Taking Over DigitalOcean Domains via a Lax Domain Import System

Re:Taking Over DigitalOcean Domains via a Lax Domain Import ... by tombrossman on Friday August 26, 2016 @04:38AM (#12364990)

I have an account with DigitalOcean (and several competitors) and I'm not going anywhere or moving any sites around because of this. Sure, they could have handled things better and the security researcher could have too. I don't see any malice or incompetence here, nor do I see a reason to make the effort to switch to another provider.

Where are you going to run off to? How is their security better over there? How many hours of work does that involve?

[ Parent | on HN ]

Re:Taking Over DigitalOcean Domains via a Lax Domain Import ... by anilgulecha on Friday August 26, 2016 @06:21AM (#12365307)

Allowing adding a domain without verifying ownership, and banning someone who reported a security issue isn't incompetence?

I think you're looking more kindly on their security practices than most folks in the security world would.

[ Parent | on HN ]

Re:Taking Over DigitalOcean Domains via a Lax Domain Import ... by corobo on Friday August 26, 2016 @06:37AM (#12365342)

Banning someone who added 20k domains to their account. There's a difference between reporting a security issue and blatantly abusing their services.

[ Parent | on HN ]