3 ms·

Domains can only be added if they are not in another account, so he added only domains which were previously deleted but still pointed to DO nameservers (hence

Domains can only be added if they are not in another account, so he added only domains which were previously deleted but still pointed to DO nameservers (hence almost certainly not being used). And if DO was really concerned about the damage then they would have removed the added A records, but they didn't, they banned the author and continued to let all traffic go to his server.

IanCal 10y ago
> (hence almost certainly not being used) Well they were still being accessed by real people. > And if DO was really concerned about the damage then they would have removed the added A records, but they didn't, they banned the author and continued to let all traffic go to his server. Both seem reasonable. And it does sound like the security team are actually doing something about it. > I reached out to DigitalOcean’s team to see if they can assist in deleting the domains from my account (sadly leaving them vulnerable again) or sinkholing the DNS to 127.0.0.1. I received a very helpful response from someone on the security team and it appears they will look into it. I assume these things happened from different departments. Banning an account because you saw it make 20k requests to your API adding domains seems pretty reasonable, and it was a few hours before they reached out. If you saw that activity, would you ban the account or leave it open hoping that they'd be doing something nice and reach out?
- wongarsu 10y ago
  > Banning an account because you saw it make 20k requests to your API adding domains seems pretty reasonable, and it was a few hours before they reached out. If you saw that activity, would you ban the account or leave it open hoping that they'd be doing something nice and reach out? If I was a domain reseller, adding my 20k domains to digital ocean just to get banned without warning, explaination or option for reconsideration I would be rightfully upset. If they didn't want people adding large numbers of domains they could just have limited the feature instead of banning people who reach some arbitrary threshold. If on the other hand the department that executed the ban knew that the registrations weren't made by the domain owners, they should be discussing such a huge incident with the security team. That discussion would naturally lead to them knowing about the specifics of this case, unless this case wasn't widely shared in the security team. So the options are: 1. Digital Ocean bans legitimate customers without warning or option for reconsideration; for no obvious reason 2. Big security incidents don't get reported to the security team 3. The responsible people thought that this was not a big security incident 4. This incident wasn't discussed in the security team 5. They knowingly banned a white hat hacker (who may or may not have gone too far) Of all those options, the last one is by far the one that looks best for Digital Ocean.
  - IanCal 10y ago
    Or 6, they spoke to the security team in the interim period of several hours between the addition of all the domains and when the author reported the issue to the security team. Neither of us really know what's happened here, but the author at least thinks DOs actions were justified so I'm reasonably happy to leave it at that.

IanCal 10y ago

> (hence almost certainly not being used) Well they were still being accessed by real people. > And if DO was really concerned about the damage then they would have removed the added A records, but they didn't, they banned the author and continued to let all traffic go to his server. Both seem reasonable. And it does sound like the security team are actually doing something about it. > I reached out to DigitalOcean’s team to see if they can assist in deleting the domains from my account (sadly leaving them vulnerable again) or sinkholing the DNS to 127.0.0.1. I received a very helpful response from someone on the security team and it appears they will look into it. I assume these things happened from different departments. Banning an account because you saw it make 20k requests to your API adding domains seems pretty reasonable, and it was a few hours before they reached out. If you saw that activity, would you ban the account or leave it open hoping that they'd be doing something nice and reach out?

wongarsu 10y ago
> Banning an account because you saw it make 20k requests to your API adding domains seems pretty reasonable, and it was a few hours before they reached out. If you saw that activity, would you ban the account or leave it open hoping that they'd be doing something nice and reach out? If I was a domain reseller, adding my 20k domains to digital ocean just to get banned without warning, explaination or option for reconsideration I would be rightfully upset. If they didn't want people adding large numbers of domains they could just have limited the feature instead of banning people who reach some arbitrary threshold. If on the other hand the department that executed the ban knew that the registrations weren't made by the domain owners, they should be discussing such a huge incident with the security team. That discussion would naturally lead to them knowing about the specifics of this case, unless this case wasn't widely shared in the security team. So the options are: 1. Digital Ocean bans legitimate customers without warning or option for reconsideration; for no obvious reason 2. Big security incidents don't get reported to the security team 3. The responsible people thought that this was not a big security incident 4. This incident wasn't discussed in the security team 5. They knowingly banned a white hat hacker (who may or may not have gone too far) Of all those options, the last one is by far the one that looks best for Digital Ocean.
- IanCal 10y ago
  Or 6, they spoke to the security team in the interim period of several hours between the addition of all the domains and when the author reported the issue to the security team. Neither of us really know what's happened here, but the author at least thinks DOs actions were justified so I'm reasonably happy to leave it at that.