5 ms·

So I switched to Digital Ocean after the last Linode security fiasco and I can't say I regret it. Should you decide to switch to another VPS provider I strongl

by ary 13y ago

So I switched to Digital Ocean after the last Linode security fiasco and I can't say I regret it. Should you decide to switch to another VPS provider I strongly recommend you cite the security problems when they ask you why you're closing your account. The only reliable way to get the security message across to technical managers and business people alike is to make it about money. That said the fact that this has happened, in this way, again to Linode is a very bad sign. Having been in meetings, advocated for taking security seriously, and heard the rationalizations for a lax approach I can only say that as a customer if your desire for security isn't made crystal clear you have no hope of getting it. It has to be a deal breaker or not only will companies like Linode not learn, but their competitors who stand to gain from their loss won't either.

sukaka 13y ago
Apparently the password has been reused. Search of password cfr41qa turned up results from almost a year ago https://www.google.com/search?q=cfr41qa https://www.google.com/search?q=cfr41qa
notastartup 13y ago
the security hack was always on back of my mind. what really made me move away from linode is really their inability to accept paypal. Luckily, digitalocean accepted paypal. Also their $5 servers cannot be beat. Sure, linode has some good panels but it was more than I can chew and more than I needed. Digitalocean also had a good amount of docmentation to do everything I needed without filing a ticket.
- taf2 13y ago
  curious, what do use the $5 servers for?
  - notastartup 13y ago
    the same way I used linode for but at 4 times the less cost.
- cthor 13y ago
  A lot of merchants (e.g. Amazon) don't use PayPal because is isn't a real bank, and so isn't beholden by laws associated with banks. The terms of service state that you cannot seek any legal recourse from them should your account be shut down. How could this affect a VPS provider? Say a customer hosts a porn site, or a gun-selling site, or something else PayPal disagrees with. PayPal shuts the merchant's account down for it. Now the merchant's funds are frozen for an indeterminate amount of time till the issue can be resolved, if at all, and there's nothing they can do about it short of appealing to PayPal.
  - deleted 13y ago
    [deleted]
  - notastartup 13y ago
    yeah but when I couldn't use my credit card anymore paypal was the only option.
  - raverbashing 13y ago
    Exactly I am very sympathetic to anyone not wanting to use paypal for these reasons. It is too big a risk, especially for something like a VPS provider that needs the recurring payments.
anaphor 13y ago
Stop acting so dramatic. There's no evidence that there was any security breach. People on IRC are saying this is FUD. <gallaeaho> zectorpt: no <gallaeaho> zectorpt: nothing was "hacked", but old stuff got posted <gallaeaho> again
- infosecslave 13y ago
  Which is blatantly false, if it was "old stuff being posted again" then the mysql credentials wouldn't have been working 60 minutes ago.
  - anaphor 13y ago
    It seems like the data in this is identical to the stuff that was leaked last time. My guess is that someone was able to gain (user level) access to one of the servers hosting the forums, and the best they were able to do is leak an old database that was around from the last breach. It smells like skiddies trying to stir up drama to me. The names of the people posting this crap on IRC are "SABU", "<ryan____", "robertlevin", and "illegal". Yeah they're fucking troll idiots.
  - coff33 13y ago
    Says the bro with the name infosecslave. Nubs everywhere.
  - ctb_mg 13y ago
    Are you a shill? Serious question.
    - jsmthrowaway 13y ago
      You need only read all of the comments made by that account to get the answer to that. I actually have a pretty good idea of who it is, and we will wait to see if I'm proven right.
phkn1 13y ago
Likewise, though my specific concerns were around a suspiciously large volume of inbound traffic that appeared to be maliciously probing for open services, and in particular a lack of any sort of upstream mitigation (to paraphrase their response, "can't help you, try Cloudflare". Of course, Digital Ocean has had its own problems lately with not properly scrubbing decommissioned VPS containers... so to some degree, data security is not a Linode specific problem. And for that matter it is not just because someone is recycling passwords (bad), but because it is by nature one of the most fundamental and pervasive security challenges with any VPS hosting. Your AWS node might be perfectly secure, but it might be sharing a physical rack with a Russian botnet and you'd have no way to know. Bottom line, if you are using a shared environment there is always some risk of having bad neighbors, experiencing disruption at the supervisory layer or of your data bleeding over into an untrusted location. Your application security design should be planned accordingly, and the choice of VPS host is only one part of that equation.
coff33 13y ago
So I posted this advertisement!

by ary 13y ago

sukaka 13y ago

Apparently the password has been reused. Search of password cfr41qa turned up results from almost a year ago https://www.google.com/search?q=cfr41qa https://www.google.com/search?q=cfr41qa

notastartup 13y ago

the security hack was always on back of my mind. what really made me move away from linode is really their inability to accept paypal. Luckily, digitalocean accepted paypal. Also their $5 servers cannot be beat. Sure, linode has some good panels but it was more than I can chew and more than I needed. Digitalocean also had a good amount of docmentation to do everything I needed without filing a ticket.

taf2 13y ago
curious, what do use the $5 servers for?
- notastartup 13y ago
  the same way I used linode for but at 4 times the less cost.
cthor 13y ago
A lot of merchants (e.g. Amazon) don't use PayPal because is isn't a real bank, and so isn't beholden by laws associated with banks. The terms of service state that you cannot seek any legal recourse from them should your account be shut down. How could this affect a VPS provider? Say a customer hosts a porn site, or a gun-selling site, or something else PayPal disagrees with. PayPal shuts the merchant's account down for it. Now the merchant's funds are frozen for an indeterminate amount of time till the issue can be resolved, if at all, and there's nothing they can do about it short of appealing to PayPal.
- deleted 13y ago
  [deleted]
- notastartup 13y ago
  yeah but when I couldn't use my credit card anymore paypal was the only option.
- raverbashing 13y ago
  Exactly I am very sympathetic to anyone not wanting to use paypal for these reasons. It is too big a risk, especially for something like a VPS provider that needs the recurring payments.

anaphor 13y ago

Stop acting so dramatic. There's no evidence that there was any security breach. People on IRC are saying this is FUD. <gallaeaho> zectorpt: no <gallaeaho> zectorpt: nothing was "hacked", but old stuff got posted <gallaeaho> again

infosecslave 13y ago
Which is blatantly false, if it was "old stuff being posted again" then the mysql credentials wouldn't have been working 60 minutes ago.
- anaphor 13y ago
  It seems like the data in this is identical to the stuff that was leaked last time. My guess is that someone was able to gain (user level) access to one of the servers hosting the forums, and the best they were able to do is leak an old database that was around from the last breach. It smells like skiddies trying to stir up drama to me. The names of the people posting this crap on IRC are "SABU", "<ryan____", "robertlevin", and "illegal". Yeah they're fucking troll idiots.
- coff33 13y ago
  Says the bro with the name infosecslave. Nubs everywhere.
- ctb_mg 13y ago
  Are you a shill? Serious question.
  - jsmthrowaway 13y ago
    You need only read all of the comments made by that account to get the answer to that. I actually have a pretty good idea of who it is, and we will wait to see if I'm proven right.

phkn1 13y ago

Likewise, though my specific concerns were around a suspiciously large volume of inbound traffic that appeared to be maliciously probing for open services, and in particular a lack of any sort of upstream mitigation (to paraphrase their response, "can't help you, try Cloudflare". Of course, Digital Ocean has had its own problems lately with not properly scrubbing decommissioned VPS containers... so to some degree, data security is not a Linode specific problem. And for that matter it is not just because someone is recycling passwords (bad), but because it is by nature one of the most fundamental and pervasive security challenges with any VPS hosting. Your AWS node might be perfectly secure, but it might be sharing a physical rack with a Russian botnet and you'd have no way to know. Bottom line, if you are using a shared environment there is always some risk of having bad neighbors, experiencing disruption at the supervisory layer or of your data bleeding over into an untrusted location. Your application security design should be planned accordingly, and the choice of VPS host is only one part of that equation.

coff33 13y ago

So I posted this advertisement!