Surely something like this: https://blog.linode.com/2016/01/05/security-notification-and... doesn't inspire confidence?

Sure, but who hasn't been hacked at some point in time? The @tptacek post has an air of suggesting Something Is Really Wrong, like "Linode is a front of the NSA" or something.

Would it be that much harder to say "Don't use Linode, they have a bad history security-wise and just got hacked again"?

@tptacek is some dude on Twitter that spends a lot more time thinking about his abs than I do. I'm @tqbf.

Linode has not only been hacked countless times. So many times in fact that it's hard to blame it on just incompetence, but on gross negligence on their part.

Then there's the whole lying to cover up hacks, not investigating clear compromises when reported by customers and generally just avoiding any kind of negative press at all costs.

I know for a fact ~7 providers around the same price range have had the exact same problems and were less honest about it. :p

Hell, I know some in 2016 that are plain text offenders still.

You get what you pay for, and unless you pay about double what Linode charges...you don't get much in the way of added security or protection.

You should name them.

Just so I understand: his claim, which doesn't constitute advice of any kind and doesn't ask for any action on the part of the reader, requires substantiation? But your claim, which does have a suggested course of action for the reader, does not require further elucidation?

I do know who you are and I do have respect for your contributions, but my friend, it's seems like you're flaunting a sense of superiority when you issue a drive-by decree. It's only made worse when you choose to take the time you could have spent helping the readers whose opinions you're hoping to sway, and piss it away with grammar/spelling corrections and sarcasm. We routinely call out people in other public forums who give blatant non-answers, don't we?

I thought your comment was helpful. Until you decided that only those who would take it on faith or on fallible googling would be worthy of your help.

>Just so I understand: his claim, which doesn't constitute advice of any kind and doesn't ask for any action on the part of the reader, requires substantiation? But your claim, which does have a suggested course of action for the reader, does not require further elucidation?

I'm not sure if tptacek implied the claim requires substantiation, but IMO naming and shaming is just the ethical thing to do when someone is covering up hacks.

Yes, but not if you found out such from confidential information you agreed to keep confidential.

But in all seriousness, I don't know a single provider that sells cheap VPSs [e.g. At Linode's price point] and actually has something resembling security.

You keep talking about how Linode is cheap, but when I look on their site their prices are absolutely insane. Am I missing something?

>Yes, but not if you found out such from confidential information you agreed to keep confidential.

Debatable.

> You keep talking about how Linode is cheap, but when I look on their site their prices are absolutely insane. Am I missing something?

Its roughly the same as DO, etc. Yes, its more expensive than buying a dedicated server.

I define anything cheaper than AWS/Google Cloud/Azure/etc. as "cheap". I am assuming you are using a reasonable level of bandwidth [e.g. 100GB+] when making such statements.

Really the only places you can find even cheaper VMs is sites like lowendtalk.com and you really don't want to go that cheap if you can avoid it.

> Debatable

Let me put it this way, "contractually obligated to".

Fair enough. Tptacek named. "Shaming" strongly implies stating the actual flaw.

FWIW, I am aware of the past issues Linode has had, and hope they do get their act together.

I think you can figure out why I can't pretty easily.

You could've googled "linode", but here you go:

https://news.ycombinator.com/item?id=10845278

Meh... nothing about that is in the first page of Google results when I google Linode. I wasn't aware of the older hack incidents, because we weren't Linode customers then and so there was no particular reason to pay attention to Linode news.

Anyway, if anyone is going to make a blanket statement like "Don't use X", there's no harm in providing at least a high level explanation of why you're saying that. One shouldn't assume other people keep up with the exact same news that they do.

Their wikipedia page, the 3rd google result for me, should provide enough info by itself.

I do agree that some level of explanation would definitely be useful, but this comes up so often that I really don't find it surprising that people are too lazy to explain such statements.

There are times I am comfortable talking publicly about things and contributing context or color commentary.

There are times I am comfortable broadcasting clear, direct advice that might hurt some entity's feelings.

There aren't many times when I am comfortable doing both at the same time.

So you're not comfortable saying:

> Linode has had enough security issues that I wouldn't trust them with my servers.

I am comfortable saying "Don't use Linode."