4 ms·

I made this comment in an older thread but haven't gotten an answer on... the circumstances seem off to me: The thing that has me scratching my head is how thi

I made this comment in an older thread but haven't gotten an answer on... the circumstances seem off to me: The thing that has me scratching my head is how this chain of events unfolded. I get that your fraud algorithm flagged it because of lack of established payment. how is this possible if what the tweet referred to as "locking us out of all of our backups and work"? surely an account history of any significance would have an established payment record. From their tweets they mention that they had 5 droplets and some storage of a not insignificant number of records (~500k) and that a script is required to be run every 2-3 months to process some data and that script spins up 10 droplets during that time. seems like it will take 13 hours to process the data based on row count and per record time.[0] I am struggling to see how they didn't have payment history. can you elaborate? In addition another thing I'd think would help assuage fears of a complete lockout is some process where you can request and download the db or a snapshot of the virtual machine. [0] https://twitter.com/w3Nicolas/status/1134529322902007809 https://twitter.com/w3Nicolas/status/1134529322902007809

bcooks 7y ago
Hi weaksauce... sorry I must have missed your earlier question. The account had been live for some time and in that sense had history but because of credits it didn't have payment history. As some others have commented lots of startups use credits to get their business going and depending on your usage they can last you for quite a while. Payment history indicates a willingness and capability to make payments. Part of the issue here was what triggers the algorithm used when looking at remaining credits, payment history (none), workload deltas (the new spin ups), and effective run rate (think of that as the amount of money they would be charged for the workload they were spinning up). The bug in this case was both simple and super impactful. Raisup did nothing wrong, everything right in fact. We just blew it. Thanks for the comment on request for download of backups or snapshot. That is a great idea, I guess we just never expected to actually go shoot a real customer and the fraudsters don't ask for their data.
- weaksauce 7y ago
  I appreciate the response. a followup question to that would be how they got enough credits to be running for that long without any payment?
  - bcooks 7y ago
    DO has a startup program called Hatch: https://www.digitalocean.com/hatch/ https://www.digitalocean.com/hatch/ That is the starting place for many folks.
    - freehunter 7y ago
      So a startup was getting their hosting entirely for free, their paying customers were Fortune 500 companies, but they didn't have the money to pay for off-site backups. What the hell was their cost then?

bcooks 7y ago

Hi weaksauce... sorry I must have missed your earlier question. The account had been live for some time and in that sense had history but because of credits it didn't have payment history. As some others have commented lots of startups use credits to get their business going and depending on your usage they can last you for quite a while. Payment history indicates a willingness and capability to make payments. Part of the issue here was what triggers the algorithm used when looking at remaining credits, payment history (none), workload deltas (the new spin ups), and effective run rate (think of that as the amount of money they would be charged for the workload they were spinning up). The bug in this case was both simple and super impactful. Raisup did nothing wrong, everything right in fact. We just blew it. Thanks for the comment on request for download of backups or snapshot. That is a great idea, I guess we just never expected to actually go shoot a real customer and the fraudsters don't ask for their data.

weaksauce 7y ago
I appreciate the response. a followup question to that would be how they got enough credits to be running for that long without any payment?
- bcooks 7y ago
  DO has a startup program called Hatch: https://www.digitalocean.com/hatch/ https://www.digitalocean.com/hatch/ That is the starting place for many folks.
  - freehunter 7y ago
    So a startup was getting their hosting entirely for free, their paying customers were Fortune 500 companies, but they didn't have the money to pay for off-site backups. What the hell was their cost then?