| ▲ | Active incident at Dreamhost forcing password reset(dreamhoststatus.com) |
| 88 points by greenchair 9 hours ago | 22 comments |
| |
|
| ▲ | duskwuff 4 hours ago | parent | next [-] |
| Reading the tea leaves: given that the outage started with "connectivity issues affecting the File Manager", which was an install of Monsta FTP [1] - a commercial PHP application - I suspect the file manager got popped by one of the recently published PHP vulnerabilities, and users' FTP credentials may have been exfiltrated. [1]: https://www.monstaftp.com/ |
| |
| ▲ | traeregan 3 hours ago | parent | next [-] | | 20 year customer here. This morning I asked their support chatbot if this is related to the PHP vulnerabilities and it assured me that's not the case. I'm skeptical. These status updates from the PHP incident would also have us believe that they were never directly affected: https://www.dreamhoststatus.com/pages/incident/575f0f6068263... They're being awfully vague about this issue so far. 8 hours ago I submitted a ticket requesting more information and they've not responded yet. I guess that they're still in the thick of it. | | |
| ▲ | pixl97 2 hours ago | parent [-] | | Why would their support chatbot know? Having worked in support for years quite often higher layers of the company will give T1 support almost no information on what happened intentionally. That's pretty standard corporate CYA policy in litigious societies. | | |
| ▲ | traeregan an hour ago | parent [-] | | I didn't think that it would know but their support UX funnels you through it so that's where I started. I followed it up with a ticket. |
|
| |
| ▲ | MuffinFlavored 4 hours ago | parent | prev [-] | | hopefully their hashed/salted passwords, right? not plaintext? | | |
| ▲ | duskwuff 4 hours ago | parent [-] | | Internally, sure. But the application that was (probably) compromised was an FTP client, so it would have received the plain text of those passwords from users as they logged in. | | |
| ▲ | trollbridge 3 hours ago | parent [-] | | For those customers who are still logging in with FTP… As a precaution they reset everyone’s email passwords, presumably from an assumption people use the same ones for both. I’m surprise they still let people use FTP. | | |
| ▲ | jacquesm 2 hours ago | parent [-] | | I came across such a thing recently. The counterparty was a bank, and they point blank refused to update their processes so the people I talked to had no choice but to continue to use something they knew was hopelessly outdated. SFTP was released what, 3 decades ago or so? There is a good chance that whatever was on the other side of that upload was not capable of any kind of secure connection. |
|
|
|
|
|
| ▲ | paulbjensen 3 hours ago | parent | prev | next [-] |
| Dreamhost - gosh that brings back memories… |
|
| ▲ | hmokiguess an hour ago | parent | prev | next [-] |
| I migrated all my stuff from dreamhost about 5 years ago, got this email today and felt validated from having made that decision. |
|
| ▲ | whyage 5 hours ago | parent | prev | next [-] |
| What's going on with Dreamhost lately? Is it falling apart? |
| |
| ▲ | AznHisoka 4 hours ago | parent | next [-] | | I havent seen anyone talk about it for the last 10-15 yrs. I would have guessed it fell apart already | | |
| ▲ | PaulDavisThe1st 3 hours ago | parent [-] | | They abandoned all support for email lists a couple of months back. Will likely move after 20+ years on DH. | | |
| ▲ | trollbridge 3 hours ago | parent [-] | | Chat support works well. Email is nonexistent. | | |
| ▲ | PaulDavisThe1st 2 hours ago | parent [-] | | I don't mean "support for using mailing lists". I meant "they no longer provide the services (i.e. mailman) to run mailing lists" | | |
|
|
| |
| ▲ | trollbridge 3 hours ago | parent | prev | next [-] | | No, they’re still doing well. Support is primarily via chat these days. Pricing wise they don’t beat Herzner anymore but are somewhat competitive with Digital Ocean. I am gradually moving everyone to my own self hosting mostly for supportability reasons. We want to react in seconds, not hours, when a customer has an issue. | |
| ▲ | forgotmypw17 4 hours ago | parent | prev [-] | | Working pretty well for me. | | |
| ▲ | donohoe 3 hours ago | parent [-] | | Same. Into my second decade with them. Great value, no real complaints. |
|
|
|
| ▲ | forgotmypw17 4 hours ago | parent | prev | next [-] |
| Ah, I noticed this yesterday, figured it was just me. |
|
| ▲ | therein 4 hours ago | parent | prev [-] |
| Now that's a blast to the past. What's next, Rapidshare.de is having issues? |
| |
