22 ms·

No support Linux hosting shutting down from hack

354 points by ourmandave 6y ago

joeberon 6y ago
I imagine support@nosupportlinuxhosting.com is routed to /dev/null?
- zomg 6y ago
  i thought the same thing! how ironic that there's a "support" email for "no support" linux hosting???
- volongoto 6y ago
  I have/had an account there and they actually responded to every email I sent and it did not feel like canned responses. So, I was positively surprised by the level of support I got for the money I paid.
mshook 6y ago
That's literally the definition of "no support"... Aka you're on your own...
1_player 6y ago
What an irresponsible business model. It's not the "no support" part that concerns me, is that they've pocketed the customers money until there was a major problem, then just shut down, customers be damned. Sounds like someone placed a server in their basement, added cPanel and a PayPal link and totally ignored whatever happened to that server. I guess you get what you pay for.
- woofie11 6y ago
  And as a high school student back in the day, I really would have appreciated the ability to pay for something like this! Really, not everything on the web needs to be mission-critical.
  - fogihujy 6y ago
    Yeah, the idea is sound (assuming it was properly marketed), but simply shutting everything down because of an issue like that does sound excessive. At the very minimum, they should have a basic backup that is enough to get the servers running again even if the customers' data got wiped.
    - lub 6y ago
      Sounds like the customers' data itself is still available? > All customers should immediately download backups of their websites and databases through cPanel.
      - darkwater 6y ago
        I noted that too and it's really weird. So, they do no have backup of their part of the data (or they don't want/are not able to restore it) but they still have the customers data?
        sbarre 6y ago
        Perhaps things were running in maintenance mode already, and there is no longer the desire to run this part of the business, so they took this unfortunate opportunity to wind things down.
        numpad0 6y ago
        Maybe they’re compromised but data seems intact, as in it’ll be irresponsible to keep serving on the Internet but most of it are probably not maliciously altered?
        fogihujy 6y ago
        Yeah, it's pretty common for hackers to upload backdoors to random web sites when they can and exploit them at a later date. If we're talking about a full server compromise then I wouldn't use those downloaded data for anything except for analysis/archival purposes, unless it's been thoroughly cleaned first.
- exporectomy 6y ago
  The refund would be a fraction of a dollar that people would have paid for the incomplete part of their final month, no? So perhaps it's hardly worth refunding, or perhaps they did. A cheap low reliability non-spammy service is a pretty good niche for hobbyists. Who cares that it shut down. It did a job while it lasted.
  - tinus_hn 6y ago
    You can’t charge one dollar monthly, the fees would eat almost all of your income
    - stone-monkey 6y ago
      Yeah, they charged in increments of 12 dollars iirc. It wasn't set up as a yearly sub though - it just worked as account credits, so if you had multiple sites it would deduct money from the same account pool.
- jart 6y ago
  It's not a business model. "No Support Linux Hosting" is a white labeled version of Shanje Inc. which is a small business from Iowa run by 1-2 people which was founded back in 1997, so they truly are a blast from the past. Shanje controls a Class C IPv4 block and they use it to host about 30,000 websites which nets them an estimated yearly revenue of ~$70k. Most of the sites that were impacted are ones you've never heard of like francisdiamonds.com and almuftahrentacar.com, but someone loved them enough to put them online, and now they've all been destroyed. Between hacking and COVID we've certainly seen a systematic decimation of the petit bourgeois. It's a tough time to be a small business owner.
  - macintux 6y ago
    It’s certainly easy to see why small businesses are increasingly giving up on websites and just using Facebook. No cost, good discoverability, easy updates...just sucks for those of us who won’t use the platform.
    - tracker1 6y ago
      I'm not so sure on discoverability. Engaging with customers, sure. However, not the place I do searches for (mostly local) businesses.
  - generalizations 6y ago
    > controls a Class C IPv4 block That explains how they could so easily offer ipv4 addresses with their vps offerings on the sister site.
    - carlivar 6y ago
      This is only 254 useable addresses. Nice, but not that big.
  - jrnichols 6y ago
    That's what is especially frustrating to see. So much of the pre 2010 web is just gone, and I'm sure much of it gone because of something like this. hacks by ransomware garbage or script kids doing it "for the Lulz." internet vandalism saddens me.
- doublerabbit 6y ago
  > Sounds like someone placed a server in their basement, added cPanel and a PayPal link and totally ignored whatever happened to that server. Welcome to 99% of shared web hosting businesses. WHM + cPanel is the combo you need to know if you ever want to run a webhosting company.
mshanu 6y ago
literally
danielsamuels 6y ago
They don't help anyone, including themselves
- tomaszs 6y ago
  You should put a warning before this comment. I have spilled some coffee :)
ceejayoz 6y ago
cPanel? Ooof.
esamatti 6y ago
Interesting business model ---------- Experts Host Sites Here for $1/month Do you like paying extra so other people can ask amateur questions? That's how it is at other hosting companies where beginners and experts pay the same price. Beginners drive up the cost by asking a lot of novice support questions while the experts don't contact support. That is great for amateurs, and unfair to the experts like you. No Support Linux Hosting has a completely different business model. We ignore the support questions, and pass the savings on to you! If you are an expert who does not want to pay extra for help with amateur support issues, then you can host with us and save big money. Experts like you can sign up now for free. We charge $1/month per website, and there is no limit to the number of websites you can host in your account. This is the best deal in the web hosting industry, as long as you are the type of person who can find his or her own answers. ----------- From https://web.archive.org/web/20201109042643/https://www.nosupportlinuxhosting.com/ https://web.archive.org/web/20201109042643/https://www.nosup... I guess they took savings from security too.
- abdullahkhalids 6y ago
  What you get for $1/month > Each website in your account can use up to 1GB of disk space and 30GB of monthly bandwidth. These resource limits are enough for most normal websites. Each website can set up 3 databases and 25 email accounts. The server specs are here https://web.archive.org/web/20200618180933/http://www.nosupportlinuxhosting.com/ServerSpecs.html https://web.archive.org/web/20200618180933/http://www.nosupp...
  - generationP 6y ago
    > 30GB of monthly bandwidth. These resource limits are enough for most normal websites Unless you have a griefer with a broadband connection and half an hour of time I guess?
    - Aachen 6y ago
      Yes, but how often does that really happen? I've known of this possibility since I was a teen, and sometimes it happened on fairly popular sites back when unlimited bandwidth was very expensive, but it was rare back then and I haven't heard of this actually happening to any site in the last decade. I'm sure you can find examples online, but it's way more common to get a proper DDoS than to get this kind of attack.
tyingq 6y ago
Looks like it was old school shared web hosting with things like WHMCS, Cpanel, Softaculous, Wordpress one-click installers, in-house written web admin, etc. Where each user was running in the same instance of Linux. Not, for example, a VM per user. That kind of setup has a really wide attack surface. Not surprising it was hacked. That kind of setup with deliberately narrow support was bound to get hit. Edit: Apparently their "sister company" sells virtual private servers, and appears to still be alive. http://nosupportvpshosting.com/index.php http://nosupportvpshosting.com/index.php
- eznzt 6y ago
  Most shared hostings work like that, they do not have a VM per user, and the professional ones don't get hacked often.
  - tyingq 6y ago
    I assume because they have more margin to keep up. If you work a system like this with $1/user minus the 30 cent Cpanel license, you have little to spend on security. The "no vm per user" means any privilege escalation bug lets a hacker wipe it all. And your unsupported customers are probably running all sorts of vulnerable stuff.
  - kenniskrag 6y ago
    How do they secure php? The php process can access nearly anything. Also they may have remote code execution vuln: https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/php-fpm-vulnerability-cve-2019-11043-can-lead-to-remote-code-execution-in-nginx-web-servers https://www.trendmicro.com/vinfo/us/security/news/vulnerabil...
    - enkrs 6y ago
      They use php-fpm pools where each website gets it's own uid:gid and the php process runs as that user. Then standard linux file permissions so you can only access your own uid files. To access web assets from nginx/apache, they add file permissions wich standard Linux acls. Altough not fancy, the security model is actually quite mature. Security problems in these servers come from misconfigured permissions and scripts, not the security stack.
perryizgr8 6y ago
Why would they shut down though?? Worst case they can wipe the servers and start afresh.
- TruthWillHurt 6y ago
  Probably person who built the platform left long ago and they've been running on autopilot since.
- tyingq 6y ago
  Perhaps it didn't make much money prior to the hack. And you would have to operate at a loss until enough new customers came in. With probably lots of bad reviews from the prior customers. My guess is that if it was worth starting fresh, they did so with a new brand that makes no mention of the old service.
  - dspillett 6y ago
    > Perhaps it didn't make much money prior to the hack. There were significant changes to cPanel licensing not long ago which caused some consternation as it would result in some hosts needing to pay more. IIRC it moved from a per-server model to per-user, with a block of users included in the minimal fee so for small hosts the change had no effect, but for a host like this with many small accounts the extra cost there would make already small margins even more tenuous. Presumably the little profit still made was better than nothing if the maintenance needed was minimal, but not (for this reason and/or others) large enough to be worth the rebuilding effort after this attack.
    - tyingq 6y ago
      "There were significant changes to cPanel licensing not long ago which caused some consternation as it would result in some hosts needing to pay more." That's interesting. And it would have hit those providers that were grossly oversubscribing the hardest. Guessing this service was in that bucket.
- gvb 6y ago
holstvoogd 6y ago
No Support hosting? So AWS basically? /s (For context, unless you pay 20% extra for AWS support, you basically get no support. There is a public forum for those that like to scream into the void.)
- Sebb767 6y ago
  Given that they shut down suddenly and you could not reach a human, it sounds more like Google Cloud ;)
  - WrtCdEvrydy 6y ago
    Here's a pretty dashboard that we use as marketing. When there's a thermonuclear strike, we'll mark down the services we think are dead as yellow.
    - martin_a 6y ago
      I don't think it can turn yellow because the servers responsible for turning it to yellow were fried. It will just stay on green.
    - rsynnott 6y ago
      I always liked Amazon's approach to this. In extremis, like if a whole region is down or something, they'll eventually change the green indicator to green with information mark.
  - aljarry 6y ago
    Not one of those big cloud offerings is human-friendly, until you pay $$$$$ and get proper account manager ;)
  - markbnj 6y ago
    > Given that they shut down suddenly and you could not reach a human, it sounds more like Google Cloud ;) On Google Cloud for over four years, with three kubernetes clusters and a few dozen VMs across three projects... and this thing you describe has never happened. Have you had a different experience with them?
Waterluvian 6y ago
Feels like there's something very serious they aren't telling their customers. Do hackers have a copy of all customer data?
- michaelmior 6y ago
  Probably given that they say the hackers compromised the servers hosting their customer database. The notice is seriously lacking in details though.
  - prepend 6y ago
    Well they market as no support so this notice is more than they promised. I kind of expected just a dead site and the autocharges to stop n
mkl95 6y ago
This is apparently not the first time they have had this kind of incident. They were hacked in 2011 as well, which prompted them to delete all customer sites: https://www.webhostingtalk.com/showthread.php?t=1089317 https://www.webhostingtalk.com/showthread.php?t=1089317
- BlueTemplar 6y ago
  Detailed answer at the end of the 2nd page of that thread.
  - sodimel 6y ago
    Here's the direct link to the message: https://www.webhostingtalk.com/showthread.php?t=1089317&page=2&p=7733402#post7733402 https://www.webhostingtalk.com/showthread.php?t=1089317&page...
    - mattmanser 6y ago
      A more accurate title for this thread might be “jbulluck wishes he had taken backups of his website.” Classic response :)
- thitcanh 6y ago
  What the. How dare they simply delete everyone’s content? That’s on another level of stupidity and/or evil.
narcissismo 6y ago
Well that was concise. I'd love to know the types of sites they hosted. Anyone here have the skillz to find out? My bet is on slimming tablets and viagra sales.
- mythrwy 6y ago
  I had some sites on there a long time ago. The model of course is shared IP so there are dozens, even hundreds of sites at the same IP address. I did some kind of lookup once to see who shared an IP with my site. It was stuff like churches, auto repair shops, high school kids experiments, plumbers. This was before Wix and friends. There was nothing scammy or spammy I saw on that particular IP anyway.
  - narcissismo 6y ago
    Nice work. Its also nice to know that a low price point doesn't automatically act as a bad-player magnet.
  - sodality2 6y ago
    How exactly do you find other sites hosted on the same IP?
- benlivengood 6y ago
  host.io maps the associations. From another comment that francisdiamonds.com was hosted there we get https://host.io/ip/216.51.232.100 https://host.io/ip/216.51.232.100 Since they apparently had a class C one could look at each IP to find the rest of the sites.
Triv888 6y ago
You can get a VPS with your own IPv4 for the same price: http://www.lowendstock.com/ http://www.lowendstock.com/ .
- tyingq 6y ago
  Different audience. As much as I loathe Cpanel, there's a bunch of customers that know nothing about Linux and want to point/click things into existence.
  - dspillett 6y ago
    > know nothing about Linux Given the name "nosupportlinuxhosting.com" I would expect many using the service to ba capable of knowing/understanding "apt install nginx php-fpm" and so forth. Though obviously cPanel and its ilk still offer some time-saving convenience even if you could setup everything yourself.
- jsmith99 6y ago
  There are superior VPS available for free in the 'always free' tier of GCP or Oracle Cloud. In the latter case you don't even need to set up a billing account, just provide a credit card for verification only, and you get 2 * VPS with a 1/8 of a physical EPYC core and 1GB RAM each, 100GB of block storage between them, and 10TB outbound data a month. Alternatively PaaS like Google's App Engine have 'always free' tiers sufficient for hobby sites.
amarant 6y ago
Dang, I never knew something like this existed! And now it doesn't.. Anyone know of any similar services one might procure? Asking for a friend...
- akx 6y ago
  You can get a VPS from Hetzner starting at 3 EUR/mo, or one from Digital Ocean at $5/mo. I know it's 3 to 5 times more expensive than this, but...
- wccrawford 6y ago
  I've been using Nearly Free Speech, and someone else here recommended it, too. I don't use it for anything important, but it's been pretty reliable.
- massysett 6y ago
  NearlyFreeSpeech.net. It's probably not as cheap as this was but is close. I used to have a personal static website there. These days I use it only for my domain. It's been years and I've never had a problem with them. They have extensive support webpages and a custom-rolled web interface for management and they seem to know what they're doing.
- tyingq 6y ago
  Another cheap Cpanel provider that's ~$1/month: https://hobohost.com/ https://hobohost.com/ If you're okay without Cpanel, there's a bunch of providers advertising dirt cheap VPS instances on https://lowendbox.com https://lowendbox.com. As this thread indicates, though, you get what you pay for.
- dspillett 6y ago
  There are many cheap shared hosts, though perhaps not that cheap if you want cPanel given their recent licensing change to per-account from per-server. If you are fine doing your own setup and have low resource needs, you can get a 1$/month VM from a number of places. Cheaper if your resource needs are really low, or you don't need a dedicated IPv4 address. There are even search engines collating them, https://www.serverhunter.com/ https://www.serverhunter.com/ for instance. Just do a little background research before picking the cheapest, if you care anything for what you host.
jart 6y ago
They were almost certainly impacted by the recent sudo bug, considering how they offered cPanel hosting: https://archive.is/PCZ99 https://archive.is/PCZ99 I've been trying to make contact with virtual hosting providers over the last few weeks to bring the weakness to their attention, but I've been ignored. cPanel hasn't even issued an update. It's heartbreaking watching websites get destroyed by the bad guys.
- ollybee 6y ago
  You have my attention, what is this recent sudo bug?
  - float4 6y ago
    https://news.ycombinator.com/item?id=25919235 https://news.ycombinator.com/item?id=25919235 As a tip for the future, in case you're interested: you can use hn.algolia.com, search "sudo", time window something like "past month", and you'd have found it.
    - vntok 6y ago
      It is much more efficient and future-proof to have someone put the exact link as a reply, that way people coming to the thread afterwards can simply click on.
      - float4 6y ago
        I gave the full link, and additionally gave a tip for those who were interested. hn.algolia.com is a great resource and I'm certain not everybody here knows about it.
        jart 6y ago
        Thanks for teaching these men to fish. I thought I was going to need to do all the explaining.
DangerousPie 6y ago
Is this legal? Don't they have to notify authorities about getting personal data hacked? And don't they have contracts in place with customers that they can't simply abandon? Just because you're cheap and don't offer support doesn't mean you don't have to follow the law.
- tyingq 6y ago
  I imagine it's one of those things where enforcement is difficult. Who would you call that would do anything about it?
- stone-monkey 6y ago
  Long time user of the site, don't think they stored any of my personal details - I just paid via paypal. Don't think you could pay directly using any other payment method.
Quanttek 6y ago
Similar hosting solution but with support: https://uberspace.de/en/ https://uberspace.de/en/
yazboo 6y ago
I have (had, I guess) a Wordpress site on here. They sent an email about the hack but somebody had already changed my password and recovery email in cPanel. They haven't changed the Wordpress admin credentials though, so I'm exporting what I can.
- passthejoe 6y ago
  I didn't realize cPanel was such an attack surface.
  - majewsky 6y ago
    It's a web interface that gives you full admin access to a website. That's exactly where I would look for vulnerabilities if I were an attacker. I know I'm going to get flack for victim blaming, but not putting something like cPanel behind a VPN or SSH reverse proxy is on the same level as not wearing a seatbelt. At this point we should all know better, and those who don't will have to suffer the consequences.
    - x86_64Ubuntu 6y ago
      If my users have to access the cPanel from wherever they may be, how does a VPN or SSH reverse proxy help? Not trolling, I'm genuinely ignorant of top level security practices.
      - EricE 6y ago
        Because instead of exploiting cpanel directly from any random IP on the Internet globally, attackers first have to compromise your VPN connection. It's a pretty significant barrier and dramatically reduces the amount of attack surfaces out there. Mobile/Desktop OS's have come a LONG way in VPN support, so requiring VPN access for critical access (and administrative access should always be considered critical!) is not near the barrier of entry it used to be. Heck anyone can set a VPN server up on a raspberry pi in minutes that can handle hundreds of megabits of traffic - piVPN with Wireguard is drop dead simple to configure and deploy (WAY easier than the mess that is OpenVPN); the amount of friction to implement a VPN these days is just about negligable. It's a harder problem for service providers like this one that have thousands of customers - but they certainly had some sort of user account management/provisioning system; it' way past time to expect those to be able to handle security certificate management too. It's far less effort than cleaning up messes like the one being profiled here! And if you have sensitive data? Once your system is compromised it's no longer sensitive. It's now public knowledge :p
beermonster 6y ago
I read the title too quickly. I thought this was going to be about a Linux-hating hosting provider... oops!
Reason077 6y ago
This gives me a business idea. nosecuritylinuxhosting.com, anyone?
- rkalla 6y ago
  LOL!
- zingplex 6y ago
  With shared hosting still being a thing, I think that's a pretty saturated market.
ollybee 6y ago
I never understood why their no support hosting seemed radical, but unmanaged VPS's became an industry standard.
mythrwy 6y ago
Wow that's too bad! NSH was my go to for years for quick unimportant sites. Like a decade ago. They actually were very helpful the once or twice I contacted them (trying to get bigger instances). And $1 a month!
- dspillett 6y ago
  If your needs can live in ½GB RAM and a few GB of space, it is fairly easy to find $1/month VMs. Cheaper if you don't mind paying annually and/or can cope with ¼GB RAM or other lower specs. Fine for simple static hosting, or a bit of low concurrency more-dynamic server-side stuff, or running simple services like DNS.
  - deleted 6y ago
    [deleted]
  - generalizations 6y ago
    I looked once, but couldn't actually find VMs available for $1/month. Where did you find such things?
    - dspillett 6y ago
      https://www.serverhunter.com/ https://www.serverhunter.com/ lists a few, and many for not a lot more, if your resource needs are low enough. Cheapest currently listed is $9.5/yr if you need an IPv4 address. You'll also see them offered in places like lowendbox / lowendtalk / webhostingtalk / similar.
circa 6y ago
damn this is so sad
thesuitonym 6y ago
This is a good reminder of why DevOps is not necessarily a replacement for a security-minded systems administrator.
sambe 6y ago
I guess you are also supposed to figure out for yourself what private information of yours has been compromised, since they can't be bothered to make it explicit.
stone-monkey 6y ago
Really surprised to see this on hacker news, I would've thought it too piddly to warrant a thread here. Anyway, long time customer and was generally satisfied with the service. I just used it for my low maintenance low traffic wp blog. Got an email yesterday from them with the same message. Think I still had like 6 bucks in my account with them, but frankly, who gives a shit. The cheapness of the service was baked in such that eating a couple of bucks doesn't really matter. We had a good run of 4-5 years. Sad to see them go though.
- gogopuppygogo 6y ago
  Long time customer as well and found out about this here on HN. I had $4 or $5 left as well but I guess it’s gone. My site is still up for the moment so if I care to save it I’ll move it. Might just be the end of the road for that site as I’m not about to spend more than $12/year to keep it going.
  - jopsen 6y ago
    I used wget to render my old MediaWiki setup into a static site, and then threw it on vercel. If you don't want to maintain a legacy app liable to be compromised, going static using wget + a few scripts is a lovely trick. No maintenance, no pain, and free hosting :) I personally doubt static websites will go out of fashion anytime soon.
    - EricE 6y ago
      Jekyl and Gatsby are pretty amazing. Got involved in a project at work that uses Gatsby underneath and once you get used to all the node.js/dependency BS it's actually fun.
Havoc 6y ago
That’s the risk with smaller VPS operations. Good value but could shut down any time and leave you wondering what happened
geocrasher 6y ago
I've worked on the support side of the hosting industry for a Long Time. A few observations. 1) Hosting is hard. It doesn't seem like it should be, but it is. cPanel simplifies and complicates it because you're locked into doing things The cPanel Way whether you like it or not. 2) Hosting is getting more expensive because cPanel keeps jacking up prices, and I strongly suspect that this host threw in the towel due to the severity of the compromise but also the razor thin margins. Digging out from under it was likely more trouble than it was worth, especially if they didn't have insurance for this kind of thing. 3) KEEP YOUR OWN BACKUPS. For the love of all data that is important, keep your own backups. Did I mention that anyone with a website on any provider on any continent should keep their own backups? By all means, keep your own backups. Because if you don't keep your own backups, you'll wish you'd kept your own backups.
- dabockster 6y ago
  Any competitors to cPanel out there? Both free and paid?
  - deleted 6y ago
    [deleted]
  - geocrasher 6y ago
    There are many. CentOS Web Panel, Virtualmin, DirectAdmin, Interworx, and many others. I use Virtualmin on my own stuff. It has a FOSS version that works well. But it's no cPanel. The interface and general paradigms leave a lot to be desired. But it works. The problem isn't variety, it's user base. All the Big Hosts are using cPanel, migrating away from it is a pain. There's also Plesk, but let's face it. Nobody likes Plesk.
- ljm 6y ago
  I'm actually surprised a no support host set you up with something like cPanel and didn't just give you an SFTP user or a restricted shell account.
- dspillett 6y ago
  > KEEP YOUR OWN BACKUPS To add the rest of my usual mantra: AND TEST YOUR BACKUPS. Memories of the look on someone's face when I had to tell them that their laptop drive was truly dead (unless they wanted to pay a data recovery company a pile o' cash) and the USB stick they'd been saving copies of important documents too appeared to be silently corrupting everything written to it...
johnlogic 6y ago
It looks like the message about shutting down was left by the hacker. I can't tell if NSLH is shutting down, though the breach doesn't instil confidence. Whether NSLH is shutting down or not, it's a good time to make backup copies.
pimlottc 6y ago
The title should be fixed to capitalize the company name "No Support Linux Hosting"; as it's current written, it's not clear that it's a proper name.
ajitgoel 6y ago
What would be a good "no support hosting" alternative be for this provider?
erwinyu888 6y ago
Just go with hosthuddy.com They are cheap and reliable and provide support.
erwinyu888 6y ago
Go with hostbuddy.com They r cheap and reliable.

354 points by ourmandave 6y ago

joeberon 6y ago

I imagine support@nosupportlinuxhosting.com is routed to /dev/null?

zomg 6y ago
i thought the same thing! how ironic that there's a "support" email for "no support" linux hosting???
volongoto 6y ago
I have/had an account there and they actually responded to every email I sent and it did not feel like canned responses. So, I was positively surprised by the level of support I got for the money I paid.

mshook 6y ago

That's literally the definition of "no support"... Aka you're on your own...

1_player 6y ago

What an irresponsible business model. It's not the "no support" part that concerns me, is that they've pocketed the customers money until there was a major problem, then just shut down, customers be damned. Sounds like someone placed a server in their basement, added cPanel and a PayPal link and totally ignored whatever happened to that server. I guess you get what you pay for.

woofie11 6y ago
And as a high school student back in the day, I really would have appreciated the ability to pay for something like this! Really, not everything on the web needs to be mission-critical.
- fogihujy 6y ago
  Yeah, the idea is sound (assuming it was properly marketed), but simply shutting everything down because of an issue like that does sound excessive. At the very minimum, they should have a basic backup that is enough to get the servers running again even if the customers' data got wiped.
  - lub 6y ago
    Sounds like the customers' data itself is still available? > All customers should immediately download backups of their websites and databases through cPanel.
    - darkwater 6y ago
      I noted that too and it's really weird. So, they do no have backup of their part of the data (or they don't want/are not able to restore it) but they still have the customers data?
      - sbarre 6y ago
        Perhaps things were running in maintenance mode already, and there is no longer the desire to run this part of the business, so they took this unfortunate opportunity to wind things down.
      - numpad0 6y ago
        Maybe they’re compromised but data seems intact, as in it’ll be irresponsible to keep serving on the Internet but most of it are probably not maliciously altered?
        fogihujy 6y ago
        Yeah, it's pretty common for hackers to upload backdoors to random web sites when they can and exploit them at a later date. If we're talking about a full server compromise then I wouldn't use those downloaded data for anything except for analysis/archival purposes, unless it's been thoroughly cleaned first.
exporectomy 6y ago
The refund would be a fraction of a dollar that people would have paid for the incomplete part of their final month, no? So perhaps it's hardly worth refunding, or perhaps they did. A cheap low reliability non-spammy service is a pretty good niche for hobbyists. Who cares that it shut down. It did a job while it lasted.
- tinus_hn 6y ago
  You can’t charge one dollar monthly, the fees would eat almost all of your income
  - stone-monkey 6y ago
    Yeah, they charged in increments of 12 dollars iirc. It wasn't set up as a yearly sub though - it just worked as account credits, so if you had multiple sites it would deduct money from the same account pool.
jart 6y ago
It's not a business model. "No Support Linux Hosting" is a white labeled version of Shanje Inc. which is a small business from Iowa run by 1-2 people which was founded back in 1997, so they truly are a blast from the past. Shanje controls a Class C IPv4 block and they use it to host about 30,000 websites which nets them an estimated yearly revenue of ~$70k. Most of the sites that were impacted are ones you've never heard of like francisdiamonds.com and almuftahrentacar.com, but someone loved them enough to put them online, and now they've all been destroyed. Between hacking and COVID we've certainly seen a systematic decimation of the petit bourgeois. It's a tough time to be a small business owner.
- macintux 6y ago
  It’s certainly easy to see why small businesses are increasingly giving up on websites and just using Facebook. No cost, good discoverability, easy updates...just sucks for those of us who won’t use the platform.
  - tracker1 6y ago
    I'm not so sure on discoverability. Engaging with customers, sure. However, not the place I do searches for (mostly local) businesses.
- generalizations 6y ago
  > controls a Class C IPv4 block That explains how they could so easily offer ipv4 addresses with their vps offerings on the sister site.
  - carlivar 6y ago
    This is only 254 useable addresses. Nice, but not that big.
- jrnichols 6y ago
  That's what is especially frustrating to see. So much of the pre 2010 web is just gone, and I'm sure much of it gone because of something like this. hacks by ransomware garbage or script kids doing it "for the Lulz." internet vandalism saddens me.
doublerabbit 6y ago
> Sounds like someone placed a server in their basement, added cPanel and a PayPal link and totally ignored whatever happened to that server. Welcome to 99% of shared web hosting businesses. WHM + cPanel is the combo you need to know if you ever want to run a webhosting company.

mshanu 6y ago

literally

danielsamuels 6y ago

They don't help anyone, including themselves

tomaszs 6y ago
You should put a warning before this comment. I have spilled some coffee :)

ceejayoz 6y ago

cPanel? Ooof.

esamatti 6y ago

Interesting business model ---------- Experts Host Sites Here for $1/month Do you like paying extra so other people can ask amateur questions? That's how it is at other hosting companies where beginners and experts pay the same price. Beginners drive up the cost by asking a lot of novice support questions while the experts don't contact support. That is great for amateurs, and unfair to the experts like you. No Support Linux Hosting has a completely different business model. We ignore the support questions, and pass the savings on to you! If you are an expert who does not want to pay extra for help with amateur support issues, then you can host with us and save big money. Experts like you can sign up now for free. We charge $1/month per website, and there is no limit to the number of websites you can host in your account. This is the best deal in the web hosting industry, as long as you are the type of person who can find his or her own answers. ----------- From https://web.archive.org/web/20201109042643/https://www.nosupportlinuxhosting.com/ https://web.archive.org/web/20201109042643/https://www.nosup... I guess they took savings from security too.

abdullahkhalids 6y ago
What you get for $1/month > Each website in your account can use up to 1GB of disk space and 30GB of monthly bandwidth. These resource limits are enough for most normal websites. Each website can set up 3 databases and 25 email accounts. The server specs are here https://web.archive.org/web/20200618180933/http://www.nosupportlinuxhosting.com/ServerSpecs.html https://web.archive.org/web/20200618180933/http://www.nosupp...
- generationP 6y ago
  > 30GB of monthly bandwidth. These resource limits are enough for most normal websites Unless you have a griefer with a broadband connection and half an hour of time I guess?
  - Aachen 6y ago
    Yes, but how often does that really happen? I've known of this possibility since I was a teen, and sometimes it happened on fairly popular sites back when unlimited bandwidth was very expensive, but it was rare back then and I haven't heard of this actually happening to any site in the last decade. I'm sure you can find examples online, but it's way more common to get a proper DDoS than to get this kind of attack.

tyingq 6y ago

Looks like it was old school shared web hosting with things like WHMCS, Cpanel, Softaculous, Wordpress one-click installers, in-house written web admin, etc. Where each user was running in the same instance of Linux. Not, for example, a VM per user. That kind of setup has a really wide attack surface. Not surprising it was hacked. That kind of setup with deliberately narrow support was bound to get hit. Edit: Apparently their "sister company" sells virtual private servers, and appears to still be alive. http://nosupportvpshosting.com/index.php http://nosupportvpshosting.com/index.php

eznzt 6y ago
Most shared hostings work like that, they do not have a VM per user, and the professional ones don't get hacked often.
- tyingq 6y ago
  I assume because they have more margin to keep up. If you work a system like this with $1/user minus the 30 cent Cpanel license, you have little to spend on security. The "no vm per user" means any privilege escalation bug lets a hacker wipe it all. And your unsupported customers are probably running all sorts of vulnerable stuff.
- kenniskrag 6y ago
  How do they secure php? The php process can access nearly anything. Also they may have remote code execution vuln: https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/php-fpm-vulnerability-cve-2019-11043-can-lead-to-remote-code-execution-in-nginx-web-servers https://www.trendmicro.com/vinfo/us/security/news/vulnerabil...
  - enkrs 6y ago
    They use php-fpm pools where each website gets it's own uid:gid and the php process runs as that user. Then standard linux file permissions so you can only access your own uid files. To access web assets from nginx/apache, they add file permissions wich standard Linux acls. Altough not fancy, the security model is actually quite mature. Security problems in these servers come from misconfigured permissions and scripts, not the security stack.

perryizgr8 6y ago

Why would they shut down though?? Worst case they can wipe the servers and start afresh.

TruthWillHurt 6y ago
Probably person who built the platform left long ago and they've been running on autopilot since.
tyingq 6y ago
Perhaps it didn't make much money prior to the hack. And you would have to operate at a loss until enough new customers came in. With probably lots of bad reviews from the prior customers. My guess is that if it was worth starting fresh, they did so with a new brand that makes no mention of the old service.
- dspillett 6y ago
  > Perhaps it didn't make much money prior to the hack. There were significant changes to cPanel licensing not long ago which caused some consternation as it would result in some hosts needing to pay more. IIRC it moved from a per-server model to per-user, with a block of users included in the minimal fee so for small hosts the change had no effect, but for a host like this with many small accounts the extra cost there would make already small margins even more tenuous. Presumably the little profit still made was better than nothing if the maintenance needed was minimal, but not (for this reason and/or others) large enough to be worth the rebuilding effort after this attack.
  - tyingq 6y ago
    "There were significant changes to cPanel licensing not long ago which caused some consternation as it would result in some hosts needing to pay more." That's interesting. And it would have hit those providers that were grossly oversubscribing the hardest. Guessing this service was in that bucket.
gvb 6y ago

holstvoogd 6y ago

No Support hosting? So AWS basically? /s (For context, unless you pay 20% extra for AWS support, you basically get no support. There is a public forum for those that like to scream into the void.)

Sebb767 6y ago
Given that they shut down suddenly and you could not reach a human, it sounds more like Google Cloud ;)
- WrtCdEvrydy 6y ago
  Here's a pretty dashboard that we use as marketing. When there's a thermonuclear strike, we'll mark down the services we think are dead as yellow.
  - martin_a 6y ago
    I don't think it can turn yellow because the servers responsible for turning it to yellow were fried. It will just stay on green.
  - rsynnott 6y ago
    I always liked Amazon's approach to this. In extremis, like if a whole region is down or something, they'll eventually change the green indicator to green with information mark.
- aljarry 6y ago
  Not one of those big cloud offerings is human-friendly, until you pay $$$$$ and get proper account manager ;)
- markbnj 6y ago
  > Given that they shut down suddenly and you could not reach a human, it sounds more like Google Cloud ;) On Google Cloud for over four years, with three kubernetes clusters and a few dozen VMs across three projects... and this thing you describe has never happened. Have you had a different experience with them?

Waterluvian 6y ago

Feels like there's something very serious they aren't telling their customers. Do hackers have a copy of all customer data?

michaelmior 6y ago
Probably given that they say the hackers compromised the servers hosting their customer database. The notice is seriously lacking in details though.
- prepend 6y ago
  Well they market as no support so this notice is more than they promised. I kind of expected just a dead site and the autocharges to stop n

mkl95 6y ago

This is apparently not the first time they have had this kind of incident. They were hacked in 2011 as well, which prompted them to delete all customer sites: https://www.webhostingtalk.com/showthread.php?t=1089317 https://www.webhostingtalk.com/showthread.php?t=1089317

BlueTemplar 6y ago
Detailed answer at the end of the 2nd page of that thread.
- sodimel 6y ago
  Here's the direct link to the message: https://www.webhostingtalk.com/showthread.php?t=1089317&page=2&p=7733402#post7733402 https://www.webhostingtalk.com/showthread.php?t=1089317&page...
  - mattmanser 6y ago
    A more accurate title for this thread might be “jbulluck wishes he had taken backups of his website.” Classic response :)
thitcanh 6y ago
What the. How dare they simply delete everyone’s content? That’s on another level of stupidity and/or evil.

narcissismo 6y ago

Well that was concise. I'd love to know the types of sites they hosted. Anyone here have the skillz to find out? My bet is on slimming tablets and viagra sales.

mythrwy 6y ago
I had some sites on there a long time ago. The model of course is shared IP so there are dozens, even hundreds of sites at the same IP address. I did some kind of lookup once to see who shared an IP with my site. It was stuff like churches, auto repair shops, high school kids experiments, plumbers. This was before Wix and friends. There was nothing scammy or spammy I saw on that particular IP anyway.
- narcissismo 6y ago
  Nice work. Its also nice to know that a low price point doesn't automatically act as a bad-player magnet.
- sodality2 6y ago
  How exactly do you find other sites hosted on the same IP?
benlivengood 6y ago
host.io maps the associations. From another comment that francisdiamonds.com was hosted there we get https://host.io/ip/216.51.232.100 https://host.io/ip/216.51.232.100 Since they apparently had a class C one could look at each IP to find the rest of the sites.

Triv888 6y ago

You can get a VPS with your own IPv4 for the same price: http://www.lowendstock.com/ http://www.lowendstock.com/ .

tyingq 6y ago
Different audience. As much as I loathe Cpanel, there's a bunch of customers that know nothing about Linux and want to point/click things into existence.
- dspillett 6y ago
  > know nothing about Linux Given the name "nosupportlinuxhosting.com" I would expect many using the service to ba capable of knowing/understanding "apt install nginx php-fpm" and so forth. Though obviously cPanel and its ilk still offer some time-saving convenience even if you could setup everything yourself.
jsmith99 6y ago
There are superior VPS available for free in the 'always free' tier of GCP or Oracle Cloud. In the latter case you don't even need to set up a billing account, just provide a credit card for verification only, and you get 2 * VPS with a 1/8 of a physical EPYC core and 1GB RAM each, 100GB of block storage between them, and 10TB outbound data a month. Alternatively PaaS like Google's App Engine have 'always free' tiers sufficient for hobby sites.

amarant 6y ago

Dang, I never knew something like this existed! And now it doesn't.. Anyone know of any similar services one might procure? Asking for a friend...

akx 6y ago
You can get a VPS from Hetzner starting at 3 EUR/mo, or one from Digital Ocean at $5/mo. I know it's 3 to 5 times more expensive than this, but...
wccrawford 6y ago
I've been using Nearly Free Speech, and someone else here recommended it, too. I don't use it for anything important, but it's been pretty reliable.
massysett 6y ago
NearlyFreeSpeech.net. It's probably not as cheap as this was but is close. I used to have a personal static website there. These days I use it only for my domain. It's been years and I've never had a problem with them. They have extensive support webpages and a custom-rolled web interface for management and they seem to know what they're doing.
tyingq 6y ago
Another cheap Cpanel provider that's ~$1/month: https://hobohost.com/ https://hobohost.com/ If you're okay without Cpanel, there's a bunch of providers advertising dirt cheap VPS instances on https://lowendbox.com https://lowendbox.com. As this thread indicates, though, you get what you pay for.
dspillett 6y ago
There are many cheap shared hosts, though perhaps not that cheap if you want cPanel given their recent licensing change to per-account from per-server. If you are fine doing your own setup and have low resource needs, you can get a 1$/month VM from a number of places. Cheaper if your resource needs are really low, or you don't need a dedicated IPv4 address. There are even search engines collating them, https://www.serverhunter.com/ https://www.serverhunter.com/ for instance. Just do a little background research before picking the cheapest, if you care anything for what you host.

jart 6y ago

They were almost certainly impacted by the recent sudo bug, considering how they offered cPanel hosting: https://archive.is/PCZ99 https://archive.is/PCZ99 I've been trying to make contact with virtual hosting providers over the last few weeks to bring the weakness to their attention, but I've been ignored. cPanel hasn't even issued an update. It's heartbreaking watching websites get destroyed by the bad guys.

ollybee 6y ago
You have my attention, what is this recent sudo bug?
- float4 6y ago
  https://news.ycombinator.com/item?id=25919235 https://news.ycombinator.com/item?id=25919235 As a tip for the future, in case you're interested: you can use hn.algolia.com, search "sudo", time window something like "past month", and you'd have found it.
  - vntok 6y ago
    It is much more efficient and future-proof to have someone put the exact link as a reply, that way people coming to the thread afterwards can simply click on.
    - float4 6y ago
      I gave the full link, and additionally gave a tip for those who were interested. hn.algolia.com is a great resource and I'm certain not everybody here knows about it.
      - jart 6y ago
        Thanks for teaching these men to fish. I thought I was going to need to do all the explaining.

DangerousPie 6y ago

Is this legal? Don't they have to notify authorities about getting personal data hacked? And don't they have contracts in place with customers that they can't simply abandon? Just because you're cheap and don't offer support doesn't mean you don't have to follow the law.

tyingq 6y ago
I imagine it's one of those things where enforcement is difficult. Who would you call that would do anything about it?
stone-monkey 6y ago
Long time user of the site, don't think they stored any of my personal details - I just paid via paypal. Don't think you could pay directly using any other payment method.

Quanttek 6y ago

Similar hosting solution but with support: https://uberspace.de/en/ https://uberspace.de/en/

yazboo 6y ago

I have (had, I guess) a Wordpress site on here. They sent an email about the hack but somebody had already changed my password and recovery email in cPanel. They haven't changed the Wordpress admin credentials though, so I'm exporting what I can.

passthejoe 6y ago
I didn't realize cPanel was such an attack surface.
- majewsky 6y ago
  It's a web interface that gives you full admin access to a website. That's exactly where I would look for vulnerabilities if I were an attacker. I know I'm going to get flack for victim blaming, but not putting something like cPanel behind a VPN or SSH reverse proxy is on the same level as not wearing a seatbelt. At this point we should all know better, and those who don't will have to suffer the consequences.
  - x86_64Ubuntu 6y ago
    If my users have to access the cPanel from wherever they may be, how does a VPN or SSH reverse proxy help? Not trolling, I'm genuinely ignorant of top level security practices.
    - EricE 6y ago
      Because instead of exploiting cpanel directly from any random IP on the Internet globally, attackers first have to compromise your VPN connection. It's a pretty significant barrier and dramatically reduces the amount of attack surfaces out there. Mobile/Desktop OS's have come a LONG way in VPN support, so requiring VPN access for critical access (and administrative access should always be considered critical!) is not near the barrier of entry it used to be. Heck anyone can set a VPN server up on a raspberry pi in minutes that can handle hundreds of megabits of traffic - piVPN with Wireguard is drop dead simple to configure and deploy (WAY easier than the mess that is OpenVPN); the amount of friction to implement a VPN these days is just about negligable. It's a harder problem for service providers like this one that have thousands of customers - but they certainly had some sort of user account management/provisioning system; it' way past time to expect those to be able to handle security certificate management too. It's far less effort than cleaning up messes like the one being profiled here! And if you have sensitive data? Once your system is compromised it's no longer sensitive. It's now public knowledge :p

beermonster 6y ago

I read the title too quickly. I thought this was going to be about a Linux-hating hosting provider... oops!

Reason077 6y ago

This gives me a business idea. nosecuritylinuxhosting.com, anyone?

rkalla 6y ago
LOL!
zingplex 6y ago
With shared hosting still being a thing, I think that's a pretty saturated market.

ollybee 6y ago

I never understood why their no support hosting seemed radical, but unmanaged VPS's became an industry standard.

mythrwy 6y ago

Wow that's too bad! NSH was my go to for years for quick unimportant sites. Like a decade ago. They actually were very helpful the once or twice I contacted them (trying to get bigger instances). And $1 a month!

dspillett 6y ago
If your needs can live in ½GB RAM and a few GB of space, it is fairly easy to find $1/month VMs. Cheaper if you don't mind paying annually and/or can cope with ¼GB RAM or other lower specs. Fine for simple static hosting, or a bit of low concurrency more-dynamic server-side stuff, or running simple services like DNS.
- deleted 6y ago
  [deleted]
- generalizations 6y ago
  I looked once, but couldn't actually find VMs available for $1/month. Where did you find such things?
  - dspillett 6y ago
    https://www.serverhunter.com/ https://www.serverhunter.com/ lists a few, and many for not a lot more, if your resource needs are low enough. Cheapest currently listed is $9.5/yr if you need an IPv4 address. You'll also see them offered in places like lowendbox / lowendtalk / webhostingtalk / similar.

circa 6y ago

damn this is so sad

thesuitonym 6y ago

This is a good reminder of why DevOps is not necessarily a replacement for a security-minded systems administrator.

sambe 6y ago

I guess you are also supposed to figure out for yourself what private information of yours has been compromised, since they can't be bothered to make it explicit.

stone-monkey 6y ago

Really surprised to see this on hacker news, I would've thought it too piddly to warrant a thread here. Anyway, long time customer and was generally satisfied with the service. I just used it for my low maintenance low traffic wp blog. Got an email yesterday from them with the same message. Think I still had like 6 bucks in my account with them, but frankly, who gives a shit. The cheapness of the service was baked in such that eating a couple of bucks doesn't really matter. We had a good run of 4-5 years. Sad to see them go though.

gogopuppygogo 6y ago
Long time customer as well and found out about this here on HN. I had $4 or $5 left as well but I guess it’s gone. My site is still up for the moment so if I care to save it I’ll move it. Might just be the end of the road for that site as I’m not about to spend more than $12/year to keep it going.
- jopsen 6y ago
  I used wget to render my old MediaWiki setup into a static site, and then threw it on vercel. If you don't want to maintain a legacy app liable to be compromised, going static using wget + a few scripts is a lovely trick. No maintenance, no pain, and free hosting :) I personally doubt static websites will go out of fashion anytime soon.
  - EricE 6y ago
    Jekyl and Gatsby are pretty amazing. Got involved in a project at work that uses Gatsby underneath and once you get used to all the node.js/dependency BS it's actually fun.

Havoc 6y ago

That’s the risk with smaller VPS operations. Good value but could shut down any time and leave you wondering what happened

geocrasher 6y ago

I've worked on the support side of the hosting industry for a Long Time. A few observations. 1) Hosting is hard. It doesn't seem like it should be, but it is. cPanel simplifies and complicates it because you're locked into doing things The cPanel Way whether you like it or not. 2) Hosting is getting more expensive because cPanel keeps jacking up prices, and I strongly suspect that this host threw in the towel due to the severity of the compromise but also the razor thin margins. Digging out from under it was likely more trouble than it was worth, especially if they didn't have insurance for this kind of thing. 3) KEEP YOUR OWN BACKUPS. For the love of all data that is important, keep your own backups. Did I mention that anyone with a website on any provider on any continent should keep their own backups? By all means, keep your own backups. Because if you don't keep your own backups, you'll wish you'd kept your own backups.

dabockster 6y ago
Any competitors to cPanel out there? Both free and paid?
- deleted 6y ago
  [deleted]
- geocrasher 6y ago
  There are many. CentOS Web Panel, Virtualmin, DirectAdmin, Interworx, and many others. I use Virtualmin on my own stuff. It has a FOSS version that works well. But it's no cPanel. The interface and general paradigms leave a lot to be desired. But it works. The problem isn't variety, it's user base. All the Big Hosts are using cPanel, migrating away from it is a pain. There's also Plesk, but let's face it. Nobody likes Plesk.
ljm 6y ago
I'm actually surprised a no support host set you up with something like cPanel and didn't just give you an SFTP user or a restricted shell account.
dspillett 6y ago
> KEEP YOUR OWN BACKUPS To add the rest of my usual mantra: AND TEST YOUR BACKUPS. Memories of the look on someone's face when I had to tell them that their laptop drive was truly dead (unless they wanted to pay a data recovery company a pile o' cash) and the USB stick they'd been saving copies of important documents too appeared to be silently corrupting everything written to it...

johnlogic 6y ago

It looks like the message about shutting down was left by the hacker. I can't tell if NSLH is shutting down, though the breach doesn't instil confidence. Whether NSLH is shutting down or not, it's a good time to make backup copies.

pimlottc 6y ago

The title should be fixed to capitalize the company name "No Support Linux Hosting"; as it's current written, it's not clear that it's a proper name.

ajitgoel 6y ago

What would be a good "no support hosting" alternative be for this provider?

erwinyu888 6y ago

Just go with hosthuddy.com They are cheap and reliable and provide support.

erwinyu888 6y ago

Go with hostbuddy.com They r cheap and reliable.