3 ms·

The fact that you think it should be the customers’ responsibility to make sure that DO doesn’t accidentally give your private data away to unknown third partie

by ratg13 3y ago

The fact that you think it should be the customers’ responsibility to make sure that DO doesn’t accidentally give your private data away to unknown third parties is an absolutely minblowing take on this matter. I’ve been a DO customer for the better part of a decade, but there is no way that I can continue to be a customer with a company that has such a blasé stance toward security and protecting customer data. If anyone can suggest any alternatives that are not Hetzner, I would be interested.

neom 3y ago
Well first, I've not worked for DigitalOcean in a long time, I left in 2015. I don't really wanna re-hash something from 2013, but again: when you deleted a VM you could click the scrub button or pass the scrub flag in the API when you issued a delete call. It was very well documented and the scrub button wasn't hidden anywhere in the interface. The fog platform wasn't using the scrub flag in their app for whatever reason. As I recall, we did change it to scrub by default shortly after. From what I remember, the reason it wasn't originally default was the zero'ing process tried up a lot of resource on the box and it was hard on the drives and we were very much in startup mode at that time with limited capacity, so it was better to only zero if the customer requests it.
- mdpye 3y ago
  You still don't appear to get it though. The fact that there even exists an option (never mind a default) which does not scrub storage between use by different tenants is completely unacceptable in a multi-tenant environment.
- ratg13 3y ago
  Imagine if your bank told you they only close the vault when a customer asks. And they give you an excuse that it’s time consuming for them and you should respect their time. Would you bank with them? This is a pathetic response and you are dragging your former company through the mud by putting the incompetence that you participated in, front and center. It’s amazing that this happened so long ago and yet you seemed to have learned nothing from it, and now want to double down on your right to leak sensitive data (because it was convenient at the time)
  - neom 3y ago
    I was always very clear at that time "this is a startup" - "do not use DO for mission critical work" - "the product is not very mature yet" - we had no sales team, nothing in our marketing was gear towards business and we primarily catered to students/personal sites/etc. I'd accept your analogy except we regularly said "use AWS for important stuff, not us".
    - ratg13 3y ago
      Even startups have to follow the law. Before the GDPR the EU had the 1995 Data Protection Directive, which you would have to comply with to have EU customers. You can’t just decide to not follow the law because you’re a startup.
      - neom 3y ago
        What law would cover this??
        ratg13 3y ago
        I just told you in my previous comment.. In the event your google is broken: ---- https://en.wikipedia.org/wiki/Data_Protection_Directive https://en.wikipedia.org/wiki/Data_Protection_Directive >the controller must implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.
        neom 3y ago
        https://en.wikipedia.org/wiki/Personal_data https://en.wikipedia.org/wiki/Personal_data
        ratg13 3y ago
- 15155 3y ago
  > tried (sic) up a lot of resources on the box Do you know what else ties up a lot of resources? Civil action, negligence claims, PR disasters. This specific GitHub issue is one of several why I will never use DO: language, official response, and attitude all matter. I'd be curious to know how much revenue DO has lost because of this one issue.

by ratg13 3y ago

neom 3y ago

Well first, I've not worked for DigitalOcean in a long time, I left in 2015. I don't really wanna re-hash something from 2013, but again: when you deleted a VM you could click the scrub button or pass the scrub flag in the API when you issued a delete call. It was very well documented and the scrub button wasn't hidden anywhere in the interface. The fog platform wasn't using the scrub flag in their app for whatever reason. As I recall, we did change it to scrub by default shortly after. From what I remember, the reason it wasn't originally default was the zero'ing process tried up a lot of resource on the box and it was hard on the drives and we were very much in startup mode at that time with limited capacity, so it was better to only zero if the customer requests it.

mdpye 3y ago
You still don't appear to get it though. The fact that there even exists an option (never mind a default) which does not scrub storage between use by different tenants is completely unacceptable in a multi-tenant environment.
ratg13 3y ago
Imagine if your bank told you they only close the vault when a customer asks. And they give you an excuse that it’s time consuming for them and you should respect their time. Would you bank with them? This is a pathetic response and you are dragging your former company through the mud by putting the incompetence that you participated in, front and center. It’s amazing that this happened so long ago and yet you seemed to have learned nothing from it, and now want to double down on your right to leak sensitive data (because it was convenient at the time)
- neom 3y ago
  I was always very clear at that time "this is a startup" - "do not use DO for mission critical work" - "the product is not very mature yet" - we had no sales team, nothing in our marketing was gear towards business and we primarily catered to students/personal sites/etc. I'd accept your analogy except we regularly said "use AWS for important stuff, not us".
  - ratg13 3y ago
    Even startups have to follow the law. Before the GDPR the EU had the 1995 Data Protection Directive, which you would have to comply with to have EU customers. You can’t just decide to not follow the law because you’re a startup.
    - neom 3y ago
      What law would cover this??
      - ratg13 3y ago
        I just told you in my previous comment.. In the event your google is broken: ---- https://en.wikipedia.org/wiki/Data_Protection_Directive https://en.wikipedia.org/wiki/Data_Protection_Directive >the controller must implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.
        neom 3y ago
        https://en.wikipedia.org/wiki/Personal_data https://en.wikipedia.org/wiki/Personal_data
        ratg13 3y ago
15155 3y ago
> tried (sic) up a lot of resources on the box Do you know what else ties up a lot of resources? Civil action, negligence claims, PR disasters. This specific GitHub issue is one of several why I will never use DO: language, official response, and attitude all matter. I'd be curious to know how much revenue DO has lost because of this one issue.