Tell HN: Linode's Abuse form is absolute garbage | Hacker News Reader

Tell HN: Linode's Abuse form is absolute garbage

38 pointssschueller18 comments

We are getting a lot of abuse traffic from Linode lately and it is absolutely frustrating filling out their abuse form: https://www.linode.com/legal-abuse/

  - There is no option for DDOS.
  - If you make a mistake and need to click back all the filled out data is gone
  - You can only report 1 IP at a time
  - The confirmation mail is full of errors such as listing Name as "First Name" as in the field description and not what I entered.
  - The confirmation mail comes from "wordpress@linode.com"
  - No ability to attach for example a pcap file

Since I am also a Linode customer I have sent such abuses via ticket system as well but it takes over 24 hours for anyone to respond just to tell you to use the abuse form. Very frustrating and sad as I have been with them since almost the beginning.

View on HN

Linode is absolutely trash, followed closely by digitalocean - almost all of the abusive traffic I see originates from those two in particular (ovh et al have pretty much dropped off the radar, presumably due to price or reputation or similar).

At this point I just drop both at the edge as they generally refuse to deal with problems and especially in the case of "researchers" who don't identify themselves, protect them.

I've been using Linode as long as they existed. When they were small I would have been curious about the details of your experience, but they have grown and many of the original folks appear to be less engaged in the community so boiler plate automation does not surprise me. I would guess that if you spoke with them on the phone you may get better results, but I also suspect they would try to sell you a DDoS solution. It would be a very unfortunate coincidence if people started receiving attacks after a CDN/DDoS mitigation service acquired them. A similar pattern occurred when Neustar/UltraDNS started selling DDoS mitigating services.

Out of curiosity, what types of attacks are you receiving? e.g.

- packet rate / packets-per-second

    TIMEFORMAT=%R time tcpdump -i any -NNnnt -p -c1000 not port 22 >/dev/null

- average mss of the tcp syn packets / number of tcp syn's missing mss.

    tcpdump -p -i any -NNnnt -c500 proto 6 and 'tcp[13] == 2'

- average length of the udp packets

    iptraf-ng -z eth0 # or # tcpdump -p -i any -NNnnt -c500 proto 17

- NIC saturating volumetric attack?

    iftop -i eth0 -PNnBb -f 'not port 22'

- Number of AS numbers these are distributed across or is it literally just Linode AS?

Replace port 22 with whatever port you are running sshd on.

I ask because I have seen an uptick in incredibly odd port scans that seem to just repeat. They are harmless but make tcpdump really noisy. If you give me some general numbers on the above questions I might be able to suggest some generalized mitigations assuming the numbers are small enough. Most that I am seeing come from 103/8, some from a server reseller in the Netherlands and some come from Tor exit nodes suggesting to me someone is trying to break Tor. This is not specific to Linode, I am seeing this on 3 VPS providers. Maybe 2% of the source IP's I see are coming from Linode.

If most of what you are seeing are TCP packets missing mss, take a look at this thread [1]. If most of the packets are UDP, first look at the legit size of UDP packets of the applications on your server, then use the "length" iptables module to DROP anything that does not match your traffic pattern, ideally in the raw table to keep the odd bots off your nf_conntrack state table.

[1] - https://news.ycombinator.com/item?id=33129508

> [..] but I also suspect they would try to sell you a DDoS solution [..]

Linode has been pretty vocal that DDoS protection at their edge has been included, from before the Akamai acquisition.

Hold my beer, says DigitalOcean, who are far ahead of Linode, and even other classically laissez-faire providers like Hetzner and OVH for originating scans and abusive traffic.

Second only to China’s major networks is quite an achievement!

https://viz.greynoise.io/query/?gnql=last_seen%3A1d

Linode?

That's nothing compared to Cloudflare.

Try to make 500+ with Cloudflare and tell me your thoughts on it. They are legit protecting piracy and turning a profit from it.

Do you mean Cloudflare is sitting in front of torrent trackers, or something else?

In front of torrent trackers and protecting sites with 100% copyrighted content.

I've sent them +500 copyright claims over the years. It's really complicated, slow and they never take any action against these sites even after 10+ valid claims.

There's no way to follow tickets. The process requires an online form to be filled then follow-ups are by email (with no way to see the status of tickets). Tracking these claims one-by-one is the hardest I've ever seen because you don't get a ticket number after you fill the online form or get an email right away. You have to manually follow them up.

The process has never been updated to be easier for the end-user in 8+ years (since my first DMCA abuse report).

Piracy is the smallest problem of Cloudflare. I run multiple honeypots and trash mail addresses for collecting spam and phishing mails and there is a huge number of phishing and scam websites which are protected by CloudFlare.. but that's only a small part: I did some research and found many ponzi-shemes, markets for stolen CreditCards and general crime forums which are all protected by CloudFlare for months or even years.

CloudFlare is pretty much the worst company I can think of. Blocking harmless Tor and VPN users through unsolvable captchas on every website they "protect", while talking about an open Internet and freedom of speech. These hypocrites only block websites if they get some cheap PR, in reality they give a shit offering their services to criminals.

Isn't Linode known for its low prices? If so, this may be a case of you get what you pay for.

I have some dirt-cheap $5 VMs that I use for banging around, but for anything important I pay extra for machines that are backed by actual support. You hope that you never need it, but when you need it, you really need it.

This isn't about the quality of Linode's product.

Linode's tech support is world-class. At least, used to be for the last decade, no idea how it is now.

Counterpoint: I stopped using Linode after nearly a decade because their support is so absolutely garbage. We were paying ~$5k a month and couldn’t get anything but absolutely dog shit canned responses. It was a few years ago but I’m still upset by it. Truly awful support.

Where did you move to if I may ask?

AWS. It did not save money, nor provide better support, but there's much more tooling and generally it's easier to hire folks who have used it extensively. I don't care for AWS much either, but at least it's issues are, at this point, relatively well-known. And there's the added bonus that if AWS goes down, everything is likely acting weird... customers blame "the internet." Where as when Linode goes down, you're likely to be the only site/app behaving strangely, and they blame you.

I'm paying $10/month and I got a helpful human on the phone at 11pm central time.

I moved my business over from EC2 earlier this year. So far the support from Linode has been stellar.

When ran into an early issue during our first few days and the support technician assigned to the ticket solved the problem. Then write back a few hours later with a change that he attributed to a colleague with whom he was chatting about it.

We haven’t had to call for support yet, but the number is in my contacts for when that day might come. We’ve been much happier than on EC2. We are spending about the same per month with much more to show for it in terms of our user-facing results.

This is about getting abused/DDOS by someone on linode. They are not customers of linode themselves.

The report feature is supposed to be for non-linode customers getting hammered with abuse traffic originating from Linode.

Reply on news.ycombinator.com