3 ms·

I did read the article. Based on what you wrote, they offered to help investigate the issue in October, November, December if you would give them root access.

by brk 17y ago

I did read the article. Based on what you wrote, they offered to help investigate the issue in October, November, December if you would give them root access. For some reason you had an issue with this (it's actually extremely common on any shared box that you do not own). After the server that you lease from them (I omit calling it "your" server on purpose) continued to have issues that impacted customers outside of yourself, they logged into the box and (based on your article again) seemed to resolve the root (pun intended) issue rather quickly. This seems to have occurred 2-3 months after the initial root access request. The response of shutting off Apache was a bit extreme, but given the history, not terribly surprising either.

mbreese 17y ago
If you rent an apartment, you don't call it "the apartment that I rent", you call it "my apartment". Also, the landlord owns the place, but that doesn't give the landlord carte blanche to enter the apartment anytime they feel like it. Sure, they "own" it, but that does not make it any less wrong for them to barge in and gain access. If they need access, they must provide sufficient notice and must do it for a specific reason. This is a very similar situation. Particularly interesting to me is that they had the technical means to restrict the virtual machine via a configuration change, but instead chose to "trespass". According to their terms and conditions, "Misuse of System Resources" is prohibited, but their only listed recourse is to "restrict, suspend, or terminate" the account. It is arguable that they had no right to access the data for his server, since they had other means to restrict or otherwise limit the VPS (which they already did). They should have just paused the VPS without accessing the data and send him an email. Adding your SSH key to a customer's server without notice or approval is a good way to tarnish a reputation among the hacker crowd (their customer base). I wouldn't allow them to have root access either. Their argument would have been much stronger had they provided any sort of evidence of CPU load of his server. However, that probably would have shown how oversold the machine really was.
- brk 17y ago
  * Also, the landlord owns the place, but that doesn't give the landlord carte blanche to enter the apartment anytime they feel like it.* Of course not, but the landlord does generally have the right to enter the property if there is an emergency (water is dripping from your unit into the unit below you). The hosting company here did not just drop in to see if he had any good scripts or pr0n to steal, they did so after resource issues.
  - apotheon 17y ago
    The apartment manager wouldn't have the ability to "pause" the apartment and wait for permission from the tenant to enter, though. The situation isn't strictly analogous.
    - brk 17y ago
      How is pausing an entire slice and thereby killing ALL services better than just shutting down one daemon?
      - apotheon 17y ago
        It's better the same way that your apartment complex manager turning off the water to your apartment if there's a problem is better than going inside when you explicitly told him not to, checking all your faucets, and going through your underwear drawer, when you're not there.
        jrockway 17y ago
        Rimuhosting didn't go through this guy's underwear drawer, though. They went in and turned off the faucet that was damaging the apartment below.
        apotheon 17y ago
        > Rimuhosting didn't go through this guy's underwear drawer, though. How do you know? They rooted the system against the explicitly stated wishes of the customer. What makes you think they wouldn't do other sketchy things while they're at it?
- SwellJoe 17y ago
  If you rent an apartment, you don't call it "the apartment that I rent", you call it "my apartment". Also, the landlord owns the place, but that doesn't give the landlord carte blanche to enter the apartment anytime they feel like it. This analogy doesn't really hold. "Your" apartment gets special rights under the law in the US and probably other places. Those rights are actually pretty extreme (it takes months after they stop paying to evict someone in most states, for example), and you don't have those same rights or expectations of privacy within an office building, or anything else you rent or lease that isn't your domicile. According to their terms and conditions, "Misuse of System Resources" is prohibited, but their only listed recourse is to "restrict, suspend, or terminate" the account. Sounds, to me, like they restricted his account to one that wasn't running Apache. But, I agree that they should have simply turned him off. Customers that don't want administrative assistance on the system should never have it imposed on them, and I would also prefer my provider never login to my systems (and I don't provide them with access to my systems; though I know that because they have access to the hardware, they always have root available to them; I rely on good faith to prevent them from doing harm or abusing my privacy). However, that probably would have shown how oversold the machine really was. While this is very often true in the VPS hosting industry, Rimuhosting has an otherwise very good reputation. It's pretty easy to know when you're on an oversold host, and it's not something I've ever heard Rimuhosting accused of.
  - mbreese 17y ago
    The apartment analogy isn't perfect, but it is a good example to show that just because you own something, it doesn't give you the legal (or moral) right to muck around with it whenever you please. If you're renting computer space to a customer, there are rules that need to be followed. Some of them are legal, some contractual, and some are societal norms. In this case they definitely violated the societal norms and possibly their contractual obligations as well. I'd say that you have a pretty good expectation of privacy on a virtual _private_ server. I don't particularly know anything about Rimuhosting. I know most places are oversold to a certain degree. I suspect that there isn't any way to make money in the industry if you're not.

by brk 17y ago

mbreese 17y ago

If you rent an apartment, you don't call it "the apartment that I rent", you call it "my apartment". Also, the landlord owns the place, but that doesn't give the landlord carte blanche to enter the apartment anytime they feel like it. Sure, they "own" it, but that does not make it any less wrong for them to barge in and gain access. If they need access, they must provide sufficient notice and must do it for a specific reason. This is a very similar situation. Particularly interesting to me is that they had the technical means to restrict the virtual machine via a configuration change, but instead chose to "trespass". According to their terms and conditions, "Misuse of System Resources" is prohibited, but their only listed recourse is to "restrict, suspend, or terminate" the account. It is arguable that they had no right to access the data for his server, since they had other means to restrict or otherwise limit the VPS (which they already did). They should have just paused the VPS without accessing the data and send him an email. Adding your SSH key to a customer's server without notice or approval is a good way to tarnish a reputation among the hacker crowd (their customer base). I wouldn't allow them to have root access either. Their argument would have been much stronger had they provided any sort of evidence of CPU load of his server. However, that probably would have shown how oversold the machine really was.

brk 17y ago
* Also, the landlord owns the place, but that doesn't give the landlord carte blanche to enter the apartment anytime they feel like it.* Of course not, but the landlord does generally have the right to enter the property if there is an emergency (water is dripping from your unit into the unit below you). The hosting company here did not just drop in to see if he had any good scripts or pr0n to steal, they did so after resource issues.
- apotheon 17y ago
  The apartment manager wouldn't have the ability to "pause" the apartment and wait for permission from the tenant to enter, though. The situation isn't strictly analogous.
  - brk 17y ago
    How is pausing an entire slice and thereby killing ALL services better than just shutting down one daemon?
    - apotheon 17y ago
      It's better the same way that your apartment complex manager turning off the water to your apartment if there's a problem is better than going inside when you explicitly told him not to, checking all your faucets, and going through your underwear drawer, when you're not there.
      - jrockway 17y ago
        Rimuhosting didn't go through this guy's underwear drawer, though. They went in and turned off the faucet that was damaging the apartment below.
        apotheon 17y ago
        > Rimuhosting didn't go through this guy's underwear drawer, though. How do you know? They rooted the system against the explicitly stated wishes of the customer. What makes you think they wouldn't do other sketchy things while they're at it?
SwellJoe 17y ago
If you rent an apartment, you don't call it "the apartment that I rent", you call it "my apartment". Also, the landlord owns the place, but that doesn't give the landlord carte blanche to enter the apartment anytime they feel like it. This analogy doesn't really hold. "Your" apartment gets special rights under the law in the US and probably other places. Those rights are actually pretty extreme (it takes months after they stop paying to evict someone in most states, for example), and you don't have those same rights or expectations of privacy within an office building, or anything else you rent or lease that isn't your domicile. According to their terms and conditions, "Misuse of System Resources" is prohibited, but their only listed recourse is to "restrict, suspend, or terminate" the account. Sounds, to me, like they restricted his account to one that wasn't running Apache. But, I agree that they should have simply turned him off. Customers that don't want administrative assistance on the system should never have it imposed on them, and I would also prefer my provider never login to my systems (and I don't provide them with access to my systems; though I know that because they have access to the hardware, they always have root available to them; I rely on good faith to prevent them from doing harm or abusing my privacy). However, that probably would have shown how oversold the machine really was. While this is very often true in the VPS hosting industry, Rimuhosting has an otherwise very good reputation. It's pretty easy to know when you're on an oversold host, and it's not something I've ever heard Rimuhosting accused of.
- mbreese 17y ago
  The apartment analogy isn't perfect, but it is a good example to show that just because you own something, it doesn't give you the legal (or moral) right to muck around with it whenever you please. If you're renting computer space to a customer, there are rules that need to be followed. Some of them are legal, some contractual, and some are societal norms. In this case they definitely violated the societal norms and possibly their contractual obligations as well. I'd say that you have a pretty good expectation of privacy on a virtual _private_ server. I don't particularly know anything about Rimuhosting. I know most places are oversold to a certain degree. I suspect that there isn't any way to make money in the industry if you're not.