Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Taking Over DigitalOcean Domains via a Lax Domain Import System

thehackerblog.com

Post reply on HN
Print view View original

181–186 of 186 posts

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#181

Post by dumbsecreport »

hatsix wrote: post #166
jsmthrowaway wrote: post #121

Earlier quoted context omitted.

More throwaway astroturfing? You say "20 thousand" the same way as your other likely throwaway account, V8OaSsoA (that is to say: somewhat identifiably) and complained about someone ripping off DigitalOcean's Web design on this account. I'm doing math on the throwaways that are oddly attracted to this thread. You are making it very obvious that you are almost certainly a DigitalOcean employee across the two throwaway…

Eh, I used '20 thousand' in one of my responses, does that mean I'm the real identity of the throwaways? Probably not.

Yeah, if it wasn't obvious enough already, I used that number because it's the one in the headline of the article........

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#182

Post by Twirrim »

linrocks wrote: post #159
Twirrim wrote: post #105

Earlier quoted context omitted.

Linode has an awful track record for security.

Been there for several years, no incidents, their support is fast and they are smart, odd huh?

Then you've been through their back end being compromised and customer details leaked several times. I'd been using them since about 2009ish and used them until earlier this year.

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#183

Post by mandatory »

jarland wrote: post #124

Hey Matthew, I just wanted to let you know that I really appreciate your feedback, as well as the feedback from the other commenters here. I understand that many here are concerned that banning the account seems, from this perspective, to have been an unjustified action. I do believe that there is a bit of a misunderstanding on the timeline of events here, as well as the source of the decision. To be clear, Cash supp…

Hey Jarland thanks for the thoughtful response. I don't think your actions were rude or inappropriate (what host would see this behavior and not act similarly?). I apologize that the discussion on the topic became so negative towards DigitalOcean (this might be my fault, I was merely trying to point out why I hadn't been able to delete the domains - not say that DigitalOcean was a bad company/etc). The disclaimer I added early on I thought would mitigate some of this negativity but apparently not quite.

At the very least I'm happy that some people have seen this more as a study of this pattern of functionality being an issue instead of this being only a DigitalOcean problem. I've seen (and have been reached out by) multiple people realizing this affects their company as well which has been awesome to watch.

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#184

Post by jarland »

mandatory wrote: post #183
jarland wrote: post #124

Hey Matthew, I just wanted to let you know that I really appreciate your feedback, as well as the feedback from the other commenters here. I understand that many here are concerned that banning the account seems, from this perspective, to have been an unjustified action. I do believe that there is a bit of a misunderstanding on the timeline of events here, as well as the source of the decision. To be clear, Cash supp…

Hey Jarland thanks for the thoughtful response. I don't think your actions were rude or inappropriate (what host would see this behavior and not act similarly?). I apologize that the discussion on the topic became so negative towards DigitalOcean (this might be my fault, I was merely trying to point out why I hadn't been able to delete the domains - not say that DigitalOcean was a bad company/etc). The disclaimer I a…

No worries! You're always welcome at DigitalOcean :)

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#185

Post by mattaustin »

jarland wrote: post #124

Hey Matthew, I just wanted to let you know that I really appreciate your feedback, as well as the feedback from the other commenters here. I understand that many here are concerned that banning the account seems, from this perspective, to have been an unjustified action. I do believe that there is a bit of a misunderstanding on the timeline of events here, as well as the source of the decision. To be clear, Cash supp…

I think most of the "outrage" is with the complete lack of validation and the "This is a known workflow within our platform" response more than the ban. Any plans to address the issue other than reactive bans?

Re: Taking Over DigitalOcean Domains via a Lax Domain Import System

#186

Post by jarland »

mattaustin wrote: post #185
jarland wrote: post #124

Hey Matthew, I just wanted to let you know that I really appreciate your feedback, as well as the feedback from the other commenters here. I understand that many here are concerned that banning the account seems, from this perspective, to have been an unjustified action. I do believe that there is a bit of a misunderstanding on the timeline of events here, as well as the source of the decision. To be clear, Cash supp…

I think most of the "outrage" is with the complete lack of validation and the "This is a known workflow within our platform" response more than the ban. Any plans to address the issue other than reactive bans?

I think it's absolutely appropriate to sit down and talk about ways that we can prevent this, both in the short term and long term. I don't think it's as simple of a problem as some might suggest, because you've got to balance expected behavior, a reasonable expectation of convenience, and added security measures.

I don't think you can make a proper decision where you're only looking out for protection, or only looking out for convenience, or only looking out for expected behavior. I think you have to mesh all of these items together and make a change that addresses each item, and I don't think that's necessarily a one day discussion. Certainly security does come at a cost of convenience, and that is okay, but it is important not to toss convenience aside as something not worthy of consideration.

So yeah not trying to be vague, my position is not with engineering or security but with the support team. I do think we need to talk about this, and conversations are taking place, but I don't honestly have the ability to say "Yes we're going to implement _____ within ____ days" or something like that. At least not today.

Post reply on HN