Hacker News

Active incident at Dreamhost forcing password reset

53 points by greenchair 6 hours ago | 19 comments

duskwuff 47 minutes ago

Reading the tea leaves: given that the outage started with "connectivity issues affecting the File Manager", which was an install of Monsta FTP [1] - a commercial PHP application - I suspect the file manager got popped by one of the recently published PHP vulnerabilities, and users' FTP credentials may have been exfiltrated.

[1]: https://www.monstaftp.com/

MuffinFlavored 41 minutes ago

hopefully their hashed/salted passwords, right? not plaintext?

duskwuff 30 minutes ago

Internally, sure. But the application that was (probably) compromised was an FTP client, so it would have received the plain text of those passwords from users as they logged in.

forgotmypw17 33 minutes ago

Ah, I noticed this yesterday, figured it was just me.

whyage 2 hours ago

What's going on with Dreamhost lately? Is it falling apart?

AznHisoka 34 minutes ago

I havent seen anyone talk about it for the last 10-15 yrs. I would have guessed it fell apart already

PaulDavisThe1st 15 minutes ago

They abandoned all support for email lists a couple of months back. Will likely move after 20+ years on DH.

forgotmypw17 33 minutes ago

Working pretty well for me.

therein 60 minutes ago

Now that's a blast to the past. What's next, Rapidshare.de is having issues?

tuwtuwtuwtuw 5 minutes ago

Angelfire shut down this year so not them at least.

hvalero2001 15 minutes ago

[flagged]

sunjester 2 hours ago

[flagged]

jawns 53 minutes ago

I've been a user for more than 20 years. With their shared hosting plan, which was about $5/mo. when I joined and is now $13/mo, I've been able to host my personal blog and professional site, as well as probably 3 dozen other sites over the years, including several that have hit the HN front page and never got hugged by the squeeze of death.

Honestly, compared to some of the professional environments I've worked in, it's a joy to have an idea, create a few PHP files, and in a matter of seconds have that idea live.

pockybum522 43 minutes ago

Me, for all the reasons listed so far in comments

rpdillon 2 hours ago

Been a customer for decades, love them.

0898 2 hours ago

Do you remember the cool newsletters they used to do?

ceejayoz 2 hours ago

A shitload of small business sites that were built years ago and haven't been touched since.

SoftTalker 2 hours ago

If they are static sites that shouldn't be a problem. Many are probably not though.

ceejayoz 2 hours ago

My suspicion is at least half are unpatched WordPress installs.

Jgrubb 2 hours ago

My suspicion is closer to 95%

Arainach 2 hours ago

It's cheap and reliable with predictable costs. It hasn't caused me any problems in a decade. Most of the websites I want to host don't need cloud anything, they're statically generated.