5 ms·

Have they updated their security and disclosure policies ? If not they can remain in my "dodgy vendor who you can't trust" list. For those that don't remember

Have they updated their security and disclosure policies ? If not they can remain in my "dodgy vendor who you can't trust" list. For those that don't remember hackers managed to get root access to several VPS via some Linode vulnerability. Didn't bother to let customers know. Didn't bother to update their status/website. Didn't bother to tell anyone what they've done to fix it. Compare that with CloudFlare: http://blog.cloudflare.com/post-mortem-todays-attack-apparent-google-app http://blog.cloudflare.com/post-mortem-todays-attack-apparen... Linode continues to be a recurring example of how not to behave as a vendor.

whalesalad 14y ago
Continues? I've been a happy Linode customer for a long time. Their boxes are snappy. I rarely have issues, and when I do, they are pretty quick to respond and help out. I've also had my fare share of free hosting thanks to their referral platform. Aside from the issue you mention, what else have they been doing wrong?
- taligent 14y ago
  Congratulations. I was a happy Linode customer too until I had to find out from Reddit that a major security hack had occurred and my VPS had potentially been rooted. I don't recall every receiving an email from Linode about it. And the fact is that every single day that passes without them updating their security/disclosure policies and showing some commitment to transparency is another day they will be classed as "untrustworthy".
jspthrowaway2 14y ago
If you are referring to the Bitcoin incident, the only accurate statement in your comment is that hackers managed to gain root access on several VPS. The rest of it is nowhere remotely close to the truth: http://status.linode.com/2012/03/manager-security-incident.html http://status.linode.com/2012/03/manager-security-incident.h... You were very active in the very forum thread wherein the announcement was posted by another customer, not half a dozen posts above you, so I find it hard to believe this falsehood is not intentional: http://forum.linode.com/viewtopic.php?f=20&t=8509 http://forum.linode.com/viewtopic.php?f=20&t=8509 Considering the grandstanding you did in that forum thread and are continuing to do here with your overly aggressive (and false) commentary, I question whether you have some kind of overt agenda against Linode that is clouding any message you might have. Every company makes mistakes, and Linode, in my opinion, handled this one as appropriately as they could have; were it Amazon, who are far more secretive (particularly with outages), we might have never known.
- thaumaturgy 14y ago
  taligent's primary complaint seems to boil down to Linode not making a public statement about the problem until after one of the affected individuals had taken his case to Reddit. I don't think that's an unreasonable complaint. I'm still a pretty enthusiastic Linode customer, but that incident bothers me a little bit too. I have to wonder if they would have addressed the problem publicly at all if the story hadn't made the rounds on the social news sites. You shouldn't question his motives unless you have something more solid to go on than, "unhappy former customer".
  - jspthrowaway2 14y ago
    Things take time to investigate and fix. The investigation was probably underway when the story went around. Rushing something out, be it a fix, release, whatever, is risky and a good way to be wrong (which is worse than deliberate). Imagine sending out a press release saying that you fixed it and the incident repeating itself an hour later. Usually, I side with "better eventually than never". I agree on the root complaint, and it is valid, but OP did pretty directly say that Linode did not notify customers about the issue, implying to this day. That's demonstrably false, and I don't like to see Hacker News threads turn in to a whirlwind of fairy tales. My conclusion regarding OP is based largely upon his behavior in the forum thread I linked. I actually remembered him by name when I saw his comment, which should say something.
    - thaumaturgy 14y ago
      Alright, I scrolled through all 16 pages of the singularity of stupidity that was that thread. I don't see anything in there by taligent that stands out. About the worst he did was let himself get dragged into a personal fight in the first few pages. (I wonder now which one of the users you were in that forum thread. sednet?) You linked to the email exchange between Linode support and one of the affected customers. You know that Linode already had an idea that they had a problem before the rest of their customers found it. Do you think it would have been so unreasonable for Linode to at least put up a message on status.linode.com, "We are investigating an incident of unauthorized access to one of our customer Linodes, we will update this as we investigate it"? And I don't read that implication from taligent's comment here. I think it's obvious that he's saying that they didn't bother to let their customers know when the incident occurred. Basically: he thinks they didn't handle the disclosure on that matter in a way befitting its seriousness, and he thinks that they've done nothing to show that they'll handle it differently in the future. I agree on both counts. As he said in the forum thread, what makes this so frustrating is that Linode has been so spectacular in every other regard. He's right also to point to the CloudFlare post-mortem as an example of Doing It Right. Surely you see the stark difference between CloudFlare's handling of their incident and Linode's? We still don't know the exact nature of the compromise (former employee? Did Linode have an externally-accessible customer service interface? What happened), nor do we have any idea what they did about it, other than that they say they "will be reviewing our policies and procedures to prevent this from ever recurring" -- an extremely wormy statement that will still be true even if they choose to change nothing at all. I don't like to see HN threads turn in to a whirlwind of pointless personal attacks. Let's just discuss the facts, OK?
deleted 14y ago
[deleted]

whalesalad 14y ago

Continues? I've been a happy Linode customer for a long time. Their boxes are snappy. I rarely have issues, and when I do, they are pretty quick to respond and help out. I've also had my fare share of free hosting thanks to their referral platform. Aside from the issue you mention, what else have they been doing wrong?

taligent 14y ago
Congratulations. I was a happy Linode customer too until I had to find out from Reddit that a major security hack had occurred and my VPS had potentially been rooted. I don't recall every receiving an email from Linode about it. And the fact is that every single day that passes without them updating their security/disclosure policies and showing some commitment to transparency is another day they will be classed as "untrustworthy".

jspthrowaway2 14y ago

If you are referring to the Bitcoin incident, the only accurate statement in your comment is that hackers managed to gain root access on several VPS. The rest of it is nowhere remotely close to the truth: http://status.linode.com/2012/03/manager-security-incident.html http://status.linode.com/2012/03/manager-security-incident.h... You were very active in the very forum thread wherein the announcement was posted by another customer, not half a dozen posts above you, so I find it hard to believe this falsehood is not intentional: http://forum.linode.com/viewtopic.php?f=20&t=8509 http://forum.linode.com/viewtopic.php?f=20&t=8509 Considering the grandstanding you did in that forum thread and are continuing to do here with your overly aggressive (and false) commentary, I question whether you have some kind of overt agenda against Linode that is clouding any message you might have. Every company makes mistakes, and Linode, in my opinion, handled this one as appropriately as they could have; were it Amazon, who are far more secretive (particularly with outages), we might have never known.

thaumaturgy 14y ago
taligent's primary complaint seems to boil down to Linode not making a public statement about the problem until after one of the affected individuals had taken his case to Reddit. I don't think that's an unreasonable complaint. I'm still a pretty enthusiastic Linode customer, but that incident bothers me a little bit too. I have to wonder if they would have addressed the problem publicly at all if the story hadn't made the rounds on the social news sites. You shouldn't question his motives unless you have something more solid to go on than, "unhappy former customer".
- jspthrowaway2 14y ago
  Things take time to investigate and fix. The investigation was probably underway when the story went around. Rushing something out, be it a fix, release, whatever, is risky and a good way to be wrong (which is worse than deliberate). Imagine sending out a press release saying that you fixed it and the incident repeating itself an hour later. Usually, I side with "better eventually than never". I agree on the root complaint, and it is valid, but OP did pretty directly say that Linode did not notify customers about the issue, implying to this day. That's demonstrably false, and I don't like to see Hacker News threads turn in to a whirlwind of fairy tales. My conclusion regarding OP is based largely upon his behavior in the forum thread I linked. I actually remembered him by name when I saw his comment, which should say something.
  - thaumaturgy 14y ago
    Alright, I scrolled through all 16 pages of the singularity of stupidity that was that thread. I don't see anything in there by taligent that stands out. About the worst he did was let himself get dragged into a personal fight in the first few pages. (I wonder now which one of the users you were in that forum thread. sednet?) You linked to the email exchange between Linode support and one of the affected customers. You know that Linode already had an idea that they had a problem before the rest of their customers found it. Do you think it would have been so unreasonable for Linode to at least put up a message on status.linode.com, "We are investigating an incident of unauthorized access to one of our customer Linodes, we will update this as we investigate it"? And I don't read that implication from taligent's comment here. I think it's obvious that he's saying that they didn't bother to let their customers know when the incident occurred. Basically: he thinks they didn't handle the disclosure on that matter in a way befitting its seriousness, and he thinks that they've done nothing to show that they'll handle it differently in the future. I agree on both counts. As he said in the forum thread, what makes this so frustrating is that Linode has been so spectacular in every other regard. He's right also to point to the CloudFlare post-mortem as an example of Doing It Right. Surely you see the stark difference between CloudFlare's handling of their incident and Linode's? We still don't know the exact nature of the compromise (former employee? Did Linode have an externally-accessible customer service interface? What happened), nor do we have any idea what they did about it, other than that they say they "will be reviewing our policies and procedures to prevent this from ever recurring" -- an extremely wormy statement that will still be true even if they choose to change nothing at all. I don't like to see HN threads turn in to a whirlwind of pointless personal attacks. Let's just discuss the facts, OK?

deleted 14y ago

[deleted]