Comment by ryanlol | Hacker News Reader

Comment by ryanlol | Hacker News Reader

Obligatory Linode warning. Linode has a history of putting their customers in very uncomfortable situations.

Here's a few HN threads on the previous disasters:

https://news.ycombinator.com/item?id=3654110 Compromised Linode, thousands of BitCoins stolen (2012)

https://news.ycombinator.com/item?id=3655137 Linode Manager Security Incident (2012)

https://news.ycombinator.com/item?id=5552756 Linode hacked, CCs and passwords leaked (2013)

https://news.ycombinator.com/item?id=7086921 An old system and a SWAT team (2014)

https://news.ycombinator.com/item?id=10825425 Linode DDoS continues – Atlanta down for 16+ hours (2016)

https://news.ycombinator.com/item?id=10998661 The Twelve Days of Crisis – A Retrospective on Linode’s Holiday DDoS Attacks (2016)

https://news.ycombinator.com/item?id=10845170 Security Notification and Linode Manager Password Reset (2016)

https://news.ycombinator.com/item?id=10806686 Linode is suffering on-going DDoS attacks (2016)

Edit: Guess someone linked this on the Linode staff channel :) Hi guys!

Around November in 2015 the IRC network I host was hacked due to a breach Linode had already been informed of (https://news.ycombinator.com/item?id=10845985) - I had a completely unique username, password, and I even had 2FA enabled. Linode support refused to work with me, advising me to "secure my 2fa device better next time". Longevity of a company like Linode clearly isn't indicative of good business practices, only that they are the cheapest option.

Why was this downvoted?

Probably because of https://news.ycombinator.com/item?id=14572970 ?

> "While you and the sources you link to are generally correct, you should probably disclose your relationship with Linode when you make these comments -- namely that you were involved with, and successfully prosecuted for, one of the more serious of the five."

The comment you linked is newer than the one you're responding to, probably not.

Why do you hate then so much?

They are just another hosting company, I'm sure your can find holes and dirt on all of them?

Why not attack an organisation that is "more evil" ?

First of all I need to clarify that I'd likely be making these posts even without my personal interactions with Linode, just as I'd advice against using SSL 2.0 or gasp ColdFusion if I saw someone using them.

I'm certainly not alone in recommending against Linode, any sane security person will share the sentiment.

>Why do you hate then so much?

I don't really "hate" Linode, but I certainly don't wish them luck.

Why?

They wasted a bunch of my time because some guy with a very thick Aussie accent prank called them and the police while introducing himself as me.

>Why not attack an organisation that is "more evil" ?

I can do both, although I'm hardly "attacking" Linode. I'm simply pointing out their very poor track record, which is an indisputable fact.

Why advice folks away from a hosting provider that covers up known breaches for months? https://news.ycombinator.com/item?id=10845985

Or one that tells their employees to lie about breaches? https://imgur.com/sJd56AT

Or one that refused for years to spend a couple of minutes thinking about security, until it started to actually hurt their bottom line? As jsmthrowaway points out, Linode was aware of serious security issues for years and did exactly nothing to protect their customers. https://news.ycombinator.com/item?id=14572970

If not for the info you provided I may have wasted my time with them.

Honestly, I was wondering if Linode staff or people on "their side" downvoted the post since it didn't seem downvote worthy. It's only fair that their track record follow them, especially their free press. It wasn't a rant or an accusation or anything personal. It was just a list of their past actions and what others had to say about it.

If you want trustworthy cloud hosting look at EC2 and GCE. Avoid digital ocean, they have a long history of account hijackings due to "social engineering" attacks.

Otherwise look at dedicated hosting, preferably colocation but just renting servers can be cheaper and isn't so bad. Encrypt your drives, either disable your IPMI thing completely or ensure that it's only accessible over a VPN by you only and not your host. OVH (and their other brands) might be a decent cheap choice for dedicated hosting that should be very competitive in Linodes price bracket.

Reply on news.ycombinator.com