Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Using Digital Ocean Now: The Aftermath

serdardogruyol.com

Post reply on HN
Print view View original

61–70 of 102 posts

Re: Stop Using Digital Ocean Now: The Aftermath

#61

Post by nwh »

jjoe wrote: post #28

Sorry but I must be blunt... What do people expect for Something has to give. Yes we've all built and sold products and believe in providing an impeccable service worth far greater than the sum of its parts. Because we're in it to please everyone and build a reputation. But hosting is different. There are real costs for not taking action (upstream null routing, blacklisting, chargeback fees, fraud, abuse, etc). I'm d…

I expected a budget service, but they've been anything but that. Their support staff aren't just reading off a script, their instances are fast and downtime non existent. In this case the user fucked up and was made part of a botnet, and DO were forced to protect their network. I'm happier running my services on DO than on any other host.

Re: Stop Using Digital Ocean Now: The Aftermath

#62

Post by csomar »

opendais wrote: post #51
zagi wrote: post #39

Hi, this is Ben, CEO and Co-Founder of DigitalOcean, we have received the document and will discuss the matter publicly. ----- All times are UTC. Our monitoring picked up a malicious UDP traffic pattern on 2013-09-08 00:58:23. A ticket was then opened with the customer at : 2013-09-08 01:05:55 roughly 7 minutes later. The customer informed us that it was a script that was crawling in the background. We informed the c…

So you shutdown the VM due to what appears to be a compromise. That is typical host behavior at least. Locking the user out of their account seems...odd, tho. I've never had that happen, personally, at any host.

Maybe Ben can explain what "locking" an account is actually is. If the customer did, in fact, break the TOS, I think it's logical to lock his account.

Re: Stop Using Digital Ocean Now: The Aftermath

#63

Post by taf2 »

sdogruyol wrote: post #53
veemjeem wrote: post #50

Earlier quoted context omitted.

I think it's a bit sad that you have to go to such great lengths to protect your company's image. This was a very obvious case of customer fault. He admitted that he doesn't know if his server was hacked. The customer probably should have looked into the issue before making a inflammatory blog post. Maybe if you guys charged more you wouldn't get these ultra-cheap customers who think they should get 24/7 support for…

Being attacked or even getting compromised is customer fault ? Okay i get that. But what about closing the account instantly, not notifying the customer, accusing that customer of being a cheap liar and treating them in a bad way?

perhaps they can't tell if the customer was running the attack or not... it's kind of similar to someone buying and selling drugs in your house... it's your house you take some heat when it happens in your home... not sure it was the right thing or wrong, but i am sure they have to shut you down at least on that one instance to protect themselves as well as anyone else using their service...

Re: Stop Using Digital Ocean Now: The Aftermath

#64

Post by joshdance »

zagi wrote: post #39

Hi, this is Ben, CEO and Co-Founder of DigitalOcean, we have received the document and will discuss the matter publicly. ----- All times are UTC. Our monitoring picked up a malicious UDP traffic pattern on 2013-09-08 00:58:23. A ticket was then opened with the customer at : 2013-09-08 01:05:55 roughly 7 minutes later. The customer informed us that it was a script that was crawling in the background. We informed the c…

Good reply Ben. I am actually a DO customer I think you've explained yourself well. Good to remember that there are always two sides to the story. I'm sure both parties could have done things differently. But thanks for the disclosure.

Re: Stop Using Digital Ocean Now: The Aftermath

#65

Post by nerfhammer »

cortesoft wrote: post #49
zagi wrote: post #39

Hi, this is Ben, CEO and Co-Founder of DigitalOcean, we have received the document and will discuss the matter publicly. ----- All times are UTC. Our monitoring picked up a malicious UDP traffic pattern on 2013-09-08 00:58:23. A ticket was then opened with the customer at : 2013-09-08 01:05:55 roughly 7 minutes later. The customer informed us that it was a script that was crawling in the background. We informed the c…

I am curious to see the blog poster's response to this, as your course of action seems completely reasonable. May I ask what about the UDP traffic made it appear abusive?

https://news.ycombinator.com/item?id=6447635

Re: Stop Using Digital Ocean Now: The Aftermath

#66

Post by sdogruyol »

sdogruyol wrote: post #53
veemjeem wrote: post #50

Earlier quoted context omitted.

I think it's a bit sad that you have to go to such great lengths to protect your company's image. This was a very obvious case of customer fault. He admitted that he doesn't know if his server was hacked. The customer probably should have looked into the issue before making a inflammatory blog post. Maybe if you guys charged more you wouldn't get these ultra-cheap customers who think they should get 24/7 support for…

Being attacked or even getting compromised is customer fault ? Okay i get that. But what about closing the account instantly, not notifying the customer, accusing that customer of being a cheap liar and treating them in a bad way?

You know what they stopped answering my ticket after first response. If it wasn't HN post gaining this much traction i'm pretty sure that they won't respond to me.

Re: Stop Using Digital Ocean Now: The Aftermath

#67

Post by veemjeem »

orenbarzilai wrote: post #34

Isn't that a major violation of their SLA? Have you consulted with a lawyer?

Even if they violated their SLA, the most DO could do is offer a $5 refund, which isn't that big a deal. It's probably too costly to hire a lawyer over a $5 server.

Also, I don't think the SLA would include things like getting hacked, or running illegal services.

Re: Stop Using Digital Ocean Now: The Aftermath

#68

Post by csomar »

sdogruyol wrote: post #46
zagi wrote: post #39

Hi, this is Ben, CEO and Co-Founder of DigitalOcean, we have received the document and will discuss the matter publicly. ----- All times are UTC. Our monitoring picked up a malicious UDP traffic pattern on 2013-09-08 00:58:23. A ticket was then opened with the customer at : 2013-09-08 01:05:55 roughly 7 minutes later. The customer informed us that it was a script that was crawling in the background. We informed the c…

Hello Ben, thanks for the response. Fırst of all at first ticket i told that the only possibility of having an UDP outgoing is that script that i wrote. Other than that i've no other activity or script that can generate that much traffic. Haven't you even considered that my droplet may be compromised or being attacked ? Instead of letting me know what exactly happened or which processes were running at that time you…

Unmanaged = Your responsibility

I got my server down with DO many times at first. It was a problem with the CentOs package; but it was indeed my responsibility to fix it.

You are responsible of securing your server.

Re: Stop Using Digital Ocean Now: The Aftermath

#70

Post by nav1 »

sdogruyol wrote: post #58
sdogruyol wrote: post #46

Earlier quoted context omitted.

Hello Ben, thanks for the response. Fırst of all at first ticket i told that the only possibility of having an UDP outgoing is that script that i wrote. Other than that i've no other activity or script that can generate that much traffic. Haven't you even considered that my droplet may be compromised or being attacked ? Instead of letting me know what exactly happened or which processes were running at that time you…

I was also tremendously happy with DO and their service. But what if you get your production apps down without even any notification and proper reasoning ? That's the thing which makes you feel insecure.

They did notify you.

>Our monitoring picked up a malicious UDP traffic pattern on 2013-09-08 00:58:23. A ticket was then opened with the customer at : 2013-09-08 01:05:55 roughly 7 minutes later.

Also, you should do a better job securing your server. It seems like the server was compromised.

Post reply on HN