60 pointsby greenchair6 hours ago8 comments
  • duskwuffan hour ago
    Reading the tea leaves: given that the outage started with "connectivity issues affecting the File Manager", which was an install of Monsta FTP [1] - a commercial PHP application - I suspect the file manager got popped by one of the recently published PHP vulnerabilities, and users' FTP credentials may have been exfiltrated.

    [1]: https://www.monstaftp.com/

    • traeregan15 minutes ago
      20 year customer here. This morning I asked their support chatbot if this is related to the PHP vulnerabilities and it assured me that's not the case. I'm skeptical.

      These status updates from the PHP incident would also have us believe that they were never directly affected: https://www.dreamhoststatus.com/pages/incident/575f0f6068263...

      They're being awfully vague about this issue so far. 8 hours ago I submitted a ticket requesting more information and they've not responded yet. I guess that they're still in the thick of it.

    • MuffinFlavoredan hour ago
      hopefully their hashed/salted passwords, right? not plaintext?
      • duskwuffan hour ago
        Internally, sure. But the application that was (probably) compromised was an FTP client, so it would have received the plain text of those passwords from users as they logged in.
        • trollbridge5 minutes ago
          For those customers who are still logging in with FTP…

          As a precaution they reset everyone’s email passwords, presumably from an assumption people use the same ones for both.

          I’m surprise they still let people use FTP.

    • an hour ago
      undefined
  • paulbjensen16 minutes ago
    Dreamhost - gosh that brings back memories…
  • forgotmypw17an hour ago
    Ah, I noticed this yesterday, figured it was just me.
  • whyage2 hours ago
    What's going on with Dreamhost lately? Is it falling apart?
    • trollbridge6 minutes ago
      No, they’re still doing well.

      Support is primarily via chat these days.

      Pricing wise they don’t beat Herzner anymore but are somewhat competitive with Digital Ocean.

      I am gradually moving everyone to my own self hosting mostly for supportability reasons. We want to react in seconds, not hours, when a customer has an issue.

    • AznHisokaan hour ago
      I havent seen anyone talk about it for the last 10-15 yrs. I would have guessed it fell apart already
      • PaulDavisThe1st41 minutes ago
        They abandoned all support for email lists a couple of months back. Will likely move after 20+ years on DH.
        • trollbridge6 minutes ago
          Chat support works well. Email is nonexistent.
    • forgotmypw17an hour ago
      Working pretty well for me.
      • donohoe20 minutes ago
        Same. Into my second decade with them. Great value, no real complaints.
  • thereinan hour ago
    Now that's a blast to the past. What's next, Rapidshare.de is having issues?
    • tuwtuwtuwtuw31 minutes ago
      Angelfire shut down this year so not them at least.
  • hvalero200141 minutes ago
    [flagged]
  • bone_42120 minutes ago
    [flagged]
  • sunjester2 hours ago
    [flagged]
    • jawnsan hour ago
      I've been a user for more than 20 years. With their shared hosting plan, which was about $5/mo. when I joined and is now $13/mo, I've been able to host my personal blog and professional site, as well as probably 3 dozen other sites over the years, including several that have hit the HN front page and never got hugged by the squeeze of death.

      Honestly, compared to some of the professional environments I've worked in, it's a joy to have an idea, create a few PHP files, and in a matter of seconds have that idea live.

    • pockybum522an hour ago
      Me, for all the reasons listed so far in comments
    • rpdillon2 hours ago
      Been a customer for decades, love them.
      • 08982 hours ago
        Do you remember the cool newsletters they used to do?
    • ceejayoz2 hours ago
      A shitload of small business sites that were built years ago and haven't been touched since.
      • SoftTalker2 hours ago
        If they are static sites that shouldn't be a problem. Many are probably not though.
        • ceejayoz2 hours ago
          My suspicion is at least half are unpatched WordPress installs.
          • Jgrubb2 hours ago
            My suspicion is closer to 95%
    • Arainachan hour ago
      It's cheap and reliable with predictable costs. It hasn't caused me any problems in a decade. Most of the websites I want to host don't need cloud anything, they're statically generated.