4 ms·

This doesn't help my impression of Digital Ocean at all (even if I am a paying customer currently). A few years ago you could impersonate Digital Ocean staff on

by flexd 10y ago

This doesn't help my impression of Digital Ocean at all (even if I am a paying customer currently). A few years ago you could impersonate Digital Ocean staff on their support pages with no effort. They grabbed the username from your email, so whatever you put in front of the @ becamse your username on the forums, visible to everyone. And the avatar came from one of those email->avatar services where you can sign up and set it to anything. So when I signed up with a username like digitalocean@mydomain.com, I ended up being called "digitalocean" on the support forums, and if I had wanted I could just change the avatar to the Digital Ocean logo and impersonate DO or anyone else. I tried reporting it but got pretty much the same answer as this guy (though I did not get banned). Luckily they fixed it like a year later. Great write-up, and interesting problem! I wonder if more hosting providers are vulnerable to the same problem.

jsmthrowaway 10y ago
I can think of at least Cloudflare (somewhat), Linode, and Hurricane Electric off the top of my head. Anybody who operates a well-known ns1 type of resolver. It's more a problem with zone hygiene than hosts, honestly.
- deleted 10y ago
  [deleted]
- stestagg 10y ago
  This seems like a great candidate for an ACME style protocol. I would totally support the ACME spec being expanded to cover this, and various other domain verification related issues
  - corobo 10y ago
    Or just claim your domain if you point it at a DNS service..
- ilogik 10y ago
  Cloudflare does something similar to AWS. Each user gets different nameservers
  - electroly 10y ago
    Is that true? The nameserver I was given by CloudFlare is "nelly.ns.cloudflare.com". From some cursory searches, it seems like a large number of domains have that same nameserver. AWS nameserver hostnames have all kinds of numbers in them that seem a lot more like they're generated per user.
    - jsmthrowaway 10y ago
      It's not true at all, no. I got "dan" on two or three different accounts.
    - dividuum 10y ago
      While you can generate unique hostnames of name servers per user you can't assign all of them unique IP addresses (at least in IPv4) as dns resolving doesn't have anything like vhosts (why should it?). So there will be overlap. Which is not a problem as long as the set of name servers for one users doesn't overlap the set of name servers for another user for a single domain. So you confirm that a set of name server belongs to a user by verifying that its domain record has those name servers configured. You then don't allow another user to control the same name servers for that domain as long as the domain record still points to them. New users can then freely create new name servers but the domain still uses the servers assigned to by the domain owner. What DO does is that it allows any user to control the name server for a domain if the previous owner gives up control of them. It should only do that, once the domain records start pointing anywhere else.
kuschku 10y ago
And the ban reminds me of the recent case, where DO invalidated the credits of many people within of 2 weeks with a simple TOS change. I had to pay 5€ to even be able to add the 100$ credit from the GitHub students pack to my account (for "verification purposes"), and then they – illegally – delete it just like that? (I never got to use any of it) DO is one of the shadiest hosters I know.
- Artemis2 10y ago
  They changed their ToS a year before, you got a notice to review them. What's illegal about revoking promotional credit? https://www.digitalocean.com/company/blog/details-on-expiring-digitalocean-credits https://www.digitalocean.com/company/blog/details-on-expirin...
  - kuschku 10y ago
    No, they changed their ToS in March, and invalidated all coupons older than April of the year before by April. That left me just 2 weeks. And what’s illegal is that in Germany, promotional credit or coupons given without a time limit is valid for at least 3 years.
    - Artemis2 10y ago
      Here are their terms from March 2015: http://web.archive.org/web/20150309163745/https://www.digitalocean.com/legal/terms http://web.archive.org/web/20150309163745/https://www.digita...
- jarland 10y ago
  On one hand, the policy change was made a year prior. On the other hand, we didn't communicate it as well as we should have. I apologize for that. I consider myself as much responsible as anyone else on that. If you ever want that account credit back, please let me know. I'm an easy find on Google, or you can open a support ticket anytime. For what it's worth, we posted on our blog about just this. https://www.digitalocean.com/company/blog/details-on-expiring-digitalocean-credits/ https://www.digitalocean.com/company/blog/details-on-expirin...

by flexd 10y ago

jsmthrowaway 10y ago

I can think of at least Cloudflare (somewhat), Linode, and Hurricane Electric off the top of my head. Anybody who operates a well-known ns1 type of resolver. It's more a problem with zone hygiene than hosts, honestly.

deleted 10y ago
[deleted]
stestagg 10y ago
This seems like a great candidate for an ACME style protocol. I would totally support the ACME spec being expanded to cover this, and various other domain verification related issues
- corobo 10y ago
  Or just claim your domain if you point it at a DNS service..
ilogik 10y ago
Cloudflare does something similar to AWS. Each user gets different nameservers
- electroly 10y ago
  Is that true? The nameserver I was given by CloudFlare is "nelly.ns.cloudflare.com". From some cursory searches, it seems like a large number of domains have that same nameserver. AWS nameserver hostnames have all kinds of numbers in them that seem a lot more like they're generated per user.
  - jsmthrowaway 10y ago
    It's not true at all, no. I got "dan" on two or three different accounts.
  - dividuum 10y ago
    While you can generate unique hostnames of name servers per user you can't assign all of them unique IP addresses (at least in IPv4) as dns resolving doesn't have anything like vhosts (why should it?). So there will be overlap. Which is not a problem as long as the set of name servers for one users doesn't overlap the set of name servers for another user for a single domain. So you confirm that a set of name server belongs to a user by verifying that its domain record has those name servers configured. You then don't allow another user to control the same name servers for that domain as long as the domain record still points to them. New users can then freely create new name servers but the domain still uses the servers assigned to by the domain owner. What DO does is that it allows any user to control the name server for a domain if the previous owner gives up control of them. It should only do that, once the domain records start pointing anywhere else.

kuschku 10y ago

And the ban reminds me of the recent case, where DO invalidated the credits of many people within of 2 weeks with a simple TOS change. I had to pay 5€ to even be able to add the 100$ credit from the GitHub students pack to my account (for "verification purposes"), and then they – illegally – delete it just like that? (I never got to use any of it) DO is one of the shadiest hosters I know.

Artemis2 10y ago
They changed their ToS a year before, you got a notice to review them. What's illegal about revoking promotional credit? https://www.digitalocean.com/company/blog/details-on-expiring-digitalocean-credits https://www.digitalocean.com/company/blog/details-on-expirin...
- kuschku 10y ago
  No, they changed their ToS in March, and invalidated all coupons older than April of the year before by April. That left me just 2 weeks. And what’s illegal is that in Germany, promotional credit or coupons given without a time limit is valid for at least 3 years.
  - Artemis2 10y ago
    Here are their terms from March 2015: http://web.archive.org/web/20150309163745/https://www.digitalocean.com/legal/terms http://web.archive.org/web/20150309163745/https://www.digita...
jarland 10y ago
On one hand, the policy change was made a year prior. On the other hand, we didn't communicate it as well as we should have. I apologize for that. I consider myself as much responsible as anyone else on that. If you ever want that account credit back, please let me know. I'm an easy find on Google, or you can open a support ticket anytime. For what it's worth, we posted on our blog about just this. https://www.digitalocean.com/company/blog/details-on-expiring-digitalocean-credits/ https://www.digitalocean.com/company/blog/details-on-expirin...