4 ms·

Linode has a weak track-record with regards to security in my view.

by borplk 9y ago

ryanlol 9y ago
I think this Glassdoor review sums it up pretty well: https://i.imgur.com/sJd56AT.png https://i.imgur.com/sJd56AT.png Linode has been hacked at least 5 times¹ in the past decade, and EVERY TIME they try their hardest to downplay the incident and distract attention from it. Avoiding any public communications at all if possible. This HN comment from a PagerDuty employee is also particularly damning https://news.ycombinator.com/item?id=10845985 https://news.ycombinator.com/item?id=10845985 ¹https://news.ycombinator.com/item?id=10845278 https://news.ycombinator.com/item?id=10845278
- jsmthrowaway 9y ago
  While you and the sources you link to are generally correct, you should probably disclose your relationship with Linode when you make these comments -- namely that you were involved with, and successfully prosecuted for, one of the more serious of the five. You also lost any semblance of moral footing when you dumped the customer data that you extracted to the public. Reading your comment with that context changes it slightly; given that since said prosecution you've taken every opportunity to speak negatively about Linode that you can, I feel it's important context to have. I know you've spoken openly in the past about it, but a lot of folks reading now will not have seen those threads. I'm not saying I disagree. To prove that, for the record, I informed Linode leadership that ColdFusion admin being world-accessible was a bad idea several years before you and your 'team' were even aware of Linode, and I and another employee proposed replacing ColdFusion long before you flippantly suggested that it doesn't take years[0]. (Try running a hosting provider at medium scale.) I've been just as critical long after leaving Linode as an employee -- I saw oversights like mgreb:mgreb1221 being a full-admin user on world-accessible db1.linode.com for many years with the password in crons, for example -- so please don't interpret me as disparaging your opinion, only your trying to have it both ways with a very clear conflict of interest, and turning your takedown of Linode into a potential annoyance for me and thousands of other people. And yes, I know the key passphrase that you never recovered, despite your public assertions to the contrary. [0]: https://news.ycombinator.com/item?id=10845462 https://news.ycombinator.com/item?id=10845462
  - ryanlol 9y ago
    >While you and the sources you link to are generally correct, you should probably disclose your relationship with Linode when you make these comments -- namely that you were involved with, and successfully prosecuted for, one of the more serious of the five. I was successfully prosecuted for hacking coldfusion things in general, that list included Linode and over 50000 others. There was a pending investigation relating to Linode specifically, but I'm pretty sure that's hit the statute of limitations and can only assume that there's no intent to prosecute. >Reading your comment with that context changes it slightly You're right, it does. I considered linking directly to https://news.ycombinator.com/item?id=10845278 https://news.ycombinator.com/item?id=10845278 but figured I could deliver the information in a more concise manner, without quoting myself. I made a mistake in not immediately clarifying my relationship here. >given that since said prosecution you've taken every opportunity to speak negatively about Linode that you can Since long before that actually. >And yes, I know the key passphrase that you never recovered, despite your public assertions to the contrary. What are you referring to? The credit card decryption key? I assure you we most definitely got that, if you want I might be able to dig up old IRC logs from police documents with plaintext credit card information of several linode customers. Jennifer Emick, Robert "xnite" Whitney and Ryan Cleary as I recall.
    - jsmthrowaway 9y ago
      > I was successfully prosecuted for hacking coldfusion things in general, that list included Linode and over 50000 others. This is a significant exaggeration, but I'm not going to dox you. Suffice to say, I'm reading your case as we speak, so stop trying to mislead people. (Good luck with that visa.) > What are you referring to? The credit card decryption key? I assure you we most definitely got that Then name it. I have the one that protected the key you retrieved memorized on account of my duties (I had to enter it every time I restarted the application), and they've changed it since then, so it's a no-op. It's not brute forceable even by nation states, so you'd have had to extract it by means your entry vector did not give you. Hash it in your reply if you want. I've always suspected you had former employee help, and I'm pretty sure I know not only exactly who, but also their motive for assisting you and "HTP". If you do have the passphrase to that key, I can almost promise it was from your assistance. I eagerly await your reply, since the passphrase is a sentence, and once you know it the gist of it is easily communicable without consulting logs.

Linode has a weak track-record with regards to security in my view.

by borplk 9y ago

Linode has a weak track-record with regards to security in my view.

I think this Glassdoor review sums it up pretty well: https://i.imgur.com/sJd56AT.png https://i.imgur.com/sJd56AT.png Linode has been hacked at least 5 times¹ in the past decade, and EVERY TIME they try their hardest to downplay the incident and distract attention from it. Avoiding any public communications at all if possible. This HN comment from a PagerDuty employee is also particularly damning https://news.ycombinator.com/item?id=10845985 https://news.ycombinator.com/item?id=10845985 ¹https://news.ycombinator.com/item?id=10845278 https://news.ycombinator.com/item?id=10845278

jsmthrowaway 9y ago
While you and the sources you link to are generally correct, you should probably disclose your relationship with Linode when you make these comments -- namely that you were involved with, and successfully prosecuted for, one of the more serious of the five. You also lost any semblance of moral footing when you dumped the customer data that you extracted to the public. Reading your comment with that context changes it slightly; given that since said prosecution you've taken every opportunity to speak negatively about Linode that you can, I feel it's important context to have. I know you've spoken openly in the past about it, but a lot of folks reading now will not have seen those threads. I'm not saying I disagree. To prove that, for the record, I informed Linode leadership that ColdFusion admin being world-accessible was a bad idea several years before you and your 'team' were even aware of Linode, and I and another employee proposed replacing ColdFusion long before you flippantly suggested that it doesn't take years[0]. (Try running a hosting provider at medium scale.) I've been just as critical long after leaving Linode as an employee -- I saw oversights like mgreb:mgreb1221 being a full-admin user on world-accessible db1.linode.com for many years with the password in crons, for example -- so please don't interpret me as disparaging your opinion, only your trying to have it both ways with a very clear conflict of interest, and turning your takedown of Linode into a potential annoyance for me and thousands of other people. And yes, I know the key passphrase that you never recovered, despite your public assertions to the contrary. [0]: https://news.ycombinator.com/item?id=10845462 https://news.ycombinator.com/item?id=10845462
- ryanlol 9y ago
  >While you and the sources you link to are generally correct, you should probably disclose your relationship with Linode when you make these comments -- namely that you were involved with, and successfully prosecuted for, one of the more serious of the five. I was successfully prosecuted for hacking coldfusion things in general, that list included Linode and over 50000 others. There was a pending investigation relating to Linode specifically, but I'm pretty sure that's hit the statute of limitations and can only assume that there's no intent to prosecute. >Reading your comment with that context changes it slightly You're right, it does. I considered linking directly to https://news.ycombinator.com/item?id=10845278 https://news.ycombinator.com/item?id=10845278 but figured I could deliver the information in a more concise manner, without quoting myself. I made a mistake in not immediately clarifying my relationship here. >given that since said prosecution you've taken every opportunity to speak negatively about Linode that you can Since long before that actually. >And yes, I know the key passphrase that you never recovered, despite your public assertions to the contrary. What are you referring to? The credit card decryption key? I assure you we most definitely got that, if you want I might be able to dig up old IRC logs from police documents with plaintext credit card information of several linode customers. Jennifer Emick, Robert "xnite" Whitney and Ryan Cleary as I recall.
  - jsmthrowaway 9y ago
    > I was successfully prosecuted for hacking coldfusion things in general, that list included Linode and over 50000 others. This is a significant exaggeration, but I'm not going to dox you. Suffice to say, I'm reading your case as we speak, so stop trying to mislead people. (Good luck with that visa.) > What are you referring to? The credit card decryption key? I assure you we most definitely got that Then name it. I have the one that protected the key you retrieved memorized on account of my duties (I had to enter it every time I restarted the application), and they've changed it since then, so it's a no-op. It's not brute forceable even by nation states, so you'd have had to extract it by means your entry vector did not give you. Hash it in your reply if you want. I've always suspected you had former employee help, and I'm pretty sure I know not only exactly who, but also their motive for assisting you and "HTP". If you do have the passphrase to that key, I can almost promise it was from your assistance. I eagerly await your reply, since the passphrase is a sentence, and once you know it the gist of it is easily communicable without consulting logs.