone configured the nameservers for that domain - it doesn't imply ownership. Digital Ocean can check Whois for the owner of the domain. Checking Whois might work for many cases, but at least some registrars have the option of obscuring Whois data. It seems simpler to put the onus of security on the owner of the domain. I should cleanup my registrar's NS records before removing my domain from Digital Ocean to ensure nobody hijacks it. I would be satisfied as long as Digital Ocean maintained a simple eviction policy (I don't know if they do) as a way for legitimate owners to add their domains to Digital Ocean's nameservers.
- voltagex_ 10y ago
  Except a (theoretical?) attacker isn't going to stick with the things they're "meant" to do. I'd much rather know about this vulnerability via a researcher than when a high profile company loses control of their accounts / domains.
  - ultramancool 10y ago
    Except this isn't even a vulnerability, this is expected behavior given the design I think, to encounter an issue with it, you'd need to leave your domain with DO's nameservers, but delete it from your account. This would only happen if it's something you're not using anymore, or if you're a severely terrible admin.
    - timv 10y ago
      > this isn't even a vulnerability, this is expected behavior given the design Those aren't mutually exclusive. It's certainly possible to be broken by design. > This would only happen if it's something you're not using anymore From the writeup it seems like it would also happen if you registered a new domain and assigned the DO name-servers but didn't immediately point it to something.
      - ultramancool 10y ago
        Typically when registering a new domain you add it on your panel first and then change the NS as instructed. If you didn't follow that order, well, that's on you. It's the same design just about everyone providing DNS uses (CloudFlare, XName, FreeDNS, probably others).
        Cpoll 10y ago
        But DO instructs you to do it in the reverse order: https://www.digitalocean.com/community/tutorials/how-to-set-up-a-host-name-with-digitalocean https://www.digitalocean.com/community/tutorials/how-to-set-...
        deleted 10y ago
zatkin 10y ago
Do you know of an alternative that can host an instance of FreeBSD?
- anilgulecha 10y ago
  I'm familiar only with AWS, and it supports FreeBSD.
  - eropple 10y ago
    "Supports" is a strong phrase. Colin Percival creates FreeBSD AMIs. They work mmmmmostly as you might expect, except there's no cloud-init (instead it uses a gizmo that cperciva wrote), but AWS doesn't support it--that's a community thing.
- cyphar 10y ago
  I believe Vultr offers FreeBSD (and custom ISO) hosting at about the same price and offers storage servers too. Their documentation and remote console tools leave a lot to be desired though (I wanted to install openSUSE and ended up resorting to manually entering the iPXE commands at a console to get the damn thing installed).
  - nicolas_t 10y ago
    Their support also leaves a lot to be desired. Had a persistent network problem due to a misconfiguration of their system and it took two weeks of back and forth before they really looked into it.
  - deleted 10y ago
    [deleted]
  - po1nter 10y ago
    Are Vuktr and DigitalOcean related in any way? their websites look really similar down to the animation that shows you how to create a new droplet/server.
    - 10y ago
ultramancool 10y ago
It's pretty understandable actually. Most DNS providers do similar, it's really just the admins fault for not switching their DNS, likely because they were abandoned and unused.
icebraining 10y ago
Meh, it was just mild incompetence. I expect the only providers (hell, large companies in general) who never responded this way are the ones who haven't been around long enough.
- deleted 10y ago
  [deleted]
tombrossman 10y ago
I have an account with DigitalOcean (and several competitors) and I'm not going anywhere or moving any sites around because of this. Sure, they could have handled things better and the security researcher could have too. I don't see any malice or incompetence here, nor do I see a reason to make the effort to switch to another provider. Where are you going to run off to? How is their security better over there? How many hours of work does that involve?
- anilgulecha 10y ago
  Allowing adding a domain without verifying ownership, and banning someone who reported a security issue isn't incompetence? I think you're looking more kindly on their security practices than most folks in the security world would.
  - corobo 10y ago
    Banning someone who added 20k domains to their account. There's a difference between reporting a security issue and blatantly abusing their services.
hetfeld 10y ago
Already thinking about it.
deleted 10y ago
[deleted]

sattoshi 10y ago

I should leave the most reliable host I had to date because someone was messing around with things he shouldn't be? DO knows people can do this, but they don't want people to do it. Remembering 2 recurring DNS servers is easier for bulk management than a bunch of different ones. You don't test services like that, it can negatively affect other users. Response wasn't perfect but it was reasonable.

timv 10y ago
> Response wasn't perfect but it was reasonable I'm sorry, "We aware that we make it easy for about 20k domains to be directed to a malicious host, but we're not going to do anything about it" is reasonable? But of course, it's because Matt "was messing around with things he shouldn't be". It's all solved - we just need everyone to stop doing things that DO "don't want people to do".
- MichaelGG 10y ago
  Meh the owners of the domains gave up control by pointing to someone else's nameservers.
  - Dylan16807 10y ago
    You've just condemned 99% of domains. You really think that's reasonable?
    - ZoF 10y ago
      I do think it's reasonable. If the domain is added to the account there is no PoC, it's only for domains that have been removed from accounts but still have the nameserver values(meaning the domain is not being used at this point, there's no zone file if it isn't added to an account). So this is mostly only going to affect currently derelict domains. I'm not saying it isn't something to worry about, but I do think it's a reasonable solution.
      - Dylan16807 10y ago
        What you just described as reasonable is not the scenario I asked about, which is just "pointing to someone else's nameservers".
    - MichaelGG 10y ago
      Huh? 99% of domains point to some nameserver they aren't contracting service? That is, 99% have invalid NS? (Obviously when I say somebody else's NS I mean a NS they have zero reason to think would respond with correct records. Obviously not talking about outsourcing DNS hosting.)
    - quacker 10y ago
      If I buy a domain from a registrar, I can point the registrar at Digital Ocean's nameservers (or AWS, CloudFlare, etc) for my domain (by adding NS records at the registrar). Then I need to go to Digital Ocean and add my domain and records to their nameservers (via their control panel or api). If I remove my domain from Digital Ocean, it's my responsibility to then go to the registrar and point the registrar away from DigitalOcean's nameservers. (I own the domain, so I'm the only one the registrar allows to do this. Digital Ocean cannot do this.) Now, your suggestion is that Digital Ocean goes and verifies that I'm the one who owns that domain. But how would they do this (legitimate question)? I imagine manual verification of ownership of every domain upon creation isn't feasible for their scale. Digital Ocean could query DNS, and see NS records pointing to Digital Ocean, but this only tells them someone configured the nameservers for that domain - it doesn't imply ownership. Digital Ocean can check Whois for the owner of the domain. Checking Whois might work for many cases, but at least some registrars have the option of obscuring Whois data. It seems simpler to put the onus of security on the owner of the domain. I should cleanup my registrar's NS records before removing my domain from Digital Ocean to ensure nobody hijacks it. I would be satisfied as long as Digital Ocean maintained a simple eviction policy (I don't know if they do) as a way for legitimate owners to add their domains to Digital Ocean's nameservers.
voltagex_ 10y ago
Except a (theoretical?) attacker isn't going to stick with the things they're "meant" to do. I'd much rather know about this vulnerability via a researcher than when a high profile company loses control of their accounts / domains.
- ultramancool 10y ago
  Except this isn't even a vulnerability, this is expected behavior given the design I think, to encounter an issue with it, you'd need to leave your domain with DO's nameservers, but delete it from your account. This would only happen if it's something you're not using anymore, or if you're a severely terrible admin.
  - timv 10y ago
    > this isn't even a vulnerability, this is expected behavior given the design Those aren't mutually exclusive. It's certainly possible to be broken by design. > This would only happen if it's something you're not using anymore From the writeup it seems like it would also happen if you registered a new domain and assigned the DO name-servers but didn't immediately point it to something.
    - ultramancool 10y ago
      Typically when registering a new domain you add it on your panel first and then change the NS as instructed. If you didn't follow that order, well, that's on you. It's the same design just about everyone providing DNS uses (CloudFlare, XName, FreeDNS, probably others).
      - Cpoll 10y ago
        But DO instructs you to do it in the reverse order: https://www.digitalocean.com/community/tutorials/how-to-set-up-a-host-name-with-digitalocean https://www.digitalocean.com/community/tutorials/how-to-set-...
        deleted 10y ago

zatkin 10y ago

Do you know of an alternative that can host an instance of FreeBSD?

anilgulecha 10y ago
I'm familiar only with AWS, and it supports FreeBSD.
- eropple 10y ago
  "Supports" is a strong phrase. Colin Percival creates FreeBSD AMIs. They work mmmmmostly as you might expect, except there's no cloud-init (instead it uses a gizmo that cperciva wrote), but AWS doesn't support it--that's a community thing.
cyphar 10y ago
I believe Vultr offers FreeBSD (and custom ISO) hosting at about the same price and offers storage servers too. Their documentation and remote console tools leave a lot to be desired though (I wanted to install openSUSE and ended up resorting to manually entering the iPXE commands at a console to get the damn thing installed).
- nicolas_t 10y ago
  Their support also leaves a lot to be desired. Had a persistent network problem due to a misconfiguration of their system and it took two weeks of back and forth before they really looked into it.
- deleted 10y ago
  [deleted]
- po1nter 10y ago
  Are Vuktr and DigitalOcean related in any way? their websites look really similar down to the animation that shows you how to create a new droplet/server.
  - 10y ago

ultramancool 10y ago

It's pretty understandable actually. Most DNS providers do similar, it's really just the admins fault for not switching their DNS, likely because they were abandoned and unused.

icebraining 10y ago

Meh, it was just mild incompetence. I expect the only providers (hell, large companies in general) who never responded this way are the ones who haven't been around long enough.

deleted 10y ago
[deleted]

tombrossman 10y ago

I have an account with DigitalOcean (and several competitors) and I'm not going anywhere or moving any sites around because of this. Sure, they could have handled things better and the security researcher could have too. I don't see any malice or incompetence here, nor do I see a reason to make the effort to switch to another provider. Where are you going to run off to? How is their security better over there? How many hours of work does that involve?

anilgulecha 10y ago
Allowing adding a domain without verifying ownership, and banning someone who reported a security issue isn't incompetence? I think you're looking more kindly on their security practices than most folks in the security world would.
- corobo 10y ago
  Banning someone who added 20k domains to their account. There's a difference between reporting a security issue and blatantly abusing their services.

hetfeld 10y ago

Already thinking about it.

deleted 10y ago

[deleted]