Linode Blog

(Tory from the Linode team here) We made some improvements to our disclosure / Bug Bounty program last year and launched this on HackerOne. The community and quality of submissions has been great. More information: https://blog.linode.com/2018/05/16/linodes-new-bug-bounty-program-now-… We've also been making ongoing improvements to our application security and security infrastructure through the implementation of a DevSecOps culture. This is something we take very seriously.

I'm a long-time Linode customer as well, and over the years I've been scaling my services up but the pricing model is quite restrictive! I also need more disk space, but not necessarily RAM and CPU... For what it's worth Linode has said (in Feb, 2017) that they will be announcing block storage in the coming months. https://blog.linode.com/2017/02/14/high-memory-instances-and-5-linodes…

In Linodes case it's not about "a hack" it's about at least 4 hacks within the past 5 years. http://arstechnica.com/business/2012/03/bitcoins-worth-228000-stolen-f… https://blog.linode.com/2013/04/16/security-incident-update/ https://blog.linode.com/2014/01/19/an-old-system-and-a-swat-team/ https://blog.linode.com/2016/01/05/security-notification-and-linode-ma… I'm not even sure if they ever figured out the last one. So yeah, hopefully ryebit was just kidding.

This seems pretty fantastic, I am excited to upgrade and think the SSD storage is going to be really helpful for improving the performance of my applications hosted there. That said, I am not an expert on CPU virtualization but I did notice that the new plans are differently phrased than the old ones here. The old plans all talked about 8 CPU cores with various 1x, 2x priority levels (https://blog.linode.com/2013/04/09/linode-nextgen-ram-upgrade/ for examples), while the new plans all talk about 1, 2, etc. core counts. Could anyone with more expertise here tell me whether this is a sneaky reduction in CPU power for the lower tiered plans, or just a simpler way of saying the same thing as the old plans?

+1 here for Rackspace mostly due to their excellent support. They seem to have a dedicated WP offering[0]. Have also heard mostly good things about Linode (exception[1]), but don't have personal experience with them. [0]http://www.rackspace.com/cloud/sites/web-hosting/wordpress/ [1]https://blog.linode.com/2013/04/16/security-incident-update/

[1] - https://blog.linode.com/2013/04/16/security-incident-update/ [2] - http://arstechnica.com/business/2012/03/bitcoins-worth-228000-stolen-f… I believe there may have been other incidents. That said, I still have a number of services running happily on Linode. :)

It was back in April, in association with an attack on Linode [1]. See this HN comment by RoboTeddy from yesterday for a great summary of the group's story about these attacks [2]. However, Name.com has not disclosed much information. I don't know if they were aware of the attack until the group released their story yesterday. The systems could have still been compromised. [1] https://blog.linode.com/2013/04/16/security-incident-update/ [2] https://news.ycombinator.com/item?id=5667391

If you're wondering, I stumbled upon that text file while reading the official company response to the recent hack here: http://blog.linode.com/2013/04/16/security-incident-update/ I was interested in setting up a Linode account but I think it's best to wait for some more information at this point. Thoughts?

I was hoping http://blog.linode.com/ would mention risk assessment/strategy on Newark center. This is a good summary of data centers at risk: http://readwrite.com/2012/10/29/hurricane-sandy-vs-the-internet-in-the…

If you find yourself impacted by these changes in your home lab (and chances are you will; taking ballooning out of Free is nothing but petty), keep in mind that you can follow the lead of the major hosting companies and jump ship to KVM via oVirt or some homebrew. KVM is better in a number of ways anyway, one of them being a lack of control by Citrix, not to mention when Linode switched they got ~30% more perf out of Linodes. Xen has been dying for a while. EC2 is heading off it, and they've held out the longest. This change is evidence that Citrix would like to accelerate that trend by killing off the home lab users that stuck it out (read: me). Looks like I have a new Christmas project. https://cloudplatform.googleblog.com/2017/01/7-ways-we-harden-our-KVM-… https://www.theregister.co.uk/2017/11/07/aws_writes_new_kvm_based_hype… https://blog.linode.com/2015/06/16/linode-turns-12-heres-some-kvm/ https://www.digitalocean.com/help/technical/general/ (Cmd+F KVM)

Great start to a comparison review. I've used all the service providers available and these opinions include my historical experience with them (I've used all providers for many years, my account with DO is since 2013). Most of my service uses were focused in those service provider's North America locations, Asia locations, and Oceania locations. Note I did do a short comparison between DigitalOcean and Vultr back in 2014 here: https://vpsboard.com/threads/digitalocean-vs-vultr-the-asian-face-off.… Most service providers here are fairly decent. From my experience, OVH's KVM VPSes weren't worth the time, but their VMWare VMs were absolutely top notch. Linode has had two major security events over the last few years, one of which was in early 2016 which included release of credit card information. However, they also offer paypal payments now and are fairly top notch in terms of performance. (They've taken approaches to fix their problems from 2016 with this blog post here: https://blog.linode.com/2016/02/19/security-investigation-retrospectiv… ). DigitalOcean is fairly reliable. Their Singapore location early on had regular packet loss events, but they've been shaping up pretty nicely over time. Vultr has been a major problem for me. Vultr for a while (on their storage instances in Japan) had terrible I/O which took a solid two hours just to install Ubuntu 14.04. When contacted support, they stated they "stopped a noisy neighbor and to retry" but no real…

"With the way that Linode recently handled the hack which exposed customer CC's and data[1], I would find it hard to have any peace of mind with them." I hear this repeated over and over but did you just read the headline and draw your own conclusion? From all the articles I read, the hacker maybe got some worthless encrypted cc data. I don't think anyone lost sleep over this and kudos to Linode for encrypting user data. Also the breach had nothing to do with the individual VPS accounts. Around that same time Amazon had the most epic multi-day outage in history and their storage servers were leaking user data. By comparison, the Linode hack wasn't a big deal, IMO. PS: As far as Linode holding back information, were you a Linode cusotomer last year or are you just repeating rumors? Your Slashdot article was posted April 15th. Linode announced the "security incident" on the 12th https://blog.linode.com/2013/04/12/security-notice-linode-manager-pass… also https://blog.linode.com/2013/04/16/security-incident-update/ I did not get the impression they were holding back information.

Here's an attempt at an explanation/translation: HTP ("Hack The Planet") is a group that likes to break into things. Another (unnamed) group of people impersonated a third group of people ("ac1db1tch3z") and tried to cause trouble for HTP. The impersonators located HTP by examining one of HTP's botnets (a collection of compromised computers that are used to launch things like denial of service attacks). Botnets have to receive instructions (e.g., targets to attack) from somewhere, so it's likely that the impersonators followed the path taken by commands to the botnet, and found the network(s) that HTP uses to organize themselves. HTP realized this, and wanted to get back at the impersonators. They found out that the impersonators used an IRC channel (chat room) hosted on a network called SwiftIRC. If HTP could break into SwiftIRC (which is hosted on Linode), they could cause all sorts of trouble for the impersonators. So HTP decided to break into Linode, so they could break into SwiftIRC, so they could break into the group of impersonators. To break into Linode, HTP broke into their domain name registar (name.com). They planned to secretly take control of linode.com, and replace it with a version of linode.com would look and feel and work correctly, but had one additional feature -- it would collect the login information that people typed in. HTP probably hoped to gain the login for SwiftIRC directly, or collect the logins for Linode admins and obtain SwiftIRC's login…

Right now, we've seen pretty constant pricing from "cloud" providers like Amazon and Slicehost. While they probably had razor thin margins a few years ago, they're probably decent now. As technology improves, they'll probably have to reduce pricing to remain competitive. In fact, Linode (who has been around for 5 years, considerably longer than Slicehost) has seen constant upgrades. Linode has gone from, on their base plan: 64MB 2003 80MB 2005 100MB 2006 128MB Jan 2007 256MB Mar 2007 300MB Sep 2007 360MB Dec 2007 Similar increases in transfer and disk space have been seen over this time period (http://blog.linode.com/category/upgrades/). I expect that Amazon and Slicehost will start offering more as pricing comes down. With virtualization being offered by more and more firms, they'll have to follow market pricing and as disks and RAM get cheaper and cheaper, what is offered will go up. Margins are probably decent now as he notes in his posts. As such, anytime storage or RAM falls by half, we should see a discount in the cost to us.

Linode, who didn't fair all that well in this test (though was the cheapest) actually does offer a dedicated CPU option as of recently: https://blog.linode.com/2019/02/05/introducing-linode-dedicated-cpu-in… Curious how much of a difference it would make.

Just for a reference: https://blog.linode.com/2003/11/04/new-linode-96-plan/ 96M RAM 3GB Disk Space 38GB xfer $29.95

Their blog post mentioned block storage beta is coming at the bottom of the post. https://blog.linode.com/2017/02/14/high-memory-instances-and-5-linodes…

From Soh (Linode) in the comments [0]: "We’ve deliberated and brought the floor for all plans to have 1000Mbps. Thanks for your feedback!" So it appears that 75Mbps was the initial speed but after some internal deliberation (possibly influenced by feedback), they raised it to 1000Mbps. [0] https://blog.linode.com/2017/02/14/high-memory-instances-and-5-linodes…

We did an on-the-spot upgrade to that speed, the new floor for all plans will be 1000Mbps. The blog should be updated now, might need a refresh to see: https://blog.linode.com/2017/02/14/high-memory-instances-and-5-linodes…

wow... 8 months? Not being able to get in to your servers for days at a time is not "a little exaggerated". It was less than a year ago - 11 months. December in to January, Linode data centers, but especially Atlanta, were heavily attacked. https://blog.linode.com/2016/01/29/christmas-ddos-retrospective/ There was another moderate attack a few months ago. Caused no end of headache for some clients of mine. I like Linode, and have used them for some projects in the past, but there are more options now.

> per-customer VLANs I am looking forward to that! Linode is my go-to hosting service, but it's a little troubling that anyone in the datacenter can hit your private IPs [1]. On the other hand, maybe it shouldn't matter, and you should always act like the network is compromised. Isn't trusting their private network how Google leaked traffic to the NSA? Still, it seems like a nice improvement that would make compromises less likely. [1] https://blog.linode.com/2008/03/14/private-back-end-network-support/

Play by Play of Linodes 'twelve day attack' over Christmas and New Year 2015 https://blog.linode.com/2016/01/29/christmas-ddos-retrospective/

They weren't down for the entire two weeks, but various datacenters went up and down for hours, then quieted down for a few days, then was back again, then another hit; stretching across two weeks. One thing that took them so long was that their upstream ISPs at some of the datacenters were themselves unable to handle the DDOS, so they had to switch ISPs, which took a while. I don't see Google/AWS as easy to attack; but I'm not sure why similar tier players like DigitalOcean aren't being hit -- or maybe they're just less transparent about things, or are actually a smaller target (didn't think they were?). edit: here's a postmortem from linode of the christmas attack - https://blog.linode.com/2016/01/29/christmas-ddos-retrospective/

You're right, and the downtime was inexcusable. We've learned from what happened and are continuously working to upgrade and better protect our network, and periodically report on our progress on our blog: https://blog.linode.com/2016/05/02/network-status-updates-april-2016/

https://blog.linode.com/2016/01/05/security-notification-and-linode-ma… Among others, OP (likely) isn't referring to your own box specific security.

Surely something like this: https://blog.linode.com/2016/01/05/security-notification-and-linode-ma… doesn't inspire confidence?

Not the first time they poorly handled a security issue: https://blog.linode.com/2014/01/19/an-old-system-and-a-swat-team/

For those not keeping track, that's the third major breach I've heard of where user data was exposed. Previous Incidents: April, 2013: https://blog.linode.com/2013/04/16/security-incident-update/ January 2014: https://blog.linode.com/2014/01/19/an-old-system-and-a-swat-team/ (they mention the breach almost in passing...the swatting is unrelated) I really want Linode to do well, but this may be it for me.

> I'm not in the industry (I'm in higher education), but this is news to me. They were hacked, badly, and tried pretty hard to pass it off as "no big deal" for a while. https://news.ycombinator.com/item?id=5552756 https://blog.linode.com/2013/04/16/security-incident-update/