Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Super Cheap Virtual Private Servers - the Wild West of Hosting

blog.maclawran.ca

Post reply on HN
Print view View original

51–60 of 65 posts

Re: Super Cheap Virtual Private Servers - the Wild West of Hosting

#51

Post by throwaway64 »

waitwhat wrote: post #14
darklajid wrote: post #9

So I thought I give empire-hosting a try to play with a cheap box. >>> Thank you for signing up with us. Your new account has been setup and you can now login to our client area using the details below. Email Address: my.mail@address Password: YepYouGuessWhatWasRightHereInCleartext To login, visit http://secure.empire-hosting.net Ah well.. Let's look at the other recommendations of that list, I guess.

Just because the welcome email contains the password in clear doesn't mean that they permanently store the password in their database unhashed.

can we please stop having this conversation every time a plain text password is mentioned, its a bad idea to have a recoverable password, in any form, the end.

http://codahale.com/how-to-safely-store-a-password/

Re: Super Cheap Virtual Private Servers - the Wild West of Hosting

#53

Post by Confusion »

throwaway64 wrote: post #51
waitwhat wrote: post #14

Earlier quoted context omitted.

Just because the welcome email contains the password in clear doesn't mean that they permanently store the password in their database unhashed.

can we please stop having this conversation every time a plain text password is mentioned, its a bad idea to have a recoverable password, in any form, the end. http://codahale.com/how-to-safely-store-a-password/

It's not helping that you give the wrong explanation. The issue here isn't that the password is recoverable, because you don't know whether that is true. It may as well be properly bcrypted. The problem is that they sent you the plaintext password you just entered via email.

Re: Super Cheap Virtual Private Servers - the Wild West of Hosting

#54

Post by jsn »

waitwhat wrote: post #29
jsn wrote: post #26

Earlier quoted context omitted.

No, but it does mean that anyone who's able to view your traffic or your mail box content could've seen the password (anyone controlling any router or a mail relay between you and them, or your mail service provider, or even someone with tcpdump on your LAN segment).

If your threat model includes hostile mail relays, you probably shouldn't be using bargain basement VPS providers. Password-reset emails are also easy for an attacker to generate, and no harder for them to intercept than the welcome email.

Right, that's what GP said in the comment you replied to: that he probably should not use that VPS provider.

And yes, password-reset emails may also be a concern (not as severe, though, if reset emails are single-use and have short TTL).

Re: Super Cheap Virtual Private Servers - the Wild West of Hosting

#55

Post by Dylan16807 »

throwaway64 wrote: post #51
waitwhat wrote: post #14

Earlier quoted context omitted.

Just because the welcome email contains the password in clear doesn't mean that they permanently store the password in their database unhashed.

can we please stop having this conversation every time a plain text password is mentioned, its a bad idea to have a recoverable password, in any form, the end. http://codahale.com/how-to-safely-store-a-password/

Can we please have people stop assuming that the password is recoverable just because it's put in an email when it's set.

Re: Super Cheap Virtual Private Servers - the Wild West of Hosting

#56

Post by lucb1e »

"These virtual machines, called Virtual Private Servers (or VPS's), are cheap. You can get your own instance of linux for very very little money. Like $10 a month, sometimes less."

The Dutch company Versio (domains, shared hosting, dedicated, vps, colocation) hosts VPSes from as little as €5,-/month. You need to pay in 3 month terms, though. I don't really mean to adverstise, but why did this page make it to the HN homepage?

Re: Super Cheap Virtual Private Servers - the Wild West of Hosting

#57

Post by spqr »

webfuel wrote: post #3
josephb wrote: post #2

From the article: > Linode http://linode.com - expensive, no IPV6, really fast network @ 11.9 Mbps Actually Linode have IPv6 support in 5 of their 6 locations :-)

I just did the speed test on linode (Atlanta) and got 52.1 MBps. I can't say enough good things about their service. http://imgur.com/BLmCH

It is way too easy for these providers to fake the results of "the speed test". Just re-route the URL to a local resource or have all users go through a local proxy which caches the speed test file... the results of the test will be phenomenal but will not in any way reflect the reality of transferring files on the host's network.

I'm not saying they're doing that, just that the methodology of using a single URL to wget is way too easy to cheat.

Re: Super Cheap Virtual Private Servers - the Wild West of Hosting

#58

Post by api »

moe wrote: post #42
api wrote: post #41

Part of why this can be so cheap is density. The Parallels Virtuozzo / OpenVZ container-based approach to virtualization is just so infinitely more efficient than hypervisor-based virtualization. It's really, really staggering. We use it where I work for internal virtualization and have done tests with thousands of containers on a box that could hold at most 20-30 KVM-based hypervisor instances. If you look into the…

Part of why this can be so cheap is density. This is also the reason why performance is usually beyond terrible. Most of the cheap VPS hosts are extremely overprovisioned and not very well maintained. There may be the odd gem (I haven't tried alien), but $130 buys you a rackspace VM for a year nowadays, so I don't see the point of even bothering anymore.

Those are business problems, not tech shortcomings. Poor performance is due to horrendous overselling, while poor maintenance is due to being cheap.

You don't have to oversell like that. It doesn't change the fundamental, unavoidable fact that containers are a far more efficient way to virtualize than hypervisors for fundamental architectural reasons. An OpenVZ-based hoster that didn't oversell ridiculously would be cheaper and faster than a hypervisor-based host.

With a hypervisor you are running an entire kernel within a simulated machine within another kernel. That will never be more efficient.

Re: Super Cheap Virtual Private Servers - the Wild West of Hosting

#59

Post by simonbrown »

waitwhat wrote: post #29
jsn wrote: post #26

Earlier quoted context omitted.

No, but it does mean that anyone who's able to view your traffic or your mail box content could've seen the password (anyone controlling any router or a mail relay between you and them, or your mail service provider, or even someone with tcpdump on your LAN segment).

If your threat model includes hostile mail relays, you probably shouldn't be using bargain basement VPS providers. Password-reset emails are also easy for an attacker to generate, and no harder for them to intercept than the welcome email.

But you at least know your account has been compromised.

Re: Super Cheap Virtual Private Servers - the Wild West of Hosting

#60

Post by ilaksh »

It would be nice if there were a web site with a recommended tool that you could install on your VPS and then when you ran it it would upload your results directly to a comparison page. That way you could compare the cost to the performance of each service.

It could run that network test he mentions in the article, and hdparm, something to check CPU load, gather info on the CPUs and memory and whether it was using Xen or OpenVZ or whatever, maybe try a few benchmarks.

Post reply on HN