Gandi has been my registrar for years -- they're solid, high-integrity folks. Hope they manage to resolve this without too much damage.
I've stayed away from them since then. Not a very impressive company, and I'm not too surprised they're failing to deal effectively with this DDoS.
If you choose to use a value added service like VPS, you should expect subpar experience. You can go to any cloud provider and find a service for which you're going to have a worse experience than you had with Gandi VPS.
Claiming not to do shady things with user data is the minimum I expect from a domain registrar. Fortunately, Gandi aren't unique in that respect.
Gandi came highly recommended to me, so I was quite disappointed by the reality.
They buy the domain themselves, and let you pay with Dogecoins -- possibly a good deal for the next Pirate Bay, but not what I would use for general domain registration. There is a good chance one day they will go down and take your (their!) domain with them.
From their website:
---
We're not actually a domain name registration service, we're a customer to these.
[...]
When you buy a domain in our system, we're actually purchasing it for ourselves. We will be the actual owners of the domain.
In my experience having to engage after a technical issue on their side, they were rude, argumentative, and totally unhelpful.
If you value your domains I would register them literally anywhere else.
According to other HN users, they do: https://news.ycombinator.com/item?id=22002534