41–50 of 52 posts
Earlier quoted context omitted.
Standard containerization technology (e.g. docker) isn’t designed to sandbox untrusted code.
Do tell what is designed to sandbox untrusted code
Anecdotally, I've used Dreamhost for years as a domain host and have had nothing but positive experiences.
Originally I switched to them for being very vocally against SOPA, and they've consistently been on the right side of various Internet legislative issues.
Dreamhost had the best response of all of them (at the bottom of the article). Anecdotally, I've used Dreamhost for years as a domain host and have had nothing but positive experiences. Originally I switched to them for being very vocally against SOPA, and they've consistently been on the right side of various Internet legislative issues.
They do seem like good people, I have no plan to move my own stuff from Dreamhost and I can't fault their customer service, but I also cannot recommend for stuff beyond vanity domains, fun side projects and so on because they've had so many issues that suggest a lot of stuff is kind of half-arsed. My home Internet service provider is also good hearted, but they've also been very _competent_ which is important, and I just can't honestly say that about Dreamhost.
Three (of many) Examples:
I own a .co.uk domain, and the people who run .co.uk have different requirements for WHOIS and for how domain transfers work. So Dreamhost would present me a generic "Here's how to change WHOIS" page and then it'd mysteriously fail, but actually their backend just didn't work with that entire 2LD, and domain transfer stuff would not work or it'd seem to work but then payment was rejected and the transfer doesn't go through...
I made a DNS change through Dreamhost's control panel, and after a reasonable period of time (maybe an hour?) of Dreamhost's three authoritative DNS servers only one had updated. So I talk to their support. They say I need to wait for it to "propagate" which is bullshit, these are authoritative servers, "propagating" data to the authoritative servers is Dreamhost's problem and if they can't do it in an hour what are they using, carrier pigeons? Then the support person shows me dig results they see locally for those DNS servers which don't match results I see, showing that actually these servers are either split brain or anycast groups, I ask about that, and the tech assures me that no, the answers they see are correct and that answers I see, by literally querying the same IP addresses, must need to "propagate" for a few hours more. After enough prompting they relent and say they'll "check" with someone about the DNS servers. Literally under 60 seconds after going to "check" the results are fixed. Huh, what a "coincidence".
Most hilariously one time they charged me for a year in advance entirely by accident, someone fat fingered a script that takes money from customer accounts. Now, like I said their customer service is good, I got the money refunded together with my costs for the currency difference between when they took the bogus transaction and when it was refunded rounded up. But if I had a $5000 contract that'd have hurt a lot more than it did for a few vanity sites.
Would setting samesite cookie values have mitigated Bluehost's problems 1 and 2 in part? Or do CORS requests include cookies for compatibility purposes?
In other words: yes, it would have mitigated Bluehost's problems. It would also have broken their sites (or otherwise they would not be needing to use CORS requests at all).
[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Ac...
Dreamhost had the best response of all of them (at the bottom of the article). Anecdotally, I've used Dreamhost for years as a domain host and have had nothing but positive experiences. Originally I switched to them for being very vocally against SOPA, and they've consistently been on the right side of various Internet legislative issues.
I've been with Dreamhost personally for almost two decades, and as a group my friends have a shared account with them that's far older. Like, old enough that work was done on porting code to _the brand new PHP3_. They do seem like good people, I have no plan to move my own stuff from Dreamhost and I can't fault their customer service, but I also cannot recommend for stuff beyond vanity domains, fun side projects and…
Seconded.
Dreamhost is fantastic at tone in their communications, especially broad public communications; they sound accessible, human, and open rather than corporate... and maybe they are, or maybe that's just part of their brand.
They are not, however, super reliable when it comes to availability, especially if your resource usage starts to approach something on the order of magnitude stated capacity, and in that case you will find out that there are the system rules they sold you on, and there's the unwritten rules which may or may not even be legible to you by the time you're done.
This is not unheard of when it comes to discount hosting, of course, and I don't expect them to be different. Just sayin' that neither should anyone else.
These seem to have been "technical" bugs, mostly in the client-server communication of the self-service websites. But hosting management also has a whole lot of potential for logical errors. I work at a B2B ISP that is also a managed service provider, and every now and then somebody calls for more self-service. I'm not against it, but it's full of landmines. It starts with such simple things as account creation. We a…
Also browsers automatic sending cookie enable many of these CSRF, consider JWT.
Amazing how PHP is still bitting developers.
I think everyone need to remember CORS is a browser-only protection and anything you expose via CORS protected endpoint in reallity has no protection at all. Try cURL reaching any endpoint protected by CORS and you'll see what I mean. Also browsers automatic sending cookie enable many of these CSRF, consider JWT. Amazing how PHP is still bitting developers.