Security Flaw Hits VAserv; Head of LxLabs Found Hanged

Keldrin_1 writes "The discovery of 24 security vulnerabilities may have contributed to the death of the chief of LxLabs. A flaw in the company's HyperVM software allowed data on 100,000 sites, all hosted by VAserv, to be destroyed. The HyperVM solution is popular with cheap web hosting services and the attacks are easy to reproduce, which could lead to further incidents."

Comments

Well

[courteaudotbiz]

I guess there's not much to say...

Re:Well

[ckthorp]

Yah, but once you're in the ground, how do you dodge the bugs then?

Re:Well

[tattood]

TFA: "Ligesh [from LxLabs] was also still coming to terms with the suicides by hanging of his sister and mother five years ago."

I suspect that this was the result of a lot of bad things going on in his life, and not just because of the software issues.

Re:Well

[SatanicPuppy]

Yea, Jesus. Someone take their job a little too seriously?

If you ever seriously think of killing yourself over your job, it's time to get a new job.

Re:Well

[siloko]

A lot of stuff was going on in this guys life which suggests his demise wasn't simply down to exploits found in his software - from the article it appears that both his mother and sister committed suicide a few months ago, he also recently lost a large contract. That being said I can't imagine the news of VAserv (which relied on Ligesh's HyperVM, the exploited software) losing data on upto 10,000 virtual servers helping much.

Re:Well

[courteaudotbiz]

You know, I was just trying to show some compassion. I find it sad that someone could be that much desperate. I personnaly found my brother hung in his bedroom 10 years ago, so

I guess there's not much to say...

takes a very different meaning to me than the moderators or you could have seen in this comment.

Re:Well

[Anonymous Coward]

waka waka waka

Re:Well

[value_added]

If you ever seriously think of killing yourself over your job, it's time to get a new job.

Probably good advice generally, but I wonder how many of those defaulting on their mortgages due to a layoff will react positively to hearing it.

Sometimes that shitty job is all you've got.

Re:Well

[weirdcrashingnoises]

Killing myself is my job, you insensitive clod!

(I work at a cult and I'm the virgin sacrifice on Thursdays [cause no one on /. would believe me if I said I was not a virgin])

Re:Well

[JustOK]

not much to say, but perhaps to think.

Re:Well

[Darkness404]

Sure but there *are* other jobs, sure, it might mean taking a job in something that isn't your specialty, taking a job thats "lower than you", etc. But if you really are /that/ stressed about your job, even a job at McDonalds might be better even if that means you can't afford that 50 inch plasma.

Re:Well

[Anonymous Coward]

"Killing myself is my job, you insensitive clod!"

Obviously, you're not very good at it. Time to find a new job.

Re:Well

[CarpetShark]

If you ever seriously think of killing yourself over your job, it's time to get a new job.

Probably good advice generally, but I wonder how many of those defaulting on their mortgages due to a layoff will react positively to hearing it.

The same rule can be applied to mortgages, and, really, any material possession or circumstance. If it can be destroyed, you should be prepared to live without it. In fact, you should enjoy it all the more while you have it: "It's the transience of life which lends it such poignancy", as someone once said.

Re:Well

[Anonymous Coward]

It's not just a matter of getting another job. Sometimes it's a matter of realizing that your job....ANY job....does not define you. As soon as your job becomes the centerpiece of your life, you're setting yourself up for stress.

It took me years to realize that as long as I have a roof over my head (any roof...not the McMansion that makes you feel better about your life than the poor saps you went to school with....even an apartment is better than a park bench), and my wife and kids have food, I have everything that I need. If a lower paying, less stress job helps me maintain that, then that's what I'll do. The job is simply not important.

I really feel for this guy. I hope he didn't burden a family with this.

Re:Well

[SatanicPuppy]

Normally I hate fuzzy continental philosophy, but this is the time to trot out the existentialism.

All that shit is meaningless. House, car, job, social standing, everything. Your family matters, your life matters. You get too hung up on that material bullshit, to the point where you take your own life rather than alter your social circumstances? That's pathetic.

Yea, its a step. A huge change. But there could be anything on the other side of that door, things you never even knew you wanted because you were so blinded by what you had and what you thought you had to have.

Don't get blinded by the habits of your life to the point where you think your job and the lifestyle it supports is worth more than your life. The only thing constraining your choices is you, and the fear of unknown consequences.

Re:Well

[Anonymous Coward]

In retrospect, he has become an hero and should be considered among the many brave an heroes.

Also, anyone know what he dropped?

Re:Well

[Anonymous Coward]

If I had to find a new job right now, I would just kill myself!!

oh wait...

Re:Well

[Comatose51]

Agreed but I think that kind of situation or attitude is more prevalent than we think. People build their lives around different things. Their "work" (as in the product of their effort, not as in what they do from 9 to 5) becomes their lives. This is especially true of the creative types such as artists and writers but also software engineers. In many ways, software engineering or engineering in general is a hybrid between the arts and the sciences with room for creativity and personal touches. I work with a good group of engineers who are very passionate about their work, much more so than our paychecks can account for. I've seen the same passion turn into despair in bad times as well. Engineers also compound this problem by not being the most social people in the world. Having a network of people to connect to can really soften the pain when things don't go well. Most engineers don't commit suicide but the rate of burning out is rather high.

Re:Well

[espamo]

TFA: "Ligesh [from LxLabs] was also still coming to terms with the suicides by hanging of his sister and mother five years ago."

I suspect that this was the result of a lot of bad things going on in his life, and not just because of the software issues.

And very likely a genetic predisposition to suicide as well.

Re:Well

[johnsonav]

But if you really are /that/ stressed about your job [...]

It might not have anything to do with on-the-job stress. It seems that there were some other things going on in his life at the time. Lots of people, when their personal lives go to shit, begin to define themselves, more and more, by their jobs. When the rest of their life sucks, their job is where they are valuable, potent, skilled, respected, and needed.

If you lose that, and you begin to think that your job performance is just as terrible as your performance in the rest of your life, That's when you find people at risk for suicide; they've just had their last leg kicked out from underneath them.

For some people, a job is the only good thing in their life. Failing at that, as they perceive they've failed at every other aspect of life, is sometimes enough to drive someone over the edge. And no, a job at McDonald's won't mitigate that feeling.

Re:Well

[Anonymous Coward]

Suicide is a permanent solution to a temporary problem.

Re:Well

[Thaelon]

The job wasn't the only thing. From TFA:

Ligesh was also still coming to terms with the suicides by hanging of his sister and mother five years ago.

I'm sure that had a significant impact as well. The security flaw fiasco may have been just the final straw.

Re:Well

[TheRealMindChild]

Typical. You do know that most places, you'd be lucky that a full time, minimum wage, McDonalds job will pay for a one bedroom apartment and food for yourself per month. That doesn't include utilities, transportation, clothing, etc.

Now imagine the single mom with two children. Imagine the 68 year old woman who takes care of her husband who had a stroke.

It isn't as cut and dry as "Stop being gluttonous"

Re:Well

[Deanalator]

It's a bit different when you are the founder of the company, and you see your life's work get destroyed overnight. Piled on that, I understand that he just lost out on some massive contract, and has been dealing with personal issues since him mother recently killed herself. This is definitely not a case of someone simply drinking a bit too much of the company cool-aid.

Re:Well

[Anonymous Coward]

If only *more* programmers that wrote shitty code would follow in these footsteps. Thin the herd!

Re:Well

[dagnabit]

How does a genetic predisposition for suicide propagate...?

Re:Well

[Anonymous Coward]

Please. This guy obviously does not speak English as his first language... probably French. When you speak his language as well as he speaks yours, go ahead and be a grammar Nazi.

Until then, stfu.

Re:Well

[Atryn]

If you ever seriously think of killing yourself over your job, it's time to get a new job.

Perhaps he felt responsible and not just depressed? I agree with your sentiment, but I also acknowledge that not all cultures do. We still today hear stories out of Asia of people taking their own lives after failing in their job. In this case there were many other factors as well, but suicide isn't always about depression.

Heck, IIRC plenty of people were recently calling for Wall Street Execs and Bankers to consider the option.

Re:Well

[Abreu]

But if you really are /that/ stressed about your job, even a job at McDonalds might be better even if that means you can't afford that 50 inch plasma.

I would be glad to take a job at McDonalds or Starbucks if it only meant that I would not be able to afford a flat-screen TV... I'd be like Kevin Spacey in American Beauty... hanging out with the kids all day, flipping burgers or making frappuchinos in a no-pressure job.

However, I choose put up with my current job because I have a wife and two kids that deserve more from me.

Re:Well

[bonch]

A man or woman has kids before they kill themselves. Any other questions, smartass?

Re:Well

[Sun.Jedi]

^^ Mod up.

Re:Well

[story645]

People kill themselves after they reproduce. Not very difficult.

Re:Well

[Anonymous Coward]

People kill themselves after they reproduce. Not very difficult.

Well shit, what good is that? That's not going to get these headlines off my Slashdot index page!

Re:Well

[Ephemeriis]

Sure but there *are* other jobs, sure, it might mean taking a job in something that isn't your specialty, taking a job thats "lower than you", etc. But if you really are /that/ stressed about your job, even a job at McDonalds might be better even if that means you can't afford that 50 inch plasma.

Spoken like someone who hasn't had to deal with the job market in quite some time.

The economy right now is in rough shape. My son has been looking for a job for six months now with no luck. He isn't looking for anything amazing - just retail, labor, or food service, or something basic like that. Folks aren't hiring.

And your typical McDonalds job isn't going to cut it these days. Most food service/retail positions will be minimum wage, which doesn't go very far. They'll also be hourly, not salaried, so you're screwed if you get injured or sick. They'll also be part-time - your schedule will change from one week to the next so you'll not have reliable income, and there'll be absolutely no benefits.

We're not talking about whether or not you can afford a 50" plasma. We're talking about whether or not you can keep your house and/or car. Whether you'll be able to afford to feed your family. Whether you'll be able to pay the assorted bills.

We try very hard to live well within our means. We've got a very affordable mortgage on our house. We bought a used car a few years back and paid for it in full, with cash. We don't have a lot of expensive hobbies. We don't have a pile of debt. But if I lost my job we'd be pretty much screwed.

The odds of me being able to find reliable employment before our savings ran out aren't good. Like I said, folks around here aren't hiring. We could sell the house, if necessary, but I don't know that anyone would buy it. There are plenty of "for sale" signs around town and I don't see them disappearing very quickly. There aren't a whole lot of luxuries we could cut back.

It's a very scary situation to be in, and we aren't even under a pile of debt. I can't imagine what it's like for some of the folks out there.

Re:Well

[harryandthehenderson]

But if you really are /that/ stressed about your job, even a job at McDonalds might be better even if that means you can't afford that 50 inch plasma.

And how is that job from McDonalds going to provide even the most basic of needs for a person and their family? This goes beyond not being able to afford a 50 inch plasma, it would be more like you won't be able to afford to house your family on that salary.

Re:Well

[johnsonav]

You get too hung up on that material bullshit, to the point where you take your own life rather than alter your social circumstances? That's pathetic.

If you think that most job-related suicides have anything to do with material possessions, you're mistaken. Often, a person's job is the only thing in his life that is working at all. For most people, a job is more than a simple paycheck, it's a source of self-esteem, and feelings of potency, competence, and respect.

If every facet of your personal life takes a huge dump on you, you might start feeling powerless. But, if you have a job where you can feel powerful and in control, it's easy to recognize that those feelings of powerlessness are a result of those circumstances, that you are not intrinsically powerless.

But, take away that job, and the emotional support it brings, and you may just have removed the last thing standing between healthily handling life's disappointments, and believing that you are fundamentally powerless to affect change for the better, in your life.

It's very easy, at that point, to stop seeing yourself as a resilient victim of circumstance, and begin to recognize that perhaps the only common thread in all your life's problems is you. For some people, that's when the line is crossed, and suicide is contemplated. It has nothing to do with material possessions, just feelings of guilt and powerlessness.

Re:Well

[Anonymous Coward]

This is exactly how I would have responded. Defaulting on the mortgage means either short selling or foreclosure... items that go away in time. The only constant thing in all of our lives is our life itself. Adapt to the situation, and continue on. We've all been heaped on, in one way or another, by depressing things. None of that is worth taking one's own life over.

Re:Well

[OrangeTide]

It's obvious you have not tried to get a minimum wage job when your job experience qualifies you for something vastly different. Many places are hesitant to hire PhDs to wash dishes.

Also most people can't pay their mortgage with a job at McD, so there is essentially no point. Their only chance is to hope they have enough money set aside to move out before the money runs out. But most parents resist the idea of pulling their kid out of school just because they can't find work to support living in their current location.

Re:Well

[Anonymous Coward]

Maybe in some sections of the country, people have to downsize from a Rolls to a Lincoln or go from their Lear Jet to chartering a plane and are hating life, but in most of America, a job loss means loss of a house, loss of basic transportation, and loss of the ability to feed one's family.

People can't just downsize and work at McDonald's. It's not about the 50 inch plasma either. It's getting the kids clothing and school supplies, keeping a homestead, and keeping basic transportation running.

The US isn't like Europe. In the majority of the nation, there just plain no other transportation other than by car. No, bikes don't work either, unless you like being buzzed by semis while trying to pedal into town on the frontage road of an interstate with no shoulder, not to mention being prey for any gangbangers. Yes, you have the BART and NYC's subway system, but for most of America, finding a bus route is a major achievement, and finding a bus route that can get someone to work on time is almost astounding. Of course, someone will chime in that people moved to the suburbs so they suffer what they may. However, most US cities, someone not extremely rich has a pretty bad choice: Raise a family up in the inner city with gunshots ringing out nightly, or buy a house in the suburbs with a reasonably safe chance to raise kids and commute to work.

So the adage that most Americans are just whining that they can only buy a smaller TV or go with a smaller SUV for their 500 pound derriere is pure BS.

Re:Well

[iluvcapra]

After reading the headline "Head of LxLabs found hanged" I was sortof hoping "Head of LxLabs" was some sort of master node and it just needed a power cycle...

Re:Well

[Anonymous Coward]

Right now, there are *so many* applicants even for fast food jobs, that fast food places are turning people away for not having enough experience in food prep. My brother-in-law, who I previously thought was fortunate for never having worked fast food, was unable to get a job at Taco Bell or McDonald's for exactly that reason. I, myself, cannot even get a twenty hour a week job stocking at Menard's because they want someone who wants a career with Menard's. Since I have a Bachelor's in Computer Science (but no experience at a company), they know I don't want a career with them. And no work experience related to my degree means no job related to my degree.

Re:Well

[Ragzouken]

Don't children and carers of the disabled get financial benefits, though?

Re:Well

[Anonymous Coward]

cassez-vous et mourez.

Re:Well

[zix619]

sad to say, but many often the job is just a curtain in front of your reality: it covers the unbearable emptiness of your life, once it's gone, you don't have any choice to see the reality!

Re:Well

[daveime]

You appear to speak English. They only hire people from the future around here.

(mandatory)
Dey tuk ur jerb ...

Re:Well

[djheru]

Sometimes you need money for things other than "that 50 inch plasma", like, for example, food for your children.

Re:Well

[daveime]

Many places are hesitant to hire PhDs to wash dishes

So don't tell them ?

Re:Well

[Shatrat]

My opinion is suggesting someone work at McDonalds, which is virtually impossible for an american citizen, is about as cold hearted as suggesting someone work at a call center, which is virtually impossible for an american citizen, more or less for the same business reasons.

I've worked at both McDonalds and a call center, and I'm an American citizen.
I think your definition of "virtual impossibility" is similar to VAserve's definition of "virtual machine security".

Re:Well

[SatanicPuppy]

The core premise of Existentialism is very simple: most people spend their entire lives lying to themselves, and living in a world of imaginary restrictions. It's herd behaviour.

If you build your self-image on something outside of your self you are giving up your right to self-determination. Other people are making your decisions, and deciding how your life is going to be. Your boss can decide, on a whim, how you get to feel about yourself.

The whole problem is that we get trapped in this societal notion of how it's supposed to be, of all the things that we have to do. You have to realize that all those obligations are things you put on yourself. There is nothing you can't walk away from.

Depressing ass philosophy, right? But its still useful. I got stuck in a bitch session with my boss a couple of weeks ago which basically boiled down to, "I'm pissed that the stuff that corporate assigned to you over my head has taken precedence over this thing I wanted you to do."

And in the middle of it, I unclipped my badge and tossed it on my desk, and looked him in the eye. And he shut his mouth, turned around and didn't bother me again for the rest of the week. He could fire me, no problem, but he feared those consequences more than I did, and he knew it.

When you define the boundaries of yourself, and you understand that your choice governs your life, and you know it profoundly, there is a freedom in that that scares the shit out of people who let their lives be defined by others.

Re:Well

[TheSpoom]

WARNING! WARNING! CYNICISM OVERLOAD!

My fiancee has worked at a call center and is an American citizen, and I know many American citizens who have worked for McDonalds.

Do your research before making such outlandish claims.

Re:Well

[Hatta]

I dunno. If your job involves being responsible for thousands of people losing their homes, and helping to spark the worst economic crisis in generations, suicide is probably the honorable way out. Certainly much more respectable than taking bonuses for your failure.

Re:Well

[Anonymous Coward]

mod up mod up

Re:Well

[Abreu]

I am Mexican, you idiot! ...and I live in Mexico, before you reply with more racist stupidities

Re:Well

[shrubya]

They only hire illegals around here. Better learn Spanish and temporarily "lose" your proof of citizenship. The preceding is a cold statement of fact, nothing more.

You're lucky I don't have mod points right now. Personally I despise McDonalds for both their food and their corporate behavior, but the REAL cold hard fact is that they prefer to hire people who will show up on time and work hard. It is extremely hard to find USians, either inner city or suburban, who are willing to do that for minimum wage.

Re:Well

[Andr T.]

How do you people know he lives in America?

Re:Well

[swb]

Don't get blinded by the habits of your life to the point where you think your job and the lifestyle it supports is worth more than your life.

If the media is to be believed at all*, the lifestyle which my job supports involves a reasonable mortgage on a reasonable house for a family of 3. I'm kind of hung up on a roof over my head, running water and heat in the winter.

* I sometimes wonder if "the media" is so influenced by their own life circumstances -- ie, the crumbling of network news, and the disintegration of the print media universe -- that the horrors of the current recession get way overplayed. While I believe it's generally true that the financial sector has been hit hard and that the housing market sucks, I had no problem refinancing my mortgage to a low 4.5% (purely to lower my payment) and a couple of houses on my block have sold within six months of being listed, and I've never been busier at my job, either (although my wife's business sucks, and its tied to housing).

It's not that things aren't economically worse than they have been, but is the extent being overplayed by the media because their most palpable universe sucks so bad?

Re:Well

[e40]

That's a gross oversimplification. People don't kill themselves over their job. They kill themselves because they are mentally ill. The job wasn't the cause. The lack of proportion and perspective was the cause. The job was incidental.

In this particular case, the guy's mother and sister committed suicide. There are much higher rates of suicide among people who have relatives who have also committed suicide. That, with the isolation he appears to have suffered from, the job is looking not that significant, at most some sort of trigger.

Re:Well

[Anonymous Coward]

Theres always mexico!

Re:Well

[Anonymous Coward]

The effects are easy to reproduce, apparently

Re:Well

[Zerth]

By being gene-linked to a higher propensity for promiscuity.

Re:Well

[Khyber]

If you worked in a critical sector of our government and you did something that cost the lives of thousands of people, I'd FULLY EXPECT you to contemplate suicide and at least attempt it two or three times.

Re:Well

[Anonymous Coward]

don't be scared.

Re:Well

[jeffasselin]

Genes that bring defects that don't affect an individual before its main reproductive period tend to survive more easily. So say a gene defect that kills you the day you are 40, especially for females, will propagate more easily than one that kills you at 10, because you've reproduced and passed those genes on by that time.

There is still an advantage to surviving after the age of reproduction in a species with longer childhood cycles or one where the grandparents care for the offsprings of its offspring (aka its grandchildren). This advantage is lessened because of gene dilution and its (usually) lesser importance compared to straight reproduction, but still if humans mostly reproduce around 15-20y old (historically), around where they reach maturity, then surviving till at least 40 is an advantage because of more care for the offspring up till maturity. For grandchildren, the age can be up to 60 in the same context.

Species with communal care for offspring also get advantaged by members who survive longer because they get more people to care for the offsprings, but then the dilution is even more significant.

So I can see how a gene that brings higher suicide rates of mature subjects can survive for a while, even though it is detrimental.

Re:Well

[Anonymous Coward]

Yes, but not enough to offset the actual cost of them. If taking care of a child costs you $500 a month and the government gives you an extra $200, you're still screwed.

Re:Well

[Khyber]

"Better learn Spanish and temporarily "lose" your proof of citizenship."

In case you don't pay attention to CA or WA laws - you don't even get hired at McD's until you pass a food handler's test and obtain your license, which requires your identification and proof of US residence.

I moved to CA and within two weeks had a job at McDs. I'm 100% American, and worse, I was born in Texas, showing a CA manager a TN drivers license. I don't know what the fuck you're talking about, a job at McDs being virtually impossible for an American citizen to obtain is one of the biggest lies on the planet.

Re:Well

[Anonymous Coward]

Who says you need a house? Rent a one-room appartment. That's certainly large enough for a family witha few kids. Sure, it's not what you are USED to, but you can certainly continue to live. Presumably, your husband/wife would also have a job at McDonalds, so we are not talking about one income anyway.

Re:Well

[SatanicPuppy]

Nah. The economy is overplayed because it sells papers. The death of media itself is overplayed, which is the hilarious part, for some of the same reasons, but also, as you suggest, because they think about it all the time.

*Works for "The Media"
**Not worried about the economy

Re:Well

[david_thornley]

That philosophy can work for a single person, but only at a cost: you'll never be able to make binding commitments. If you want to exercise your freedom to get married, or have kids, you've accepted obligations that you can't just walk away from (or, at least, you really shouldn't). If you want to keep your freedom to risk your job, without being a complete and utter jerk, you have to pass on some things that make some other people's lives deeply meaningful.

Or, to put this another way, if you can't (or won't) choose to enter an obligation you can't walk away from, you don't have as much freedom as a person who can.

Personally, I chose to get married and make a commitment, and we chose together to have a kid. This means that I chose certain obligations. The form of the obligations is guided by societal notions, but the choice was mine in both cases. These choices do govern my life, in ways I fully accept. I'm as free as you are, aside from acknowledging that there are consequences for decisions freely made.

Re:Well

[SatanicPuppy]

The respectable option there would be to dedicate your life to helping those people you hurt, not to just kill yourself. That's too clean.

Either way, it's a lack of personal responsibilty. In a way, I don't blame them. This stuff happens every few decades like clockwork. Economy starts booming, banks convince the government to loosen "outdated" regulations, they invest unwisely, the bottom drops out, everyone recriminates, and then the government passes a lot of regulations. Repeat.

It's that whole "Those who do not learn from history are doomed to repeat it" thing.

Re:Well

[Anonymous Coward]

Also consider the other major reason for suicide: Pain. Emotional or physical, doesn't matter. It can be really hard to live life when you're uncomfortable 24/7.

Re:Well

[Ungrounded Lightning]

Additionally, affective disorders are associated with creativity and periods of intense productivity. Though they may lead to suicide, they may also lead to considerable economic and/or political power advantage for self and family. Sometimes in the same individual. Thomas Jefferson, for instance, was apparently a bipolar who made major political and nontrivial scientific and technological contributions. Affective disorders seem as common among artists as Asperger Syndrome among techies.

For an extreme case of a "win some, lose some" genetic system, consider sickle-cell anemia. Surviving malaria is SO successful that a gene where a quarter of the offspring of heterozygous parents are unprotected and a quarter are very likely to die if they become too short of breath, yet the other half are able to survive malaria and live essentially normal lives, is actually advantageous.

Re:Well

[svnt]

I'd be like Kevin Spacey in American Beauty...

You did see the entire movie, right?

Notable characteristics of Kevin Spacey's character: in the middle of a mid-life crisis, hated by his daughter, hates his wife, has sexual contact with a minor. Oh, and he happens to work at a fast food restaurant.

This is just a friendly suggestion, but before you tell this story to people you actually know, maybe refine your role model selection a little?

Re:Well

[harryandthehenderson]

Who says you need a house?

I don't know. Who did? I said one needs to be able to house their family.

Main Entry: house Listen to the pronunciation of house
Pronunciation: \ËhauÌz\
Function: verb
Inflected Form(s): housed; housÂing
Date: before 12th century

transitive verb
a: to provide with living quarters or shelter

Rent a one-room appartment.

Yeah and have 0 living space for a family?

That's certainly large enough for a family witha few kids.

I'm guessing you've never actually had a family to make such a statement, have you?

Presumably, your husband/wife would also have a job at McDonalds, so we are not talking about one income anyway.

Wow so you can net a grand total of around 16k on those splendid McDonalds jobs. Good luck affording housing, food, vehicles, etc for even a family with 1 or 2 kids with that amount.

Re:Well

[Anonymous Coward]

Bang 'em and hang 'em?

Re:Well

[SatanicPuppy]

I agree to an extent. The funny thing is always when people try to justify holding on to their death-stress job where they never see their family by saying, "I'm doing it for my family." I actually think that's a cop out; you're doing it for yourself because you want to see yourself as the sort of person who provides lifestyle X to your family.

Again, that's a problem. Families are tough. They get by. Justifying your self-destruction in the name of their social status is no better than justifying it for your own.

On the other hand, I know a guy (who at that time was married with a kid) who recently ditched a great job for no particular reason so he could do what he wanted to do, and I think that's pretty prickish.

True, hardcore existentialism is all kinds of prickish. It doesn't believe in marriage or any of that crap. Pure nihilistic self-actualization. In many ways the philosophy was a response to the Nazi movement: an attempt to explain how a whole group of basically decent people could get caught up in such a horror. Answer: they followed the herd. They did what they had to do to support themselves and their families.

So acting like a prick is definitely preferable to that sort of herd-insanity, but yea, it doesn't really translate perfectly to "I hate my job" angst.

Re:Well

[Anonymous Coward]

If anything, a retail/food industry job will be more likely to drive you over the edge. During the last set of economic lean times, I had to take a job at Fry's as a PC/Mac technician. Normally I'm a network admin or digital artist. That was a depressing, shitty ride through human hate; not only do you feel beaten down by working in the boring tedium of retail, but people treat you so badly just to make it clear how useless you are to them. Management, corporate policy, and customers. All of it works together to make sure you realize: you are everyone's bitch.

If you didn't feel like slitting your wrist before going in to retail, you will afterward.

Re:Well

[Anonymous Coward]

Do your research before making such outlandish claims.

That would require actually looking at reality, which is much more difficult than just going off on some nutty conservative sob-rant.

Re:Well

[Anonymous Coward]

When I look at the two party system of the US, that you have a choice of moderate capitalistic to ruthless capitalistic - and no third or fourth party is able to establish itself in the US - and not because the system is evil, no, because people want these rough capitalistic system . . . "because one day I might be rich as well" attitude.

I do love the US, its nature is one of the most beautiful I have in my life (yes, Grand Canyon, Colorado High Plateau etc), yet, its culture and one-sided focused consumerism isn't my thing.

So, what you say about minimum wage jobs . . . so be it, or change it.

Re:Well

[johnsonav]

Yes, you're absolutely right. I'm not defending his actions.

But, I think this issue is much more complex than a simple (*snicker*) philosophical one. These kinds of things lie at the intersection of philosophy, brain chemistry, and evolutionary and social pressures.

Most people do look outside themselves to evaluate the accuracy of their internal self-image, because, most of the time, it works. It's a valuable feedback mechanism. If you just got fired from your job because you're chronically late or very lazy, you may want to reevaluate the parts of your self-image that relate to your work-ethic or punctuality. If you get a raise, it's most likely that you're pretty good at your job. Most of the time, reality is a powerful and accurate feedback mechanism.

But, sometimes a person's feedback mechanism can backfire. A bunch of bad stuff can happen to you all at once. Normally, you'd be able to cope with any of it individually, but, as it all happens in a short span of time, you look for a common cause, almost by reflex. Sometimes, a person incorrectly judges the cause of those events to be himself, simply because of the weight of circumstantial evidence: it all happened to him.

At this point, a healthy person will most likely take a closer look at the circumstances of these painful events, and upon conscious consideration, come to the conclusion that they weren't all his fault (even if they actually were). But, someone who's depressed or prone to depression, may reach the exact opposite conclusion.

Eventually, that person may decide that the only way to prevent himself from causing any more harm, is to end his life. You can't lay the blame at the feet of his philosophy alone. It only makes sense, in a limited way, when you look at it as the result of a combination of influences and a complex chain of causation.

Re:Well

[EdIII]

I don't know what the fuck you're talking about, a job at McDs being virtually impossible for an American citizen to obtain is one of the biggest lies on the planet.

Let's give him the benefit of the doubt. He probably has never stepped foot inside a McDonalds and only has been through the drive through.

If all you had was the drive through intercom to base your judgments on, I would not be able to say the person was speaking English either. Or any other language for that matter.

Re:Well

[Khyber]

It's the language of EM interference. They run their broadcasting headsets at the same frequencies as FRS/GMRS radios. I can pick up what everybody is ordering just by turning my radio on and hitting channel 7.

Re:Well

[Anonymous Coward]

What makes you think that they value money more than your time?

Re:Well

[emlyncorrin]

How does a genetic predisposition for suicide propagate...?

Genetically...?

Re:Well

[Huge_UID]

More time or more stuff?

Re:Well

[PMBjornerud]

A man or woman has kids before they kill themselves.

Not at all! For genes to prosper, the do not merely have to allow for themself to transfer.

In this case, the man was 32 years. Well within reproductive range, even in a primitive ages.

If it is in the genes, it means individuals with a tendency to suicide does actually tend to generate more surviving offspring than others.

Obviously there cannot be a direct way for suicide to benefit reproduction. Thus one must look at the group as a whole. One theory could be that suicide of individuals in the face of hardship is a net benefit to the group, freeing up food and resources for the remaining survivors.

Re:Well

[TubeSteak]

I'm sure that had a significant impact as well. The security flaw fiasco may have been just the final straw.

http://en.wikipedia.org/wiki/Copycat_suicide
It's one of those phenomenons which is independant of social norms/taboos.

Re:Well

[Hatta]

It's that whole "Those who do not learn from history are doomed to repeat it" thing.

If we started hanging the people responsible for this mess, others would be a little more careful in the future.

Re:Well

[PMBjornerud]

We've got a very affordable mortgage on our house. We bought a used car a few years back and paid for it in full, with cash. We don't have a lot of expensive hobbies. We don't have a pile of debt. But if I lost my job we'd be pretty much screwed.

I have a very affordable mortgage, an apartment instead of house, no car, and 3 months+ salary in the bank. I could go for a year if I cut down on expenses and switched to a slower downpayment of my mortgage.

Unemployed time would be spent on my own hobby project. I have a business plan, although it would be a side income, not a billion-dollar next google.

Re:Well

[Anonymous Coward]

No. It might seem like an unbearable hardship to give up cable TV, broadband internet access, cell phones, and eating out. It is possible to live, with quite a bit of cash to spare, on a low wage. But so many people regard their cable television as an inalienable right...

Re:Well

[Anonymous Coward]

Unless you're Hitler.

Re:Well

[Anonymous Coward]

I'd still take getting my home foreclosed to hanging myself and ending it all. So what, I start from scratch and get a sh*tty apartment. Big effin' deal. Starting over can lead to good things :-)

Re:Well

[misexistentialist]

Or, to put this another way, if you can't (or won't) choose to enter an obligation you can't walk away from, you don't have as much freedom as a person who can.

It's "won't". A person who chooses to become a slave is certainly not more free than the person who chooses not to, especially since such a decision is irrational. In an absolute sense you are still free, but the whim of your wife could put you into a room with bars, which is not generally considered to be a very free condition.

Re:Well

[Anonymous Coward]

A job is just a job, no matter what that job is. To make any more of it is a waste of time.

I "work to live", as opposed to those who "live to work", and there are far too many of the latter.

How many people have a hobby now? A real, actual hobby, not just constantly talking about cars. I know of so few who do. Their lives consist of their jobs, their car, and television.

At the office all they ever talk about is whatever shit was on TV last night (these aren't just the office girls), or how drunk they got on the weekend, or about some car they've been thinking about buying.

The problem is that people devote their lives to nothing worthwhile. Just because they think their job and reality TV is worthwhile doesn't make it so.

Re:Well

[Omestes]

I am Mexican, you idiot! ...and I live in Mexico, before you reply with more racist stupidities

Well go back to... erm...
Wait...

Stop taking my Mexican jobs!

Re:Well

[dintech]

It isn't as cut and dry as "Stop being gluttonous"

It would have been funnier if he could also stop being glutinous.

Re:Well

[Anonymous Coward]

http://en.wikipedia.org/wiki/De_mortuis_nil_nisi_bonum

Re:Well

[smoker2]

I just did that. After a year, there was still no regular employment in sight. That's when the shit hits the fan. If you have bills, you have to work, even if it's part time or you WILL run out of money. Don't waste a year thinking it will be ok later, coz it won't !

Re:Well

[jeff4747]

I sometimes wonder if "the media" is so influenced by their own life circumstances...

The degree of pain one feels in the current economy varies greatly. For example, blue collar workers are hurting a lot more than white collar. And anyone associated with real estate is having a hard time. (That refi probably made the loan officer very happy, for example. Also the houses that sold may have been a bargain).

If we presume your average Slashdotter is working in IT or as a developer, then your average Slashdotter hasn't been directly hurt too badly by the crappy economy.

The fear for us is that we haven't really reached bottom yet, and there's a few massively scary problems lingering out there (Commercial real estate, and another wave of resetting ARMs). If the economy continues to suck for a long time, then the pain spreads.

Re:Well

[retchdog]

Or, the (hypothetical) gene for suicide is, directly or as part of a mediatory network, related to positive traits such as intelligence; creativity; or even, somewhat paradoxically, long-term planning (which would help overall, but every so often you get a false negative and ...). Or, suicidality is the recessive of a gene which is beneficial when co-dominant. There are many explanations which don't require altruism or the so-called "extended phenotype".

Re:Well

[Sj0]

It's slashdot. This song ain't about you. Sorry.

Re:Well

[BikeHelmet]

Kids aren't very good at stuff until they practice it a bit. ;)

Most parents have chemicals in their brains that make them want to stay alive for their children.

Re:Well

[Abreu]

The way I saw the movie it was about:

A man in the middle of his mid-life crisis, quits his hated job and gets a job in McDonalds ...he also gets a boner about his teenage daughter's friend, but lets be honest, this is Mena Suvari (at her prime!) we are talking about!

His wife, in the middle of her mid-life crisis, gets into an affair with a coworker

His daughter, in the middle of her teenage crisis, hates them both

I really don't see Lester (the protagonist) as a role model; I for one, don't plan to quit my job. However, I can empathize with his feelings and the situation he's in.

Re:Well

[Abreu]

Good point!

I already reduced my working hours as much as possible (I leave work at 3pm on Fridays)

Re:Well

[Anonymous Coward]

There are two lines of thought going through my head right now:

1) I congratulate him on his ability and character of self to take responsibility for his actions. (In the Sepuku sense of the meaning) Its courageous to do such a thing. Though I don't believe his actions should directly result in his own death, other lives aren't at stake.(Livelihoods yes, but there are always more jobs. It may be tough for a while, but it can and will eventually get better)

2) I am also deeply saddened. TFA speaks about his mother and sister both committed suicide as well not 6 months earlier. All he had left was his crappy job, which sadly ended up really bad. To him, that was his only way out. I don't believe the act itself at the company caused it, I think it was just the final catalyst he needed. I've been to that point, if something serious like this happened on top of everything else.. I may not be here today. (At least in my case, It couldn't of gone down further, trust me, it couldn't)

All in all, this is really saddening news on a personal level. I have a great amount of pity and sorrow for the loss of his life.

Re:Well

[QuestionsNotAnswers]

Easy... Having Children that breed is the only thing that matters. i.e. commiting suicide after breeding could be fine.

Re:Well

[Anonymous Coward]

You don't have to speak English to have a sense of humor.

Re:Well

[Anonymous Coward]

You sound like my shrink!

Re:Well

[CheshireDragon]

so, so true...I just dive into my job and drown myself in work. It does help keep the monkey demon at bay.

Re:Well

[ozbird]

See also http://en.wikipedia.org/wiki/Genetics

Re:Well

[MikeBabcock]

But you do have to have a good comprehension of the language in which the humour is communicated or it will be lost on you.

Re:Well

[drinkypoo]

That philosophy can work for a single person, but only at a cost: you'll never be able to make binding commitments. If you want to exercise your freedom to get married, or have kids, you've accepted obligations that you can't just walk away from (or, at least, you really shouldn't). If you want to keep your freedom to risk your job, without being a complete and utter jerk, you have to pass on some things that make some other people's lives deeply meaningful.

I would argue that if you don't have the freedom to risk your job then your family is already at an unacceptable level of risk. What if something totally out of your control happens to that job? Now your family is just boned? Clearly, you need to be more secure before you start a family.

Accidents happen, and there's no accounting for that, except to say that it's irresponsible, and you have to get along as best you can.

Personally, I chose to get married and make a commitment, and we chose together to have a kid. This means that I chose certain obligations.

So, I take it you have a plan for survival (theirs and yours) if your source of income dries up and blows away?

Re:Well

[Sudheer_BV]

He didn't lose any contract. ASAIK, he never did any project business. Newspapers wrote whatever came to their mind.

Re:Well

[elrous0]

People with professional jobs tend to romanticize the appeal of working-class jobs (the movie "Office Space," which ends with the burned-out hero finding happiness in a construction job, is a classic example). But, having been on both sides of the equation, I can say that no matter how burned-out you are on your professional job, it's still likely MUCH better than any working class job. Working class and manual labor jobs SUCK. They're (for the most part) mind-numbing, foot killing, back-breaking, spirit-killing, hard fucking work. You may not like having to wear a tie and put up with douchebags all day. But imagine having to bust your ass all day surrounded by a bunch of guys who are not only douchebags, but also borderline illiterate. They're no sitting down and taking a time-out on a job like that, either (no matter how much your feet hurt).

Re:Well

[Anonymous Coward]

Wow! You have savings!? I should be so lucky.Without help from the state; we would have to give our child up to our family or adoption and live on the street.

Re:Well

[JustJenFelice]

Not at all! For genes to prosper, the do not merely have to allow for themself to transfer.

In this case, the man was 32 years. Well within reproductive range, even in a primitive ages.

If it is in the genes, it means individuals with a tendency to suicide does actually tend to generate more surviving offspring than others.

Obviously there cannot be a direct way for suicide to benefit reproduction. Thus one must look at the group as a whole. One theory could be that suicide of individuals in the face of hardship is a net benefit to the group, freeing up food and resources for the remaining survivors.

I think your understanding of genetics is slightly askew.

A genetic trait that can be inherited is not inherently beneficial nor does it inherently generate a greater number of surviving offspring. It is merely an inherited genetic trait - it's the propensity for the development of that trait (dominant vs. recessive) that is driven by natural selection.

Re:Well

[virtual_mps]

So, I take it you have a plan for survival (theirs and yours) if your source of income dries up and blows away?

Yes, and the plan includes not blowing the safety net in a fit of pique. The emergency fund is for emergencies, not "I'm feeling like a prima donna today and want to be a jerk to my boss".

Re:Well

[treeves]

Maybe it's like that bumper sticker saying: Insanity is hereditary - you get it from your kids!

Re:Well

[turbidostato]

"In this case, the man was 32 years. Well within reproductive range, even in a primitive ages."

In primitive ages he wouldn't be "within reproductive range" but more on his end live expectancy. In primitive ages best reproductive range would be much more between 16 to 21 year-old than 32(and even that is "considering inflation": real ages probably would be between 15 to 20).

"If it is in the genes, it means individuals with a tendency to suicide does actually tend to generate more surviving offspring than others."

Bullshit. It means at least so much surviving offspring as competing genotypes. Given that he suicided past 30 year old all his expected offspring was already beyond that point.

Re:Well

[Anonymous Coward]

"from the article it appears that both his mother and sister committed suicide a few months ago!"

Maybe it was because they knew what a fuck of a bussinessman their relative was, knew what was coming and they coldn't stand it.

"he also recently lost a large contract."

Maybe because the contractor thought he was a fuck of a bussinessman.

"losing data on upto 10,000 virtual servers"

Maybe he was, in fact, a fuck of a bussinessman. Back in the day, you know, suicide was an honorable solution if you really were such a fucktard. I really miss the old days...

Re:Well

[Anonymous Coward]

"I personnaly found my brother hung in his bedroom 10 years ago, so"

I feel your sorry and I can only say I'd whish that would never happen'd. But in the harsh end... so what?

Re:Well

[turbidostato]

"A man in the middle of his mid-life crisis, quits his hated job and gets a job in McDonalds"

Quite an interesting movement.

"he also gets a boner about his teenage daughter's friend, but lets be honest, this is Mena Suvari (at her prime!)"

But, but, your honor, it was Mena Suvari at her prime, you surely understand!

(Yes, it surely makes sense)

"I can empathize with his feelings and the situation he's in."

Surely, if you are a derrotist paedophyle as he was. You might pardon others that might think otherwise.

Re:Well

[Anonymous Coward]

"Spoken like someone who hasn't had to deal with the job market in quite some time."

Sure?

"My son has been looking for a job for six months now with no luck. [...] your typical McDonalds job isn't going to cut it these days. Most food service/retail positions will be minimum wage, which doesn't go very far."

Compared to what? Since when "minimum wage" is worse than "no wage at all"? It only works that way if you think you'll have better luck if you look for a better job instead of taking what is offered. It's funny when an USA citizen wants a free market but then wants a commie-like state to protect him when things go nuts.

Go to a McDonald's and see who is working there. Do you really thing all of them are teenagers living on their parent's basement? If you look at them and you think some of them are members of families with sons in charge then don't say "McDonald's doesn't go very far": if it goes "far enough" for them, it certainly can go "far enough" for your single son. Unless, of course, you think the 50 inch plasma to be an inalienable right.

"We're talking about whether or not you can keep your house and/or car"

No. We are talking about wherther or not you can keep *a* house and *a* car, not *your* house and *your* car signed under a better situation. Saying I can't keep my SUV flipping burgers at MacDonald's is not an answer if I can buy an Aveo.

"But if I lost my job we'd be pretty much screwed."

If your live in a way that if you lose your job you'll be pretty much screwed then you don't deserve to live in the USA: it's a liberal freemarket economy so you either look for yourself on the good times for the not-so-good-to-come or you will be screwed in a deserved way.

Re:Well

[turbidostato]

"I'm guessing you've never actually had a family to make such a statement, have you?"

You certainly didn't pay attention at how many families manage to live that way, do you?

"Wow so you can net a grand total of around 16k on those splendid McDonalds jobs."

You used to have a Spaniard on service. Did you pay her 16K a year? I bet not. Still she was able to sustain herself, her son and send money to Mexico for her parents.

Re:Well

[Anonymous Coward]

"If you just got fired from your job because you're chronically late or very lazy"

Hell, I'm chronically late *and* very lazy; I'm a sysadmin by trade after all. Still I don't manage to get fired. It's the curse of we the overperformers, I think.

Re:Well

[sjames]

Yeah, who needs decent shelter where there isn't a crack house next door! Just let the kids get hooked on the crack and they won't even care that you had to spend the last of their college fund on food.

I don't know about India, but in the U.S. this gets compounded. Now that you DON'T have a decent paycheck, the bank starts charging you MORE, or they close your account and you have to lose 5-10% of your inadequate check just to get it cashed. Miss your credit card payment and they double the interest rate.Talk about kicking people when they're down.

Yes, suicide is not a very good answer, but it's not as if being forced to take a job that won't even cover the basics is something most people can just laugh off, especially when the shit just keeps coming. For some, it's the final blow. Anyone's mental health can fail if subjected to enough stresses and problems.

Re:Well

[Anonymous Coward]

You reproduce *before* you die. Duh.

There's yer problem...

[slower]

From TFA:

Some 50 percent of Vaserv's customers signed up for unmanaged service, which doesn't include data backup...

Why? Why!?

Re:There's yer problem...

[Anonymous Coward]

Backup your own damn data. If you trust your webhoster to do it for you, you're a lost cause.

Re:There's yer problem...

[Anonymous Coward]

maybe it was a lot cheaper, this is the internet.

Re:There's yer problem...

[Bill, Shooter of Bul]

I think many people may have been confused as to what they meant by data back up. There are back ups you need in case you delete all of your data accidentally, or want to go back to a previous revision. Those would be back ups due to web host user screw ups. This wasn't a web host user screw up, it was a web host screw up. The users probably didn't consider it a likely occurrence, and may have believed that the web host should be able to fix a problem that they allowed due to their negligence.

Re:There's yer problem...

[harryandthehenderson]

The users probably didn't consider it a likely occurrence, and may have believed that the web host should be able to fix a problem that they allowed due to their negligence.

But this wasn't due to negligence on the part of the web host. This was due to some Indian guy putting out apparently shitty software that contains amateur-level exploits.

Re:There's yer problem...

[Locke2005]

Why do you need the hosting company to do backup for you when you are creating all your content locally and FTP'ing it up to the server? You only need backup if you are allowing users/customers to modify the state of your web site. Probably 50% of customers are personal pages used to post baby pics for relatives to see. Yes, you should always do backup, but it doesn't logically follow that your hosting company should always do backup for you. The cardinal rule is trust noone with your data but yourself, because you are the only one that does really care about your data.

Re:There's yer problem...

[Bill, Shooter of Bul]

Well, it would seem that if the exploit was so amateurish, the host didn't do their due diligence when selecting virtualization software.

Re:There's yer problem...

[harryandthehenderson]

Because a web host has the time and money to spend auditing every single line of code of every software they use? This is discounting the fact that the software in question was a proprietary app that was also widely used by others. So I'd say that they probably did as much due diligence as was possible but all the due diligence in the world isn't going to save you when someone may find a way to exploit code.

Re:There's yer problem...

[horza]

There is only so much due diligence you can do if their claims are not true.

Phillip.

Re:There's yer problem...

[Glendale2x]

1) Lost of customers are cheap bastards; lowest cost hosting wins irrespective of the actual service offered.
2) VAserv apparently couldn't be bothered to keep their own disaster recovery backups.

Re:There's yer problem...

[Glendale2x]

I disagree; it should logically follow that a company should have some kind of disaster recovery plan other than "Oops, it's all gone, but how about a few months of free service?" If that's what customers want and I could get away with then damn, I've been wasting time and money keeping disaster recovery backups offsite. I'm not talking about backups like customers accidentally deleting files, but loss of service due to events beyond your control.

Yes, you should have copies of your own stuff, the more the better. For vahost even if the "oh crap" backup was a week old that would have been better than the total loss they're selling as "not our fault we dun got hacked".

Re:There's yer problem...

[Glendale2x]

It doesn't matter; the point of a disaster recovery backup (or plan) is not to protect your clients against accidentally deleting files, but to protect you (and them) from events that are completely outside of your control. Using a closed-source virtualization package that could possibly house a major security hole that you don't know about would qualify as something to plan for in disaster recovery. Apparently they didn't.

Re:There's yer problem...

[v1]

thanks for those links, that second one from milkw0rm is just jaw-dropping...

Re:There's yer problem...

[harryandthehenderson]

It doesn't matter; the point of a disaster recovery backup (or plan) is not to protect your clients against accidentally deleting files, but to protect you (and them) from events that are completely outside of your control.

Who says they didn't have a disaster recovery plan? The issue at hand for many of the sites that have no backups at all for their data is because they chose a plan that explicitly stated that it was unmanaged and that VAserv wasn't going to back up the data for you.

Re:There's yer problem...

[Glendale2x]

I don't know if they have a DR plan; I'm just guessing based on the aftermath of the disaster. Maybe they do, found out it was faulty, and they'll end up revising it to account for this situation in the future.

In any case, I still think its idiotic for any company (except colo where you really don't control the hardware) to wash their hands of a customer just because they didn't pay extra for "backups". Sure, pay for convenience backups, but total site loss? Come on, that's for the hoster's protection, not the customer.

Re:There's yer problem...

[Kompressor]

thanks for those links, that second one from milkw0rm is just jaw-dropping...

I'll second that!

I'm glad that I don't run their software for my hosted clients, that's for sure!

Re:There's yer problem...

[Bill, Shooter of Bul]

Yeah, I guess so. I was just saying that if the holes in the software were obvious, then the webhost would be more at fault. In a similar manner, if you don't keep a windows box up to date with virus definitions and security updates, its as much your fault as Microsoft's if you get a virus.

Re:There's yer problem...

[turbidostato]

"Some 50 percent of Vaserv's customers signed up for unmanaged service, which doesn't include data backup...
  Why? Why!?"

Because those that signed the backup plan lost all their data just the same, only they paid more for the privilege.

Re:There's yer problem...

[turbidostato]

"Because a web host has the time and money to spend auditing every single line of code of every software they use?"

Well... they still had the time and money to bill it as they would, didn't they?

Re:There's yer problem...

[Anonymous Coward]

"Who says they didn't have a disaster recovery plan?"

Well, at lest the CEO had one. Maybe a bit extreme, I should say, but...

Re:There's yer problem...

[LVSlushdat]

I had a vps hosted by fsckvps, one of Vaserv's sister companies, which was deleted by this exploit from the host machine it ran on. I'm in pretty good shape since I had a vpn between the vps and one of my internal machines with a cron job each night that backed the mysql database, which is the only part of the system that would be a real pain to recreate. I'd considered using the full vps backup manager that the HyperVM console had, to backup the entire vps periodically, but the only way to get the resultant tarball off their backup node was via ftp.. Since I don't run an ftp server on my internal server, and don't intend to, I gave up on a full backup of the vps. I couldn't even scp the tarbar down my vpn, since it was on a different server, which as I understand, was ALSO hacked and files were deleted.. I feel sorry for the guys who were relying on those backups to rebuild their vps...
I'd asked if it were possible to get access to the resultant backup tarballs and copy into one's own vps and copy/move from there to a safe off-site location, but no one from management ever responded to my question... Still waiting for a replacement vps from them, figure I'll stay with them, since, besides this issue, they've been awesome...

um....

[sanosuke001]

whoops

Narrow escape

[sakdoctor]

Just closed an account with VAserv last week for no particular reason.
I hardly ever do things for "no particular reason" so it must have been my spider sense.

Will this be a case of good bye reputation, or no publicity is bad publicity?

Re:Narrow escape

[TheRaven64]

An SQL injection vulnerability, via the web, gained hypervisor-level access to their system. Let me say that again; a web server, an SQL database, and a web app were all running with sufficiently-high privilege that a vulnerability in one caused arbitrary-code execution at the hypervisor level. Anyone who doesn't immediately start worrying when they see that kind of lack of privilege separation has absolutely no business running a VPS business. I definitely won't be putting any business VAserv's way in the future...

Re:Narrow escape

[EvilRyry]

If I'm reading this right, the point of the web application is to manage the VMs. If it didn't have privilege to manage (or destroy in this case) the VMs, it would be pretty useless.

Re:Narrow escape

[vlm]

I definitely won't be putting any business VAserv's way in the future...

Well, normally, this results in a high level of focus on the problem... So, in the future, they probably won't have problems like this. On the other hand, their competitors will be too busy signing up accounts to patch their systems and any public display of patching (like special extended maint time or a new way of using their product) will make them look just as bad so of course their competitors won't focus on security, leaving them more vulnerable than VAserv...

Except their dude, whom would have focused on security in the near future, is dead now. So maybe that doesn't work too well in this case. Hmm.

Re:Narrow escape

[fwr]

And why was access to that management interface allowed from the Internet, presumably?

Re:Narrow escape

[cinderblock]

The vast majority of the problems came from replacing files that LxLabs's software would access with elevated privileges with symlinks to target files like /etc/shadow. One combination of these tricks even led to full root shell access. Who needs an SQL injection attack... except to access an account so you don't even need to be a paid user.

Re:Narrow escape

[gollito]

Being somebody who has been affected by the attack on Vaserv (luckily my primary system was unscathed but the other 3 are MIA as of right now) I got curious and found this in regards to the vulnerabilities in HyperVM
link

Re:Narrow escape

[sjames]

Privilege separation doesn't mean not having the capability, it just means that the front end runs in a limited container with a thin API connection to the privileged process that can actually carry out the commands and authentication. The idea is that if an attacker manages to get a shell in the front-end's container, all they get is a shell that can't see anything. Even if they manage to retain the communication with the back-end, they still have no way to authenticate any commands they might send it. While I wouldn't go so far as saying that it makes the front-end's security irrelevant, it DOES limit the security sensitivity of the front-end.

See this for a high level overview of privilege separation in OpenSSH.

Well

[Zashi]

That's one way to dodge all those bug reports...

Mixed feelings

[JeffSpudrinski]

You can't truly blame Milw0rm for a person being depressed and committing suicide.

However, reading their security notes on it, they did hear back from the developer...they simply declared that it didn't happen fast enough and decided unilaterally that the "Vendor appears uninterested".

I have very mixed feelings on security firms releasing exploits to the public just to try and get results. In my (admittedly limited) experience, more bad has come from releasing exploits publicly than good.

-JJS

Re:Mixed feelings

[Anonymous Coward]

The vendor wasn't interested enough to download the specific details and data made available privately within 2 weeks, and just stalled with brief email non-statements. There's your 'not interested' right there. Sad that the guy killed himself, though; no business problem is worth that.

Re:Mixed feelings

[asdf7890]

I have very mixed feelings on security firms releasing exploits to the public just to try and get results. In my (admittedly limited) experience, more bad has come from releasing exploits publicly than good.

-JJS

But once you've informed the supplier, and allowed enough time for a fix to be created, tested, rolled into a patch, QAed, released to clients and tested+installed by clients, what other alternative is there? Quietly forgetting about it and just hoping that you are the only people who know about the issue and no black-hats out there will find it is simply not an option.

Re:Mixed feelings

[Zashi]

Actually thanks to cyber-bullying laws I think you can.

Re:Mixed feelings

[Anonymous Coward]

There is another option: You could publish that there is a working exploit (which you are not going to release), yet the vendor has not fixed the bug despite having been notified of it. If you are in an educational mood, explain that whatever you found can be found by people with less noble interests as well, so the software should be considered compromised, regardless of you publishing the exploit or not.

Re:Mixed feelings

[Omnifarious]

I think there's a difference between verbally bullying a vulnerable 14 year old with a fake account and releasing details of actual vulnerability in a piece of software written by a company owned by a 32 year old.

But, I agree with you that cyber-bullying laws are really problematic.

Re:Mixed feelings

[drachenfyre]

Why is it not an option? It isn't the best option, which is to announce that an exploit exists, but not release the details. I'm not blaming their actions for the guy's death, but the people who lost servers and data have every right to be angry. It would have been far easier for them to announce that an exploit exists so customers could get out of a bad position instead of releasing the code which guarantees the end result we see here (For the customer, not the owner of LxLabs)

Re:Mixed feelings

[CarpetShark]

You can't truly blame Milw0rm for a person being depressed and committing suicide.

No, you truly can. You can't blame it for 100% of the problem, but without doubt, people who make viruses are preying on others. What outcome to you expect, when those preyed upon are already struggling just to get through the day and raise their kids or whatever?

Re:Mixed feelings

[asdf7890]

Why is it not an option? It isn't the best option, which is to announce that an exploit exists, but not release the details.

I would agree that this is the best way to proceed initially, but what if no body takes the report seriously? Also, without releasing any details how does anyone verify that your attack is valid and not just you trying to defame the supplier?

Announcing that there is a problem but not releasing the details is not as much less dangerous as your post suggests you believe. As soon as such an announcement is made I'm pretty sure a number of black-hats out there will immediately start scanning for the issue and there is a fair chance one will find it in time to make use of it.

My suggestion would be:

1. Notify the supplier ASAP with full details
2. After some time (a month perhaps, though this may be shorter or longer depending no the potential seriousness of the exploit), if there is no public update from the supplier, contact them to see what the status is
3. If they are not taking action, publicly announce that the exploit exists and that details will follow in, say, 28 days. Delay this step if it seems the supplier is taking action but is suffering legitimate delays (such as the problem being deep in the codebase and therefor requiring much QA testing for an update - though in such events I would expect a workaround to be available and announced in most cases).
4. After the deadline above release general details - just the result of the exploit such as "will result in denial of service for all on the host" or "may result in giving unauthenticated access to all user data" or "allows an authenticated user to escalate their privileges". Announce a further deadline after which more information will be made available.
5. After the deadline above publicly release full details.

Of course one problem with this, and any other vulnerability announcement, is that the company involved may try to silence you with litigation (or threats there-of) as well as or instead of taking action to fix the issue. That could get very thorny. But any decent software supplier should be grateful of the initial heads-up and would be quite forthcoming if asked for progress (like saying "we've reproduced the issue and expect to have a patch available in X days" or "a full update may be delayed because of X, but a workaround is being tested and we expect to announce it in Y days"). I would be, as I believe would my employer.

Of course the problem will not always be down to the software supplier - it could be a local configuration issue in which case they should tell you and perhaps add extra warnings to relevant documentation to reduce repeat occurrences.

Re:Mixed feelings

[hedwards]

Because somebody else will figure it out and often times corporations refuse to do anything about the exploit until it's been made public. Seriously I'm sick and tired of MS' security by obscurity bug fixing crap. Yes it takes time to get the patch right and releasing a buggy patch can be more harm than good, but still. This whole mantra of pretending like exploits don't exist furthers nobody's interest but the code crackers.

Re:Mixed feelings

[asdf7890]

But that is not much less dangerous than just announcing the details. Letting the world know that an exploit exists is tantamount to challenging any black-hats out there to go look for it. Look for it some will, find it some might, and if some find it before fix is released and commonly installed you can bet your bottom dollar there is a chance at least one will use it for personal gain or just plain old vandalism. By announcing an exploit without details you just delay the inevitable (or, perhaps, speed its arrival almost as much as a detailed announcement would).

Re:Mixed feelings

[Deanalator]

Many companies these days will either ignore you, or threaten to sue you if you release, and still not patch. That bullshit is a lot to deal with. If a company does not have a bug bounty program, what possible incentive is there to telling the vendor? You either keep it to own their shit, find some sketchy black market buyers that want it, or you dump it on milw0rm because it's funny.

Re:Mixed feelings

[Deanalator]

Right.. and that worked really well with the latest serialization bugs in java. 6 months later and OSX was still not patched. In infosec, you either PoC or GTFO. Theory bullshit and speculation on exploitability is not tolerated. Many vendors do not patch until there is a publicly known exploit, and even then, they only patch the versions that have been proven to be effected.

Re:Mixed feelings

[Anonymous Coward]

Delaying the inevitable is still better than causing the inevitable by releasing an exploit for an unfixed vulnerability. The downside to not releasing the exploit is that you expose yourself to suspicion if someone else finds and uses the same exploit. I guess that's why nobody does it that way, even though it would serve the purpose of protecting the public better than keeping quiet or releasing the exploit.

Re:Mixed feelings

[nxtw]

I have very mixed feelings on security firms releasing exploits to the public just to try and get results. In my (admittedly limited) experience, more bad has come from releasing exploits publicly than good.

These vulnerabilities are so simple - and many lead to root access. I'd be surprised if these vulnerabilities haven't been found in the past by others; it's likely that people who found them have been exploiting the application for some time. See the exploits - the application is clearly flawed and was designed with little regard to security. With a security failure of this magnitude, I think it's best that everyone know about the exploits. If I used this product, I wouldn't trust the vendor's ability to write a secure product at all; I'd switch to a more secure product ASAP.

Re:Mixed feelings

[nxtw]

No, you truly can. You can't blame it for 100% of the problem, but without doubt, people who make viruses are preying on others. What outcome to you expect, when those preyed upon are already struggling just to get through the day and raise their kids or whatever?

You might expect someone selling a product to not lie about security.

You might expect someone selling a product with completely false security marketing to at least read the information regarding any published vulnerabilities - note that the vendor apparently did acknowledge the notification, but did not read the details.

Lxlabs has really been preying upon their customers all along: they've been selling an extremely poor product and lying about their product's security design.

Re:Mixed feelings

[corbettw]

But once you've informed the supplier, and allowed enough time for a fix to be created, tested, rolled into a patch, QAed, released to clients and tested+installed by clients, what other alternative is there?

You're assuming the bolded part is true. Reading through the information on Milw0rm's own site, it appears they had an email exchange with someone at LXLabs for two weeks, then decided on their own to release the information. Two weeks is not nearly enough time to even decide if something like this is worth looking at, let alone find a fix, develop it, test it, implement it, and push it to all clients. I hope the guys at Milw0rm get sued into oblivion over this. Their actions were completely irresponsible and directly led to millions of dollars of damage, potentially billions of dollars of damage (over 100,000 accounts were destroyed, assuming those accounts spent on $10 per month on hosting that's millions of dollars in damage to the hosting provider alone). VAServ is based in the UK and LXLabs is based in India; I have no idea what the laws are like in those countries, but let's hope Milw0rm faces criminal charges there over this. Security research is an important field and requires a certain level of trust, accountability, and responsibility for it to function properly. By releasing this information publicly without sufficient notice, Milw0rm breached those traits and deserves to suffer the consequences for doing so.

Re:Mixed feelings

[Todd Knarr]

The problem with that approach is that the day after you announce that the exploit exists the company's going to sue you for defamation and libel. They're going to use the fact that you didn't provide any evidence to support your claim against you as evidence that you don't have any evidence and are lying specifically to harm their reputation. And one of the first things they're going to ask for is an order barring you from libeling them any further, which is going to prevent you from disclosing anything to help clear your reputation. By the time you get the lawsuit untangled you won't be able to demonstrate that the vulnerability really existed (the fix will have been quietly added during a regular update and your exploit won't work anymore) and you'll end up with the trashed reputation.

My position:

1. Contact the vendor with full details. Give them working exploit code so they can verify for themselves that it really works. They get 2 weeks to respond confirming they've received your material, and no more than an additional 4 weeks to at least notify their customers of the problem.
2. If the vendor fails to meet either of those deadlines, publicly release a full report on the problem including sufficient details and/or code for other parties to verify the correctness of your claims and any known workarounds or steps that can be taken to mitigate the vulnerability. By this point the bad guys already have all this information, now the affected users also have it and can take steps to protect themselves.
3. Don't threaten. Don't bluff. Your position should be Londo's: "Actually, now that you mention it...".

Re:Mixed feelings

[nxtw]

Two weeks is not nearly enough time to even decide if something like this is worth looking at, let alone find a fix, develop it, test it, implement it, and push it to all clients

Are you serious?

According to milw0rm, whoever responded didn't even access the details of the vulnerabilities - after two weeks. Nor did they provide any contact information. It would only take a few minutes to skim through the details, and it should have been immediately apparent that the vulnerabilities described could be serious. But they didn't read the details at all.

Assuming milw0rm did contact the correct person/people at LXLabs, they clearly has no interest in the security of their product(s).

Re:Mixed feelings

[corbettw]

Someone sends a random, out-of-the-blue email saying "hey we hax0red your code, lol" and you expect the recipient to pop tall and check out their site immediately? Are you serious? And what contact information was needed? Obviously Milw0rm talked with someone at the company, so they already had contact information. Could it be that Milw0rm was talking to a customer service agent who didn't appreciate the severity of the problem because, gee, I dunno, Milw0rm didn't bother to track down contact information for the right person(s)?

Assuming milw0rm did contact the correct person/people at LXLabs

That's a huge assumption and not one I'm willing to make. However, I am willing to state, without reservation, that Milw0rm are a bunch of asshats who deserve to be sued into oblivion over their callous disregard for the safety of the customers using this software. That's really the worst part of all of this. Most of the people hurt by this had no control over the software getting fixed, had no idea there was a problem until it was too late to do anything about it, and were completely innocent of any mistakes. And yet Milw0rm doesn't care one fig about those people and just releases code that sends their lives and businesses into a tailspin. How do you defend that kind of behavior and call yourself a professional?

Re:Mixed feelings

[asdf7890]

Reading through the information on Milw0rm's own site, it appears they had an email exchange with someone at LXLabs for two weeks, then decided on their own to release the information. Two weeks is not nearly enough time to even decide if something like this is worth looking at, let alone find a fix, develop it, test it, implement it, and push it to all clients.

Fair enough, I would agree that in most cases two weeks is not nearly enough time. Even if you can, by some superhuman feat of organisation, create+QA+publish a fix/workaround that day it'll take time for the users to test and make the update available on their services (you can't just chuck a patch on a large production system without some oversight).

But I would certainly not go as far as to suggest that two weeks is not enough time to decide if something like this is even worth looking at. To have not even accessed the resource containing further exploit information (I assume this was available on a service that would log access, an unadvertised and unlinked location on a web server for instance) in two weeks seems wrong to me. Would you not at least download it, virus-/other-check it, and attach anything relevant to your internal record for the issue so the team/person who reviews these things has access to the info?

Having read the released information I would agree that Milw0rm's premature release was at least unprofessional if not down right irresponsible, but (assuming Milw0rm's report is true and accurate) I think that the vendor's response was similarly lacking in due diligence.

Re:Mixed feelings

[vlm]

Why is it not an option? It isn't the best option, which is to announce that an exploit exists, but not release the details.

Pointless, as anyone whom's ever done creative coding knows. 90% of the job is figuring out something is possible. 9% is figuring out someone else did it, so obviously anyone else can.

I know a sekret exploit for GW Basic that causes an endless loop in a program. I'm not releasing code because I'm all high and mighty above you all, but lets just say, to prove I really invented this sploit, that a program line that contains a goto statement that "goes to" itself, will, like, loop forever. I'm sure the skript kiddies will never figure out how to actually write an exploit to make an endless loop. Yea me, I'm leet! Note my lack of released sploit code.

Re:Mixed feelings

[nxtw]

Someone sends a random, out-of-the-blue email saying "hey we hax0red your code, lol" and you expect the recipient to pop tall and check out their site immediately? Are you serious?

No one looked at the details of the vulnerabilities for two weeks, after they claimed they would look at it and after they claimed they would respond in a few hours.

And what contact information was needed? Obviously Milw0rm talked with someone at the company, so they already had contact information.

In a business context, it is customary for people to sign their emails with (at least) their name.

However, I am willing to state, without reservation, that Milw0rm are a bunch of asshats who deserve to be sued into oblivion over their callous disregard for the safety of the customers using this software.

If anyone callously disregarded the safety of LXLabs' customers, it was LXLabs. Milw0rm's disclosure aside, it's LXLabs who made a product with such severe security issues and LXLabs who made ridiculous claims about the security of their product.

Most of the people hurt by this had no control over the software getting fixed, had no idea there was a problem until it was too late to do anything about it, and were completely innocent of any mistakes.

LXLabs' customers chose the product to begin with! If the product is indeed this insecure, the customers are certainly not innocent, as they have failed to thoroughly evaluate the product.

And yet Milw0rm doesn't care one fig about those people and just releases code that sends their lives and businesses into a tailspin.

It is not milw0rm's responsibility to care for LXLabs' customers. That's LXLabs' job.

Re:Mixed feelings

[horza]

Two weeks is plenty of time to consider whether the linked vulnerabilities is worth looking at, especially as on their site they claim they have "a weekly update schedule where a new version is released every week". Such an extensive list certainly merits dialogue with the person polite enough to point them out. Issue #6 indicates the admin server is running as root, a big no-no. It certainly contradicts point one of their own claims. Pointing out a security flaw in software isn't an offense as far as I know, so I don't know how they can sue. Trying to pin things on Milw0rm is a complete distraction. The real issues are:
* LXLabs failed to respond to serious vulnerabilities, many of which indicate an amateur level of programming
* the vulnerabilities directly contradict the claims made on their web site, many clients basing their purchase on these claims
* LXLabs did not tell their clients, including Vaserve, about the vulnerabilities and so they did not have the option to disable the modules containing vulnerabilities until a patch was released
* such a destructive attack indicates a personal vendetta against either LXLabs or Vaserve - which party was it intended to damage and discredit?
* if the perpetrator of the attacks has not covered his tracks, he is going to be in a lot of trouble
* never trust a product with "Hype" in the title :-)

Phillip.

Re:Mixed feelings

[Anonymous Coward]

I think there's a difference

Sure, you and I might see a difference, but that's not the point. The point was that these cyber-bullying laws probably could be used in this way.

Re:Mixed feelings

[CrazedSanity]

Let's make an analogy to a real-world situation and I think you'll probably understand a bit better.

Just as an unknown security exploit has the potential to collapse a server, an engineering flaw can cause a building to collapse.

An engineer (think security expert) is underneath a building (this would be the server) making some checks for integrity (security). During this check, he discovers a very important beam has several bolts that appear to be coming out or have sheared off::: someone with malicious intentions could quickly and easily destroy the building; but it might also be possible for natural events (i.e. an earthquake) to cause it to topple as well. Realizing the situation is grave but not wanting to cause mass panic, he tells someone in charge about the situation. It is a very important problem to address, and there are a lot of complexities to deal with, so the engineer sits back and waits to hear something. After enough time goes by without any indication that something has been done to either temporarily or permanently fix the problem, the engineer tells the people in the building about it, causing a bit of mass panic, but quickly prompting those in charge to get the problem fixed.

But let's say the engineer decides NOT to announce it publicly. Sure, people in the building go about their business as though nothing is wrong, and the threat of a malicious person hearing of the problem is avoided. What happens when a natural event causes the building to collapse? Or when a "terrorist" finds the problem and exploits it? All the people in the building--if they survived--would be fuming mad about a problem that was known but not dealt with. Now instead of having "the people in charge" mad at him, the people that were affected are mad.

If you didn't catch the moral, here it is. Announcing the problem to the world will piss off the vendor, but will ultimately result in either a fix from them or some other form of mitigation from those that are affected and/or have the means to stop it. Ignoring the situation only gives the illusion of stability... the illusion that there isn't a problem, or that unspoken problems will never be exploited. Hmm.. there's lots of illusions in "ignore" scenario...

Re:Mixed feelings

[TubeSteak]

LXLabs' customers chose the product to begin with! If the product is indeed this insecure, the customers are certainly not innocent, as they have failed to thoroughly evaluate the product.

Really? Blame the customers?

I'm not sure what country you're from, but the Westernized world has generally moved away from caveat emptor and decided that it is in society's best interest for merchants to be responsible for the fitness of the product they are selling. The UN even passed a convention on it in 1980 (Articles 35 & 36 speak directly to buyer and seller responsibility)

Re:Mixed feelings

[Eil]

Why is it not an option? It isn't the best option, which is to announce that an exploit exists, but not release the details.

Releasing the announcement of a security vulnerability without all of the details is a pretty silly thing to do.

For one thing, it's usually impossible to prove that the vulnerability exists without going into enough detail that others could use to figure out the full nature of the vulnerability for themselves. In the security field, nobody pays attention to you if you don't have evidence or hard data to back up your claims and that's the way it always should be.

Second, it's just one uncomfortable step away from blackmail. There are already groups out there who look for critical vulnerabilities in common software so that they can sell the exploits to the highest bidders, we don't need even the potential for this kind of thing in otherwise legitimate security research.

It would have been far easier for them to announce that an exploit exists so customers could get out of a bad position instead of releasing the code which guarantees the end result we see here (For the customer, not the owner of LxLabs)

And if they did, they would be accused of scare-mongering, or even collusion with a competitor. They might even find themselves in slander/libel territory without the hard evidence to back up their claims.

Re:Mixed feelings

[neuroscr]

Enough time? How do you know what's going on internally in their company? They might have real priorities that are higher than security believe it or not.

I think the problem is the security guy did not due his duty to fully disclose and inform Kloxo of the seriousness and what he planned to do if they didn't satisfy his demands.

Re:Mixed feelings

[tinkertim]

I have very mixed feelings on security firms releasing exploits to the public just to try and get results. In my (admittedly limited) experience, more bad has come from releasing exploits publicly than good.

I have the same mixed feelings. The problem is frustration stemming from vendor lock-in. If you use a proprietary product to deploy 200 servers, you basically become married to the product. The applications organize things in their own way, switching to something else is a very costly and aggravating ordeal.

If you have discovered a string (note, dozens) of serious vulnerabilities in the software and get no response from the vendor, what do you do? What immediately comes to mind is "stop using the software", however as I noted, that is not so easy.

I would never disclose something until / if the vendor patched it. I would also never accept an end user license agreement that did not clearly specify the responsibilities of the vendor with regards to security patches. If they fail to fix them in a timely manner (two weeks is MORE than timely to at least show some progress), lawyers can work it out.

If you think about it, telling someone "Fix this issue within xx days or I'll disclose it" is borderline blackmail. You're telling someone that if they don't do what you want, when you want it, you'll cause them grief. Changing that to say "If you don't address these, I'll have to involve my lawyer as you are clearly not holding up your end of our contract" is another story.

The lesson learned, use free/open source software or buy from vendors with an excellent track record of addressing these kinds of problems quickly and transparently. If you're going to get married to a product, be sure to have a prenup.

Re:Mixed feelings

[Anonymous Coward]

Because if one person found it, other have already or will soon.

Without releasing information, thousands of sites could be wiped before anyone realized what was going on.

Re:Mixed feelings

[nxtw]

If you think about it, telling someone "Fix this issue within xx days or I'll disclose it" is borderline blackmail. You're telling someone that if they don't do what you want, when you want it, you'll cause them grief.

But did the researchers demand that the flaws be fixed in a given timeframe? The vendor didn't even look at the vulnerabilities in the two week period. What can you do when the vendor doesn't take a problem seriously and when you don't have a business relationship with the vendor?

The lesson learned, use free/open source software or buy from vendors with an excellent track record of addressing these kinds of problems quickly and transparently.

Simply choosing free/open source software doesn't really prevent what happened here from happening again. Open source software is not magically more secure, and open source developers can ignore reported vulnerabilities. The main benefit is that anyone can fix the vulnerabilities.

And vendors with horribly insecure software can still do a great job of fixing flaws quickly... once they find out about them.

Re:Mixed feelings

[sjames]

Two WHOLE WEEKS! Yeah, right. Sounds more like they were upset that a very busy person didn't drop everything and devote his life to fawning over their every comment.

I'm not at all in favor of prosecuting security researchers for finding flaws, and I do believe there comes a point where the results have to be published when the vendor takes no action, but this borders on blackhat activity and probably SHOULD be prosecuted.

Two weeks is not long enough, particularly when you don't provide the info in the vendor's native language.

Releasing the info without even so much as a warning to the vendor is irresponsible.

It would be much better to first publish THAT there are security flaws and see if that gets the vendor moving (or at least gives the hapless customers a chance to migrate away).

Effectively, they blindsided the vendor's customers and the customers' customers with no warning at all.

Quietly forgetting about it and just hoping that you are the only people who know about the issue and no black-hats out there will find it is simply not an option.

So how does making sure ALL of the black-hats know all about it help? They could easily have published THAT they found a problem and were awaiting the vendor's patches to make a full disclosure. That would have given users like VAserv and all of their customers time to decide if they should switch vendors, try a work-around, or await LxLabs' update. Meanwhile they would likely contact LxLabs themselves and make sure the issue wasn't being ignored.

For those reasons, the timing of the disclosure made their actions practically indistinguishable from black-hat activities.

Re:Mixed feelings

[asdf7890]

Two WHOLE WEEKS! Yeah, right.

But *all* they needed to do in those two weeks was download the provided vulnerability details and acknowledge that they were intending to investigate?

As I said above I agree that two weeks was an unprofessionally short timeframe for full disclosure of issues this serious, but not even attempting to access the provided information in two weeks shows shows a severe due diligence failing on the part of the vendor too.

Re:Mixed feelings

[sjames]

Unless the email looked a lot like gobbeldygook because they emailed it to someone for whom english was a (distant) second language, or they emailed it to 'support' and there wasn't anything in the flip book to cover that. It's a bit hard to tell from the timeline if the contact attempt was anything more than cursory.

Re:Mixed feelings

[asdf7890]

Unless the email looked a lot like gobbeldygook because they emailed it to someone for whom english was a (distant) second language, or they emailed it to 'support' and there wasn't anything in the flip book to cover that. It's a bit hard to tell from the timeline if the contact attempt was anything more than cursory.

The rundown on that site says the second response was "Sorry for the delay. I am currently looking into this, and will reply in a couple of hours time" which implies that the messages was understood.

Of course we only have one person's word for that, and we don't get to review the initial emails to see if they were written well enough...

Re:Mixed feelings

[sjames]

Exactly. The second response looks like the sort of thing a support person might write off script to buy some time, or looking into it might mean finding someone with better English language skills to tell me what it really says.

In any event, the appropriate next step was to widely publish that there were known vulnerabilities WITHOUT saying exactly what and certainly without giving actual practical examples of how to exploit them.

That would likely have taken care of either possibility above and would have given customers some warning before they get wiped out.

Can we stick to the tech?

[Anonymous Coward]

According to the article, there have been other suicides in the family a few years ago. Let's just discuss tech, and let the personal stay personal.

Re:Can we stick to the tech?

[Anonymous Coward]

But you just mentioned other suicides in the guy's family. You could have made your point without mentioning that.

Just sayin'.

Re:Can we stick to the tech?

[jonaskoelker]

Let's just discuss tech, and let the personal stay personal.

Sure! When is Reiser4 coming out? ;-)

VM Attacks

[barfy]

Had been posited for about 2-3 years now. It is actually amazing that this was such a brutal attack.

The dangers of these attacks had always been stealth related, because it is nearly impossible for the machine to SEE the vm manager. Which makes these things even more dangerous than rootkits.

Re:VM Attacks

[Zocalo]

Actually, this has almost nothing to do with attacking VMs and more to do with the simple fact that LxLab's code is an extremely poorly written piece of crap from a security standpoint that leaves the VM wide open to attack. Having read through the 24 sample exploits when they were first published on milw0rm, the errors are pretty damn fundamental and indicate a complete ignorance of many of the established best practices in secure coding. It was just a matter of time before one of LxLab's users got hit and hit hard; frankly I'm surprised it took so long.

The only thing that I found surprising about the attack on VAserv is that the perpetrator decided to blow away the servers instead of subvert them for sending spam or hosting related websites; 100,000 web hosts have got to be worth quite a few dollars on the right market. While it sucks to be VAserv or one of their customers right now, it's probably better things went this way than the alternative for everyone else. Of course, it's just a matter of time before the next users of LxLabs HyperVM gets hit - if they haven't been already - and at least some of them are almost certainly going to be end up doing something less than legitimate.

Re:VM Attacks

[Anonymous Coward]

Wow you're so far outside your depth on this that it's almost painful to read. The only VM-specific threat vectors are guest-to-host escalations and host-to-guest leakages. These vulnerabilities are occasionally discovered in VM implementations from numerous vendors, including VMWare, Xen, and VirtualBox. There's been no positing "for 2-3 years" because there have been known bugs that were found, reported, and fixed. However, none of that has anything to do with this hack. This was simply an extremely poorly designed and written administration console and provisioning scripts; it had nothing whatsoever to do with the actual virtualization code.

Re:VM Attacks

[stevied]

It looks to me like this system is more of an OS-level v12n solution than a VM, which judging by some of the vulnerabilities (to be fair, I only looked at the first few) might have been its problem. Full-blown v12n might have been less vulnerable here, but as you say if anything did worm its way into a hypervisor or equivalent it would be bloody hard to notice.

Re:VM Attacks

[baKanale]

Of course, it's just a matter of time before the next users of LxLabs HyperVM gets hit...

Any idea what other hosting providers, if any, might use HyperVM?

Re:VM Attacks

[rebel]

I don't see any good solution for VAserv or their users.

Even without the death of the lead HyperVM developer the flaws could not be remedied quickly. There are apparently a lot of flaws and the time needed to fix and test each one will push out a security update for weeks if not months.

On the other hand, VAserv can not simply change to something else. Their infrastructure, experience, and services are all dependent on HyperVM. To rollout something else would take at least 6 months to get right.

Simply bringing everything back as best they can only puts them where they were before the attack - obviously vulnerable.

Re:VM Attacks

[jdoverholt]

I don't know of a list, but I've read that many LxLabs customers are shutting their HyperVM interfaces down until further notice. VaServ is, you can be damned sure of that. Disclosure: I'm a customer of fsckVPS, a brand of VAserv, and I sustained almost total data loss here.

Re:VM Attacks

[neuroscr]

But what's worse than this? I think this was the worst probably case scenario. Sever damage due to poor communication.

Suicide is better than the Bahamas

[Prien715]

While suicide should never be celebrated, there's a certain honor in doing it as a result of professional failure.

As opposed to you know, screwing the company over, taking a huge bonus, and running to the Bahamas (*cough* AIG, Bank of America, Chase, GM, WaMu *cough*)

Re:Suicide is better than the Bahamas

[Anonymous Coward]

troll

Re:Suicide is better than the Bahamas

[ShieldW0lf]

I thought the same thing.

Re:Suicide is better than the Bahamas

[couchslug]

"While suicide should never be celebrated, there's a certain honor in doing it as a result of professional failure."

It can be the ultimate apology. While your post will be modded Troll, other societies see things differently. Seppuku, anyone?

Re:Suicide is better than the Bahamas

[jonaskoelker]

Seppuku, anyone?

Then what do pirates do?

My condolences

[elnyka]

My condolences to Mr. Ligesh's family.

Re:My condolences

[Hyppy]

A good chunk of the rest of his family hanged themselves as well a few years back, it seems. I don't think the whole vulnerability thing was more than just the straw that broke the camel's back.

Re:My condolences

[Anonymous Coward]

So, you're saying his whole family is well-hung.

Re:My condolences

[Anonymous Coward]

No I think that horrible singer was chinese. This is an Indian family we are talking about.

Re:My condolences

[Anonymous Coward]

Gallows humor?

Times of India article on owner

[dleigh]

http://timesofindia.indiatimes.com/Bangalore/Techie-hangs-himself-in-HSR-Layout-/articleshow/4633101.cms

Depressed person with problems kills himself

[hattig]

Sounds like the guy needed some more help than he got to get to grips with his personal situation. Anyway ...

The flaws include SQL injection vulnerabilities and flaws that create a way for hackers to gain file access to files hosted on a vulnerable system.

There is no excuse for SQL Injection vulnerabilities these days. The problem is well known and publicised, the solutions are well documented. This is a problem that is solved by altering how you code, that results in neater code with less errors. If you can't use prepared/parameterised statements and insist on building SQL command strings out of user supplied data, then ... well, err, I can't say "you deserve to hang" in this case can I?

Re:Depressed person with problems kills himself

[Saija]

There is no excuse for SQL Injection vulnerabilities these days.

I just wish that be truth, right now i'm using some "connection db class" in c# made by someone else, wich expects the sql commands to be executed be concatenated strings, no SqlParameters or whatsoever, no, just single and dangerous sql commands concatenateds, and there's no way in hell i could change that class for something better

Re:Depressed person with problems kills himself

[QuoteMstr]

right now i'm using some "connection db class" in c# made by someone else

Don't use crappy libraries you pulled off some web forum then. Always be suspicious of third party libraries and only use the highest-quality ones.

concatenated strings, no SqlParameters or whatsoever, no, just single and dangerous sql commands concatenateds

Yes, this is a shitty API. But it's still no excuse for SQL injection. You can always quote any variable pieces of information before using them to construct the SQL string. You could also just write a small string parser and implement variable substitution yourself. (It'd take less than 50 lines of code.)

If you can't do either of these things, well, you have no business being a programmer.

Re:Depressed person with problems kills himself

[FishWithAHammer]

Of course there is. You just do it. In C# especially, it's not that hard.

Oh? What's that? You have a lot of places it's used? Tough shit. Do it right.

Re:Depressed person with problems kills himself

[Saija]

just a few toughts:

Don't use crappy libraries you pulled off some web forum then. Always be suspicious of third party libraries and only use the highest-quality ones.

sorry buddy, that crappy db connection class was made by some former developer who, right now is some kind of phb, and always insist you use his "wonderful" db connection class, of course i could search and use something better, but that time constraint we always have just don't let me do it, i wish i could, but working even weekends just doesn't let me improve the things the way they are

If you can't do either of these things, well, you have no business being a programmer.

again, time constraint, and the single fact i'm the only developer here(you see why i have to work weekends?), plus some IT support i also had to do, so you see, is not lazyness, there's simply no time to do better or improve the actual things

Re:Depressed person with problems kills himself

[hattig]

I really have to ask why you are using such code, voluntarily, when C#/.NET has LINQ, as well as actual, decent, SQL libraries. You appear to know that it isn't secure, so you should stand up for yourself and get your codebase migrated off of it.

Re:Depressed person with problems kills himself

[Megane]

I just wish that be truth, right now i'm using some "connection db class" in c# made by someone else, which expects the sql commands to be executed be concatenated strings

And I presume you don't have the source code to that? RMS would like to have a few words with you.

Re:Depressed person with problems kills himself

[Anonymous Coward]

I'm sick of hearing excuses like this. Stand up for yourself and when that fails (that is, I strongly suspect the company isn't interested in fixing issues like the one you mentioned), simply quit.

They obviously don't value a good development process, and assuming you are a good developer (or atleast aspires to become one) you are way better off somewhere else.

Re:Depressed person with problems kills himself

[QuoteMstr]

It's enough to make you wish we were real engineers. If an engineer is working on a bridge and his supervisor orders him to use a dangerously weak cable, the engineer has both a moral and legal duty to refuse. The same principle ought to apply to software developers, especially when life and property are at stake.

Re:Depressed person with problems kills himself

[Saija]

sorry for the missing 'h', and yeah, i don't have the source code, only some nasty dll to work with...

Re:Depressed person with problems kills himself

[CorporateSuit]

This is a problem that is solved by altering how you code, that results in cluttering your code with adhoc validations you have to make specifically for SQL injections.

Fixed. I've coded some massive sites that needed protection of SQL injection, JS injections, and other XSS attacks and had to be scalable for millions of users. When half of the code on a form page is validation, (or you're slowing down your code in any way for it) that's not cleaner code - it's bloat. Essential bloat, but bloat nonetheless.

Re:Depressed person with problems kills himself

[kriston]

Can't you just write a wrapper class that sanitizes the inputs for you?
It's not difficult and you protect yourself from that lousy other class.

Re:Depressed person with problems kills himself

[hattig]

Most software development is akin to building a model of the bridge out of straws and pipecleaners sadly. Especially in-house applications.

Re:Depressed person with problems kills himself

[hattig]

You've just broken it because you don't understand that there are better ways to do things (altering how you code), you can only think to bandaid the broken methodology. Change the programming language, or move the validations into an intermediary layer or database itself.

What is nicer (imagine a much larger table than the example), and maybe imagine the former in PHP instead?

String xs = sanitize(x);
String ys = sanitize(y);
String zs = sanitize(z);
String sql = "INSERT INTO foo (x, y, z) VALUES (" + xs + ", " + ys + ", " + zs + ")"
conn.createStatement().executeQuery(sql);

or

String sql = "INSERT INTO foo (x, y, z) VALUES (?, ?, ?);
PreparedStatement ps = conn.prepareStatement(sql);
ps.setString(1, x);
ps.setInt(2, y);
ps.setString(3, z);
int newRows = ps.executeUpdate();

Where are the "adhoc validations" here? They're inside the JDBC library, indeed they're inside the database server for those that support parameterised queries.

Re:Depressed person with problems kills himself

[Siker]

If an engineer is working on a bridge and his supervisor orders him to use a dangerously weak cable, the engineer has both a moral and legal duty to refuse. The same principle ought to apply to software developers, especially when life and property are at stake.

But software is not built that way. Chances are this started out as a small project, at a small company, and then only grew later into something where security was an issue. In your analogy it'd perhaps be like an engineer designing a wooden park bridge, not knowing that in the future somebody would try to lay down an 8 lane highway on it. You wouldn't hold the engineer himself responsible for his work being overextended in a future scenario he did not account for.

So the true problem then is with the supervisor who allowed the project to grow out of reasonable bounds without properly revisiting the foundation.

It may have been genetic

[BadAnalogyGuy]

His sister and mother both committed suicide by hanging 5 years ago. He may have had a genetic propensity towards suicide.

Culturally, Indians have a very heavy emphasis on honor and responsibility. The failure of the software is only the outermost layer of true damage. Each of those compromised VMs is a failure to satisfy a customer at best, and a grave violation of the trust between vendor and customer.

When it comes to suicide, why hanging? It seems like a really hard way to go. Maybe the person wants to suffer to pay back his debts before death.

Re:It may have been genetic

[NeoSkandranon]

Depends on one's access to weapons and forethought really. If it's got to happen RIGHT NOW and there's not a firearm handy hanging might seem like the best idea.

Re:It may have been genetic

[Anonymous Coward]

He may have had a genetic propensity towards suicide.

That would be a very difficult trait to pass to your children. Don't you think?

Re:It may have been genetic

[DNS-and-BIND]

Easy, quick, can make a noose out of the nearest curtain cord, certain (if nobody discovers you for a few minutes).

I can only wish that despicable people from our own culture would show honor. But, all that was beaten out of us and now a man who uses a word like 'honor' in public would be giggled at.

Re:It may have been genetic

[BadAnalogyGuy]

What do you attach the noose to that can support 150+ pounds?

Are you saying this guy is despicable?

Re:It may have been genetic

[fuzzyfuzzyfungus]

Not really. Plenty of people commit suicide in their late 20s or later, which leaves a decent slice of breeding time, depending on how early you start. Particularly with modern social structures(where orphans are incrementally less likely to starve in Dickensian workhouses) you can fairly easily pump out surviving children at greater than replacement rate, even if you are dead by 30.

Also, a "propensity" toward suicide isn't necessarily fatal, depending on life conditions. If you don't run into much serious stress, a tendency to respond badly to stress is largely harmless. If your son gets it and runs into a series of nasty business reversals, it'll bite him.

Re:It may have been genetic

[Rogerborg]

Are you saying this guy is despicable?

Are you saying that the GP is WORSE THAN HITLER?

Re:It may have been genetic

[Anonymous Coward]

It would certainly be possible to pass on the trait if suicide tended to happen around or after the age when one would have children.

And in this case, that is what happened.

His *mother* killed herself... but only after having had and raised at least two children. Both of whom went on to kill themselves.

You would not expect such a genetic defect (trait towards suicide) to be common, given its maladaptive nature, and it is not. That is how genetic defects work.

Re:It may have been genetic

[Anonymous Coward]

Like homosexuality, right?

Re:It may have been genetic

[Anonymous Coward]

Sadly, I've never seen that level of dedication to quality in anything touched by an Indian outsourcing provider. It's always a pile of crap that you spent twice as long overspeccing to make sure they didn't mess up, then whatever came back was so broken that you spent twice as long as it would have taken to do it right the first time trying to fix it. You can't just wipe it and start over because whoever the bright bulb was who insisted on outscourcing to begin with will have a lot of political clout invested in not looking like the weenie they actually are.

Posting anonymously because, well, I'm a coward.. but I speak the truth (as I have seen it).

Re:It may have been genetic

[Spazztastic]

What do you attach the noose to that can support 150+ pounds?

quote>

Knock out the ceiling tile/break away the drywall and tie it to the big beams in the ceiling.

Re:It may have been genetic

[Anonymous Coward]

I use the word "honor" in public, and no one laughs at me, but I don't use it to describe acts like this one. This is just as screwed up a notion of honor as the Japanese have. Killing yourself does not absolve you of anything. It does not help anyone. It is at best a gesture, and at worst simple escapism.

The honorable thing to do would have been to fix the problem in the first place, or build a new version from scratch, or shut down the project and provide a migration path. The honorable thing to do after the disaster would have been to patch the biggest holes as fast as possible while providing a migration path to another product. The thing about responsibility for negligence or idiocy is that it requires messy things like restitution, even if no one is making you do it. Suicide is ridiculously self-serving by comparison.

Re:It may have been genetic

[Anonymous Coward]

Oh, and I'm perfectly accepting of suicide when people are trying to escape pain, boredom, shame, or whatever. I just don't like seeing it confused with honor.

Re:It may have been genetic

[argiedot]

Culturally, Indians have a very heavy emphasis on honor and responsibility...

As far as I know, it doesn't work this way. If his death would have restored to life all those servers, _then_ maybe it would be considered The Right Thing To Do®. However, committing suicide for having failed your customers is neither the norm nor encouraged.

Re:It may have been genetic

[Anonymous Coward]

Culturally, Indians have a very heavy emphasis on honor and responsibility

Each of those compromised VMs is a failure to satisfy a customer at best, and a grave violation of the trust between vendor and customer.

Are you serious? You can't possibly be in the software business if you think that. Or perhaps you had the luck of not dealing with Indian software firms?

Disturbed ?

[Saija]

I think that guy was just disturbed, and the loss of all that info in the 100k sites just increased his illness:
Techie hangs himself in HSR Layout

Neighbours confirmed that Ligesh didn't have many friends and didn't interact with anyone. Often, he'd sleep with the house door open. On his social networking site page, he wrote that his ambition was to kill God and he was an anti-Christ.

Re:Disturbed ?

[Anonymous Coward]

he wrote that his ambition was to kill God

A couple members of an X'th percentile society, where X is close to 100, and percentile obviously refers to their IQ scores, that I had interactions with, suffered from the notion that they where in fact God. Now one could argue that they made these pronouncements purely for the sake of argumentation, but their actions often left one with the distinct impression that they, at least, where True Believers in their religion. Combine the notion that you are God (which I'm not saying Ligesh necessarily suffered from) with the ambition to kill God, and you've got some very depressed individual....

Re:A head found hanged?

[The Slashdot Guy]

You screw a hook into the head, then hang it where you'd like. Try to think these things through in the future.

Damn...

[SalaSSin]

Not only that, but TFA states that his mother and sister had committed suicide too 5 years before.

I can imagine that makes a man wonder...


Still, how can anyone subscribe for a hosting solution without backup?
That's like putting your mission critical servers in a garden shed with holes in the roof.
F*ing stupid.

Re:Damn...

[Chatterton]

That's like putting your mission critical servers in a garden shed with holes in the roof.

What??? It's not a cheap way to get my server water cooled???

Could this explain my high hardware failure?

Re:Damn...

[barq]

Still, how can anyone subscribe for a hosting solution without backup?

Erm, do your own backups?

Suicide?

[pluther]

He killed himself just because of massive failures in his company?

Why can't more CEOs follow his example?

potential upside

[Anonymous Coward]

Hopefully the sites lost were those abandoned blogs, even better if they were active blogs.

Re:potential upside

[Corsix]

One of the things hit was the VPS hosting the wxWidgets SVN repository, though no data appears to have been lost in this case.

Sad

[DoofusOfDeath]

I'm really sad that he hanged himself. Even if he was a total douche-bag (and I have no idea either way), this wasn't a reason for someone to die.

But by killing himself, he likely devastated a amily who loved him.

At the very least, he should have resigned. If he felt the need to make amends, he could have dedicated his remaining life to teaching, serving the poor and oppressed, or generally living a quiet life where he helped the people around him.

For him to judge that his life was such a failure that he had to rob himself and the world of his remaining years seems like a tragic mistake.

Re:Sad

[Anonymous Coward]

But by killing himself, he likely devastated a family who loved him.

That's probably why they decided to hang themselves in advance.

Oblig

[Steauengeglase]

I guess he took the Six Sigma "black belt" literally.

Yeah, I feel guilty for that one.

Re:Oblig

[Anonymous Coward]

Too soon, dude. Too soon.

Re:Oblig

[Anonymous Coward]

Yah, Six Sigma is still too recent a memory

The guys pic

[ultrapenguin]

The guys pic

http://i41.tinypic.com/zjdqgy.jpg

RIP

Re:The guys pic

[Anonymous Coward]

Does his tattoo really say "...fucking idiot"?

Re:The guys pic

[ultrapenguin]

'god is a fucking idiot'
(was covered by another article i saw yesterday, duno if this is mentioned in the current TFA)

Re:The guys pic

[Anonymous Coward]

yeah if I looked like that I would probably hang myself too

Uh Oh

[kenp2002]

The Antichrist has been made manifest!

The Illuminati is now eliminating the few members that participated in the summoning of the Zhug Jung Kai entity. Notice that both Carridine and now this poor man have ben hung to prevent the Ruthi spirit escaping their lungs, damning the Ruthi to eternity until the Zhug Jung Kai consumes them.

With the spawn of evil growing in power it will force the Illuminati to desparate measures. It falls to you adventure to put a stop to this!

Seek out the Oracle of Shando who currently is posing as Steve Jobs. He will not reval his true self unless you posess the Diamond Apple of Agamerrinon. You can find the Apple in possession of the Dark Obtennebator. He serves his dark master Bill Gate and resides in the Valley of Sorrow on the Mountain of Pain in the Cave of Agony beyond the Doors of Eternal Discomfort. He has occasionally also tried to Ebay the Apple but none seems interested in it for $221,134,110 USD.

Go now and save us all from Terrorists, Bad Remakes, and watered down soft core from Cinemax!

Disrespectful

[gubers33]

I think it is quite disturbing with all of the disrespectful comments on this article. I could Mod some of this, but not all of it. The guy obviously hit hard times with death of two family members by suicide and the tanking of his company. It is clear he had depression in his family and was not able to bear all of this hitting him. It is sickening that so many of you think it is a joke.

Re:Disrespectful

[QuoteMstr]

It is sickening that so many of you think it is a joke.

Sickening, but not surprising. Civilization has always been a thin veneer on top of barbarism, and it barely keeps our worst instincts in check. Remove via anonymity the social cues that inhibit these instincts, and we end up with the appalling comments here.

Re:Disrespectful

[SatanicPuppy]

Killing yourself pretty much removes your right to a lot of sympathy. Lot of people are talking about "honor" like killing yourself is the honorable way out, but really it's not. The honorable way out is working in the ruins to try and rectify your mistakes, not quitting when the road gets hard.

Re:Disrespectful

[DoofusOfDeath]

Civilization has always been a thin veneer on top of barbarism, and it barely keeps our worst instincts in check.

Yes, but if you look under the Barbarism, you actually find two layers of humanitarianism.

You don't need a sense of despair; just a good belt sander.

Re:Disrespectful

[LWATCDR]

It does amaze me that so many people on slashdot seem to heartless morons. There is nothing good or funny about this. Sometimes things just gang up on people. The loss of hs family members and now this just might have been too much for him. I hope none of his family
I have to wonder just how many of the people posting have ever lost a love one or even have tried to support a family.

Re:Disrespectful

[Brad Mace]

Some people use humor as a coping mechanism. I suspect the percentage is higher than average on slashdot. Perhaps that's because it's a relatively young crowd that doesn't have much experience with death. That's how it goes though; things that hit close to home seem like serious business, and the sort of things that "happen to someone else" don't. It's also just not possible to get personally invested in every bad thing that happens in the world. With our 24-hour news cycle and world-wide coverage, we'd spend every waking moment grieving. I think humor is used to push back against the tendency to only report on the bad news.

Re:Disrespectful

[Jamie's Nightmare]

Oh, fuck you. Stop being a pompous ass. Some choose to deal with personal tragedy through humor and sarcasm. Your "public" concern over the self induced death of one man amid a universe this complex and incredible is a joke in and of itself.

Re:Disrespectful

[Anonymous Coward]

I despite suicide since it's a cowardly way to get out of your problems.

I don't feel sympathy for someone who has done it. They did it, they deserve it. I'm not trolling, in fact I'm angry that anyone could feel compassion for someone who doesn't care about his own life. It's bullshit, don't waste your life like that, help people who wants to live at least before thinking about suicide!

Disrespectful my ass.

Re:Disrespectful

[david@ecsd.com]

And sometimes when they're not anonymous, they're still douchebags...

Re:Disrespectful

[gad_zuki!]

>Killing yourself pretty much removes your right to a lot of sympathy.

Bullshit. People with mental illness deserve your sympathy. The idea that suicide was some kind of rational selfish response is stupid. Clearly, he had a lot of suffering if he felt he needed to kill himself. These people deserve our sympathy not our disdain. Hopefully, we can teach people, especially young people, that mental illness shouldnt be shameful and if they suspect they have it then they should get treated - not hide it away and have it lead to suicide like this guy.

Re:Disrespectful

[AioKits]

The honorable way out is working in the ruins to try and rectify your mistakes, not quitting when the road gets hard.

I suspect it's much easier to say this when you're not the one having to travel that road. No offense to you is implied by this observation Mr SatanicPuppy, but from a smaller degree of personal experience, it is easier said than done. The depression I entered after my brother's death (sorry, no details for /.) has had some long lasting effects on me, even if it was 11 years, 7 months and 2 days, 15 hours, 30 minutes ago.

Not saying I disagree, but still, easier said than done.

Re:Disrespectful

[east coast]

Actually, I'd rather see someone step down (not nessacerily kill themselves) when they're in above their head instead of floundering around and taking up precious time that might be used to reverse the course of a business gone out of control. Sticking with it when you know you're not up to the task is letting a lot of other people down when you know better.

Re:Disrespectful

[Abreu]

That still doesn't justify the comments you see in YouTube and 4chan

Re:Disrespectful

[melikamp]

People with mental illness deserve your sympathy.

Why? How did a looser and a quitter deserve anything? I think that people who failed and kept trying deserve our sympathy, because they are the ones who provided a good example. Let's just hope that depressed people have good friends who love them for reasons other than developing some HyperVM thingy. I din't know the man and I am not passing up on a good laugh just because he hanged himself. If we could not laugh at people dying, this would be a very sad world.

Re:Disrespectful

[Anonymous Coward]

Exactly. I was going to respond to GP, but the parent post sums it up nicely. Those kinds of comments seem to indicate a complete lack of understanding of clinical depression. Which is probably better for them in the long run, because it seems to me that in order to truly understand depression you pretty much need to go through it, and it's not something I'd wish on anybody.

The trouble with depression is that you honestly believe you are not capable of handling what is in front of you. These beliefs extend into generalizations where you don't believe in a shred of your own abilities or self-worth. It doesn't take much to break the proverbial camel's back.

Try reprogramming those kinds of chemically and psychologically driven beliefs over a short period of time and you'll find you don't get very far. It's not a rational decision that can be reversed with logic and argument. It's not a state of mind. It's a friggin' _condition_, and you've got to monitor it and manage it in order to keep it from taking over.

Maybe I just got trolled, but has the phrase "put yourself in their shoes" outlived its usefulness in colloquial discourse? It's seems too easy to judge these days. Maybe I'm just getting old and crotchety. At least I'm still around to be old and crotchety. I guess I'm one of the lucky ones.

Re:Disrespectful

[SatanicPuppy]

I don't feel he deserves sympathy or disdain. He killed himself; his death was his own desired outcome. Why would I be sympathetic?

And as for disdain, I'd have felt disdain for him right now if he was alive for his epic fuckup. Not much point in feeling it for him when he's dead.

I don't know why you immediately assume it wasn't rational, especially given that there is no evidence in the articles that he had any particular mental issues, other than the fact that he apparently thought he was "an anti-christ" and wanted to "kill god."

People make bad decisions all the time. This guy made plenty of decisions when he was alive that, in retrospect, were bad decisions. But certainly they must have seemed rational to him. As far as you know he made a rational (by his standards) decision to end his life. Hell, clearly he was a theist, so corporeal suicide wouldn't be the end, as far as his beliefs go.

Re:Disrespectful

[fuzzyfuzzyfungus]

I'd argue the contrary position, actually. Most, though not all(Hi sociopaths, please don't kill me!), people typically exhibit a fair degree of empathy in response to visible suffering, unless they have a particular reason not to. However, this empathy is largely instinctive, and depends on direct emotional cues to have a full impact. Distance, literal or psychological, interferes with it pretty strongly. The sense that somebody is a social "other" or enemy does as well.

This case combines both of those pretty strongly. Since nobody reads TFA, most commenters here probably have a 1 paragraph writeup, half of which was about how his companies fuckups caused a major breach, by which to judge his life. That isn't nearly enough to activate all the low-level empathy hooks, unless somebody makes an active attempt at imagination. In addition, he likely falls into the category of "troublingly undercompetent offshore devs" for a lot of people, which is not the most sympathetic category on slashdot.

I'd be strongly inclined to suspect that, in the majority of cases, less civilization would mean more empathy in this guy's case. It would require barbarity to mock the guy to his face, while he is obviously distressed; but it merely requires detachment to make witty comments about a news story that is probably on the 4th page half a world away. Civilization gives us loads of that. Never before have we known about so many people that we don't know.

Re:Disrespectful

[SatanicPuppy]

I'm sorry for your loss.

I had my father die in front of me. It was...graphic. I pulled the plug on my mother's life support. I lived through a number of abusive step parents. I actually got shot by one of them...Now that's fucking abusive!

I got married, and a year after I married my wife, her father died. And then her mother not even a year later. Neither one was especially clean.

I'm like the fucking angel of death. It's not even funny.

And I still think life can be sweet. It's a perspective thing. There is nothing more fragile than life. Death? Death is a cowards way out. All the people, all the fucking people who would kill for just one...more...moment. And I'm supposed to be sympathetic with someone who actually had a choice? I don't think so.

Re:Disrespectful

[Anonymous Coward]

Some choose to deal with personal tragedy through humor and sarcasm.

I didn't realize that all these people here on Slashdot knew Mr. Ligesh personally.

Re:Disrespectful

[Anonymous Coward]

Civilization has always been a thin veneer on top of barbarism, and it barely keeps our worst instincts in check.

Yes, but if you look under the Barbarism, you actually find two layers of humanitarianism.

You don't need a sense of despair; just a good belt sander.

I just ripped up my barbarism and all I found was the original hardwood. Thanks a lot, jerk.

Re:Disrespectful

[Xmastrspy]

Killing yourself is chicken shit. Your dead, and you have only hurt the ones that care for you.

From your comment, it seems that you are someone that has never been a victim of someone close to you committing suicide.

I am, and I can tell you that suicide is the most selfish act that a person can commit. The pain that it causes for years to come to your loved ones it not only selfish but preventable. I can understand that if you are mentally handicapped, but you can't go a day without seeing some kind of depression commercials, add, billboard offering to get you help. From my experience, family and friends can tell when you are upset and offer to help as well.

Suicide is the easy way out, and I have 0 respect for anyone that has committed suicide.

Re:Disrespectful

[AioKits]

Let's try not to get into cock waving here over who has experienced the most tragedy and death please. I only offered my experience as a point of reference for myself. I take no pride in that I can survive such an...experience. I can't claim to know all circumstances for all people. I admire (for what little my admiration goes for these days) you were able to survive the previously mentioned situations. Don't be sympathetic because of his choice, be sympathetic because he is dead. If not for him, then for those around him.

Re:Disrespectful

[Anonymous Coward]

From what I gather about his personality, I have a lot of sympathy for him.

On his social networking site page, he wrote that his ambition was to kill God and he was an anti-Christ.

He went for it. Hope he kills him good.

Re:Disrespectful

[Anonymous Coward]

Not everyone that kills themselves or burries their person in a little ball of self-pity is "mentally-ill". Too many people grow up to be weak, spoiled, and un motivated brats that makes themselves victims and buy into every theory shrinks dish out. I've lost two homes, been let-go 3 times...and I would never consider suicide an option. WTF....how does that solve anything? Also...can the mods not be so sensitive and let some of these opinins through? kthnxbye

Re:Disrespectful

[SatanicPuppy]

I just wanted you to know where I was coming from before I disagreed with you.

The funny thing about it is how people are affected differently by different levels of emotional trauma. I've known people whose whole lives were shattered by their parents going through what I'd consider to be a reasonably amicable divorce.

So trauma is weird. Some people shake it off, other people...not so much. I'm always sympathetic with people who can't take it. I get that.

I'm not really sympathetic with people who dish it out, however. I don't know if this guy has a family or not. He was pretty young, around the age I was when I had my first kid. If he did have a family, I have nothing but contempt for him. If he was having trouble getting over his family members committing suicide, then what possible fucking rationale could he have passing that on to the rest of his family?

Gotta feel bad for his fricking father: that guy had his wife and two of his kids kill themselves. Of course, who's to say that's not misplaced sympathy? The guy could be the reason they all offed themselves.

I don't know. I guess, in my head, I view suicide when you have loved ones and/or dependents to be SO prickish, that frankly, they're probably better off without him. If it were my brother/son/father, I'd be so fucking angry...Not. Even. Words. I can't imagine the level of pissed off I'd feel if my kid offed himself after something stupid like a business crash...THAT?! That is worth your life? Jesus.

Hackers = murderers?

[Anonymous Coward]

I'm sure this guy was already unstable but can't help but believe that the attacks were what finally pushed him over the edge. Legally this would be difficult to prosecute as murder but morally those little script kiddies who so impressed with themselves should consider the unintended consequences of their actions. We are all responsible for our own actions (suicide) but should be equally concerned with how our actions affect others (hackers).

Re:Hackers = murderers?

[FishWithAHammer]

Oh, please. They had sufficient time for a relatively simple exploit to be patched. This guy stalled them with vague non-responses and shit never got done, so milw0rm posted it publicly. That's what security folks do. It's not their fault that he decided that fixing the software he put his reputation behind wasn't worth it.

Re:Hackers = murderers?

[iamhigh]

You got a point there, AC. IF this were US based, they might be able to prosecute the hackers for murder. We were able to prosecute some lady for hacking when she harassed a little girl to the point of suicide.

Re:Hackers = murderers?

[bluefoxlucid]

It depends. There is a great thrill to be had in depriving someone from something they can never have back, especially if you can con them into giving it up willingly. For example, virginity. Some of us just happen to not extend that as far as their life; others simply don't care, or have Nelsonism (HA ha!).

Re:Hackers = murderers?

[Anonymous Coward]

False information in a profile is now considered hacking? Well then everybody on slashdot is guilty of hacking!

Re:Hackers = murderers?

[Anonymous Coward]

I was wondering what milw0rm would get from publishing it openly? It could give out information on a as-needed basis. Example: If LxLabs didn't fix it on time but a user wanted to, milw0rm could announce that they've found some exploits and they could give it out with a three way verification.

But publishing it openly and giving it to script kiddies to play with is totally irresponsible. For that matter, vulnerability notification blackmailing is something that nobody is prosecuting under the law today.

Who else?

[gehrehmee]

Any idea what other cheap web serving companies are using this tech?

Re:Who else?

[FishWithAHammer]

Many/most (cheapvps, fsckvps, etc.) are reselling VAserv stuff, so a lot have been hit hard.

If they're using HyperVM, stay the hell away.

Re:Who else?

[Anonymous Coward]

It's not HyperVM that's the problem, it's the management software they developed:

http://lxlabs.com/software/kloxo/

That has the 24+ vulnerabilities, and of course, once they had root on the management servers, they had the ability to wreck a ton of VMs.

As far as all the parties involved are saying, HyperVM had nothing whatsoever to do with the vulnerability and they could have been using Xen hypervisors or a half dozen other solutions and the result would have been the same.

Re:Who else?

[Anonymous Coward]

Actually I don't think they are reselling, all these are separate brands of the same company.

What you say is true though, if anyone is using this software, they are vulnerable right now (unless they disable access to hypervm).

Re:Who else?

[mdm42]

As someone who has been hosting with VAServ for years, now, I was one of the lucky ones! Not a scratch nor a dent... uptime still ticking along at 346 days.

VAServ have indicated their intention to move to a different v12n platform asap. No real surprise, there. It also looks like BlueSquare Data (the DC's operations arm) will be taking over at least some of the VAServ operations.

Say what you like about the choice of v12n, security, lack of defense-in-depth, etc., VAServ have kept customers fully informed, blow by blow, server by server, and kudos, too, to BlueSquare for committing significant resources to helping sort out the mess.

It's already been noted above, somewhere, but mystified me, too: Why the hell did the perpetrator just wipe out servers and not subvert them to some other, more more profitable/odious purpose? The whole attack makes very little sense, unless you assume that the attacker has the mentality of a spotty 13-year-old.

I don't know if its been said yet...

[dyingtolive]

but I gotta respect this guy's dedication to the job. If we could get American CEO's to take this level of responsibility when their companies completely faceplant, the world would be a better place.

Re:I don't know if its been said yet...

[dyingtolive]

People are in strange moods today. Here I am expecting offtopic/funny/maybe redundant, and I get flamebait/interesting. Go figure.

Re:I don't know if its been said yet...

[jdoverholt]

My best guess on the flamebait would be that somebody thought you were talking about Ligesh instead of Rus.

Brilliant Idea!

[__aanmys7397]

Why don't you round them up, put identifying badges on them, and then try killing them yourse-
Oh wait.

Godwin's law, dammit.

Re:Completely tasteless

[Anonymous Coward]

Thank God there's people like you to uphold our high standards of taste here on Slashdot by inviting abusive moderation.

You may have noticed there isn't a "tasteless" mod. Well, I'm here to enlighten you this is primarily because they couldn't agree whether it should be -1 or +1.

A rope?

[Tiber]

Was he in a closet? Was it wrapped around his neck and genitals which was later covered up with the phrase "his body"?

I think I see a serial killer starting to emerge.

Woah.

[Anonymous Coward]

Can you imagine if a Microsoft executive hung himself every time a vulnerability was discovered in Windows that led to data loss?

Re:Woah.

[spartacus_prime]

Are there enough chairs left in the building to use?

Re:Woah.

[Anonymous Coward]

Ha ha! A chair one! Tell me another one, funny man.

Re:Woah.

[cbraescu1]

Such image might be a never-ending source of orgasms for lots of techies, AFAIK

Re:Woah.

[Anonymous Coward]

Apple would have no competition

I'm a VAserv customer

[barq]

Request: Please no one post links to the VAserv status page. The last thing we need is to /. them right now. Customers have been emailed the URL and we are the only ones who really need to see it (plus it isn't very interesting).

VAserv have emailed customers to say they will be taken over by BlueSquare (where they do most of their hosting anyway). Probably the best option given the scale of the attack.

I've got one apparently deleted VPS and one still running. The whole situation is terribly frustrating. However I don't think the lack of information coming from VAserv is due to a lack of effort on their part.

Re:I'm a VAserv customer

[Anonymous Coward]

Here is the status page, for anyone who is interested.

Re:I'm a VAserv customer

[Anonymous Coward]

You got what you paid for. Next time don't choose bottom of the barrel hosting.

Re:I'm a VAserv customer

[laszlomolnar]

Today, 4 days after the hacker attak my VPS is still offline. Is there no lack of effort? Okay, Vaserve not able to restore my old VPS, but I really need my new VPS now. Two days ago they told "We will aim to have all new servers up within 6 hours at the latest, of course providing no new issues occur.". Now, two days after this message, where is my VPS up? Or new issues occured? Vaserve status page is not freshed.

Re:Completely tasteless

[QuoteMstr]

The purpose of the site is to talk about science and technology, not to see how creatively you can offend people. These wretched posts we're talking about contribute nothing productive and should be hidden.

respect for the dead

[circletimessquare]

is not appreciated by those who think they are immortal

ie, teenaged idiots

that the world is full of teenaged idiots (most of whom are not chronologically actual teenagers) should not surprise you or disappoint you

just a simple ugliness of life you need to learn to accept, like people who throw their garbage on the ground or talk loudly at movies, its another example of the tragedy of the commons

sure you could declare a high holy moral crusade against boorish insensitivity, but its like trying to stop the sun from rising and setting: a lot of people are ignorant assholes, status permanent, and even those you might actually be able to educate are quickly replaced by more morons

Virtualization Death or Glory

[moon3]

As if cramming 50 VMs into one rack has not been sinful enough.

The glory part? You charge 1 VM server for about $40 a month.

Re:Virtualization Death or Glory

[Anonymous Coward]

You're not taking into account that VMs that do cost $40/mo are fully managed. And I highly doubt there're 50 VMs per machine, otherwise you'll see your IO wait times skyrocket.

Prosecutions would be a start :-)

[Anonymous Coward]

n/t

what security folks do

[Gary W. Longsine]

"Oh, please. They had sufficient time for a relatively simple exploit to be patched. This guy stalled them with vague non-responses and shit never got done, so milw0rm posted it publicly. That's what security folks do. It's not their fault that he decided that fixing the software he put his reputation behind wasn't worth it."

Well, not exactly. There is a raging debate over whether this is an appropriate tactic, and this incident will go down in the security text books as an example of why the debate exists. Opposite your opinion is something like, "That's what publicity seeking sociopathic nerds, masquerading as [security folk] do."

There is a fundamental tension between wanting to know if a system you own is vulnerable to some defect, and wanting to keep the exploit code out of the hands of The Bad Guys(TM). In this case, however, it seems pretty clear that simply knowing the name of the product (not even the version) was enough, exploit code wasn't required (as it sometimes is when scanning large numbers of systems that might be at indeterminate patch levels, for example).

There are quite a few actions one could take between "notify the vendor" and "release exploit code" which appear to have been skipped. That's irresponsible, not, "what security folks do".

Frankly, I don't understand how organizations or consultants who do this kind of thing manage to stay in business. If you were a big company with a bunch of interlocking IT systems and limited resources, would you hire someone who had a track record of publishing exploit code before patches were available? Suppose this consultant found some issues, which your organization couldn't respond to as quickly as you would like? Does that consultant become a risk to you now, simply because you didn't fix something in a manner timely enough to suit them? How do you know they wouldn't publish details of your vulnerabilities, because some snot nose punk with an inflated sense of self-righteousness thought you were ignoring him?

I don't operate that way, and neither do any of the fine security consultants who work for me or with me. I work discretely with my clients until they get their problems fixed. That sometimes means doing a lot more work than *should* be required to get the attention of a vendor. However, it has never yet meant publishing exploit code prior to patch availability.

Re:what security folks do

[Todd Knarr]

There is a fundamental tension between wanting to know if a system you own is vulnerable to some defect, and wanting to keep the exploit code out of the hands of The Bad Guys(TM).

I've never thought there was any tension: if I know about the vulnerability, track record says the bad guys already have the exploit code. The only tension is between giving enough information to the affected parties to let them confirm that it really is a vulnerability and I'm not just blowing smoke, or not giving them enough information and letting the vendor convince them I'm mistaken or lying and they have nothing to worry about. For myself, I want all the details. That way I don't have to trust some security researcher I've never heard of before, I can check things myself. And even if a patch isn't available, if I know the vulnerability exists I can fix it. The fix may involve closing down services or changing software, but a short-term fix almost always exists.

My experience has been that software companies will not even admit the problem exists, let alone put effort into a fix, until after working code demonstrating the exploit, or at least sufficient detail to let anyone verify that the exploit works, is made so public that the company can't handwave it away. They have too consistent a track record for me to think otherwise. The sword of public disclosure hanging over their heads is the only thing motivating them to fix the problems, and since I don't like having my systems vulnerable I have no choice but to resist anything that takes that sword away. It's my systems at risk, after all.

Re:what security folks do

[FishWithAHammer]

If you know about an exploit, the black hats out there already do. You're already behind. A public post adds no new vulnerability and gets the whip across a vendor's ass to get their code fixed.

Re:what security folks do

[neuroscr]

I agree.

Re:what security folks do

[Gary W. Longsine]

"track record says the bad guys already have the exploit code"

This is "popular wisdom". However, popular wisdom isn't providing a sufficiently complete analysis of the data. The best public information about this comes from the history of worm exploits. It's not at all clear that exploits are always known by the bad guys first. In fact, there have been quite a few incidents which appeared to be cases of bad guys racing to create an egg and drop it into a pre-canned bit of malware. The starting gun has often appeared to be the first public notice about a type of exploit in a particular part of a product. When exploit code was published, the defensive team usually lost the race.

Re:what security folks do

[Todd Knarr]

One flaw in that analysis: typically in that case people only start looking for evidence of the exploit being used after the public disclosure happens. After all, nobody knew to look for that evidence before the announcement because nobody knew there was anything there to look for. Definitely you're going to see some groups of bad guys racing to add a newly-announced exploit to their malware packages. There's always groups who find it easier to wait for somebody else to do the hard work. But my experience has been that those aren't all the groups of bad guys out there, and few people bother going back through the logs (or even have the logs) to find out if the exploit was in use before the announcement.

Wow. Nice crowd.

[EddyPearson]

Some rather unpleasant comments coming off of you lot.

The poor chap sounds like he'd had a bad decade, and this just topped it off.

When your business collapses overnight (which is what happened here), you're facing god knows how many lawsuits (which is what would have happened here) and the people you'd turn to for support are dead... Well, I'd imagine what follows are some rather sobering thoughts.

My heart goes out to his remaining family, and those of you modded "Funny" should go gargle some engine coolant.

Re:Wow. Nice crowd.

[Anonymous Coward]

Hi. Welcome to the internet. You must be new here.

They comitted suicide...

[kmike]

five years ago, not a few months.

Is this the link you were talkin about?

[Anonymous Coward]

http://www.vaserv.com/

Because we can't really be sure if it is this one or some other link like these:

http://www.vaserv.com/index1.html
http://www.vaserv.com/index2.html
http://support.vaserv.com/

Can't really be sure... keep hitting the refresh but nothing changes.

You insensitive clod...

[denzacar]

He WAS David Carradine!

Re:Completely tasteless

[Anonymous Coward]

I generally agree, but then you'd have to hide almost every funny-moderated post on here; they're mostly off-topic, too. It would seem off-topic humor is alright. The OP's attempt was arguably very much on topic, if not very funny.

The thing that makes it bad in this special case seems to be its offensiveness, which just isn't a criterion. Neither in attempts at insight nor information nor, like here, humor.

Summary of Vunerabilities

[BrittanyGites]

Summary from http://www.milw0rm.com/exploits/8880 seems pretty serious but quite difficult to fix all of them in 2 weeks.

      Timeline :

      05/21/2009 - sent initial email to vendor with a link to a private
                                resource for viewing various kloxo hiab575
                                vulnerability info
      05/23/2009 - received the following: "Thanks for the info. I will
                                review this and let you know." (no signature)
      05/30/2009 - sent an email asking if there were any updates
      06/01/2009 - received the following: "Sorry for the delay. I am
                                currently looking into this, and will reply in a couple
                                of hours time." (no signature)
      06/04/2009 - nothing heard from vendor, and the private resource
                                containing the vulnerability info still does not
                                appear to have been accessed

      2 weeks have passed since the initial notification. Vendor appears
      uninterested.

      ISSUE 1 - uid/gid reuse
      ISSUE 2 - unprivileged port use
      ISSUE 3 - default passwords
      ISSUE 4 - useradd string in the process list
      ISSUE 5 - XSS
      ISSUE 6 - remotely create partially user controlled file names
                            and directories. Locally append uncontrolled data to
                            any file
      ISSUE 7 - local users can take control of any file or directory
      ISSUE 8 - local users can take control of any file or directory
      ISSUE 9 - local users can overwrite any file on the box
      ISSUE 10 - yet another symlink attack for local users
      ISSUE 11 - metachar injection, local command execution as root
      ISSUE 12 - web stats world readable password hashes
      ISSUE 13 - local users can overwrite any file on the box
      ISSUE 14 - metachar injection, local command execution as root
      ISSUE 15 - remotely block any - or every - IP addr in hosts.deny
      ISSUE 16 - remote CPU and mem usage DoS
      ISSUE 17 - local users can truncate and control any file
      ISSUE 18 - just 2 more symlinks to own any file on the box
      ISSUE 19 - file manager, view and edit any file
      ISSUE 20 - file manager PT II
      ISSUE 21 - file manager PT III
      ISSUE 22 - local user symlink attack
      ISSUE 23 - local user symlink attack (last one)
      ISSUE 24 - sql injection in the "Forgot Password" form

Re:Summary of Vunerabilities

[Anonymous Coward]

Although other comments have already said essentially this, seeing this list has me convinced: milw0rm is an asshole, and this is just way too short of a unilateral deadline that he imposed. He's obviously either a teenager or socially under-developed, as he has no patience and was willing to screw tons of people over because he wasn't getting enough attention. I don't think a lawsuit would be won against him, but I think he deserves to have to pay to defend himself in court. (Actually, people explaining to him why what he did was wrong and giving him a good slap upside the head would be better -- but that's not a legal solution.)

Re:Summary of Vunerabilities

[Anonymous Coward]

Summary from http://www.milw0rm.com/exploits/8880 [milw0rm.com] seems pretty serious but quite difficult to fix all of them in 2 weeks.

It wouldn't have killed them to at least look at the details during those two weeks.

Re:Summary of Vunerabilities

[Todd Knarr]

2 weeks to fix, yes it's short. 2 weeks to get the detailed information, review it, confirm whether or not the problems actually exist and respond to the submitter? That should be eminently doable. It's not like they have to find the vulnerabilities and figure out how to fix them, just determine whether the techniques given work as described. Speaking as a professional developer myself, if they can't do that in 2 weeks they shouldn't be writing software for use by others in the first place. Hells, my boss starts bugging me if it takes me more than 2 hours.

Re:Summary of Vunerabilities

[NotQuiteInsane]

I suspect the main issue was more that they didn't even bother to download the exploit data while it was still private, even to take a peek for curiosity's sake:

06/04/2009 - nothing heard from vendor, and the private resource containing the vulnerability info still does not appear to have been accessed

It doesn't take two WEEKS to grab a text file off a HTTP server and have a quick skim through it. The problem wasn't that they were trying to fix it, it was that they didn't WANT to fix it, and were probably hoping that they could make the problem go away simply by ignoring the security bod. The "Ostrich" solution, in other words.

(Although ostriches don't actually bury their heads in the sand, but that's OT for this thread...)

Re:Summary of Vunerabilities

[decrypted08]

Summary from http://www.milw0rm.com/exploits/8880 seems pretty serious but quite difficult to fix all of them in 2 weeks.

Timeline :

05/21/2009 - sent initial email to vendor with a link to a private resource for viewing various kloxo hiab575 vulnerability info 05/23/2009 - received the following: "Thanks for the info. I will review this and let you know." (no signature) 05/30/2009 - sent an email asking if there were any updates 06/01/2009 - received the following: "Sorry for the delay. I am currently looking into this, and will reply in a couple of hours time." (no signature) 06/04/2009 - nothing heard from vendor, and the private resource containing the vulnerability info still does not appear to have been accessed

2 weeks have passed since the initial notification. Vendor appears uninterested.

ISSUE 1 - uid/gid reuse ISSUE 2 - unprivileged port use ISSUE 3 - default passwords ISSUE 4 - useradd string in the process list ISSUE 5 - XSS ISSUE 6 - remotely create partially user controlled file names and directories. Locally append uncontrolled data to any file ISSUE 7 - local users can take control of any file or directory ISSUE 8 - local users can take control of any file or directory ISSUE 9 - local users can overwrite any file on the box ISSUE 10 - yet another symlink attack for local users ISSUE 11 - metachar injection, local command execution as root ISSUE 12 - web stats world readable password hashes ISSUE 13 - local users can overwrite any file on the box ISSUE 14 - metachar injection, local command execution as root ISSUE 15 - remotely block any - or every - IP addr in hosts.deny ISSUE 16 - remote CPU and mem usage DoS ISSUE 17 - local users can truncate and control any file ISSUE 18 - just 2 more symlinks to own any file on the box ISSUE 19 - file manager, view and edit any file ISSUE 20 - file manager PT II ISSUE 21 - file manager PT III ISSUE 22 - local user symlink attack ISSUE 23 - local user symlink attack (last one) ISSUE 24 - sql injection in the "Forgot Password" form

LMAO! can you say botnet material? That network was like a hackers playground.

indescribably sad

[Presto Vivace]

very sad story, very sorry to hear about your brother.

Re:indescribably sad

[CrossChris]

"Hanged" is the correct word. Very sad all the same...

TO ALL Re:Well

[courteaudotbiz]

Yes, I meant hanged. Sorry, english is not my first language.

Re:TO ALL Re:Well

[Anonymous Coward]

It's okay. Pretty much everyone I know is a native English speaker and none of them (including myself) get that right consistently.

Re:TO ALL Re:Well

[Anonymous Coward]

Yes, I meant hanged. Sorry, English is not my first language.

There, partially fixed that for you.

Re:TO ALL Re:Well

[Ihmhi]

In America, saying someone is hung has a different meaning than suicide. d:

Re:TO ALL Re:Well

[collinstocks]

usul@SietchTabr:~$ dict hung

5 definitions found

From The Collaborative International Dictionary of English v.0.48 [gcide]:

    Hang \Hang\ (h[a^]ng), v. t. [imp. & p. p. {Hanged} (h[a^]ngd)

          or {Hung} (h[u^]ng); p. pr. & vb. n. {Hanging}.

          Usage: The use of hanged is preferable to that of hung, when

                        reference is had to death or execution by suspension,

                        and it is also more common.] [OE. hangen, hongien, v.

                        t. & i., AS. hangian, v. i., fr. h[=o]n, v. t. (imp.

                        heng, p. p. hongen); akin to OS. hang[=o]n, v. i., D.

                        hangen, v. t. & i., G. hangen, v. i, h[aum]ngen, v.

                        t., Icel. hanga, v. i., Goth. h[=a]han, v. t. (imp.

                        ha['i]hah), h[=a]han, v. i. (imp. hahaida), and perh.

                        to L. cunctari to delay. [root]37. ]

          1. To suspend; to fasten to some elevated point without

                support from below; -- often used with up or out; as, to

                hang a coat on a hook; to hang up a sign; to hang out a

                banner.

                [1913 Webster]

...[definitions continue]...

Emphasis mine. It appears as though our grammar nazis, in addition to being tactless and unsympathetic, are also unaware that this "rule" in English is merely a suggestion, and not an actual rule.

Hey Ballmer!

[PPH]

Read TFA!

Tragic

[jd]

I've known relations who have opted for suicide, or who have been hospitalized to prevent them. None as close as immediate family, so I can't begin to understand the pain, but in my own way I can dimly see.

One thing that makes this sort of thing doubly painful is that the sorts of minds that can consider suicide a real possibility are often very very close (and sometimes the same) as the minds that are brilliant.

We talk of genius and madness being a razor's edge away from each other, not because it is poetic but because it's true. But you don't have to be a genius to be that razor's edge away from self-destruction. You only have to have a similar biochemistry and/or neurology. There are dozens of conditions linked both to creative talent and self-harm.

Of course, not all suicides are for that reason. Utter despair (which I guess is still biochemical, but it's not a permanent condition) is another reason. There are doubtless many others.

I guess this sort of intellectualizing of suicide is my own way of dealing with the pain I have, for all that it's nothing compared to that of those close to such victims. So long as I intellectualize it, I can imagine that there will someday be solutions which help such people and prevent such tragedies happening.

Re:Tragic

[ckaminski]

Yes, it's called "Getting Laid on a Regular Basis".

    Tends to wipe that depression and self-destructive instinct right out of you.

Re:Tragic

[jd]

Hmmm. Now can you come up with a solution that geeks can actually use in the real world?

Re:Tragic

[Clay Pigeon -TPF-VS-]

female geeks do exist.

Re:Tragic

[jd]

I require experimental evidence of this. Send me a dozen for testing purposes.

Re:Tragic

[fugue]

You're trying to cure your loneliness by surrounding yourself with friends! How's that ever going to work? --Jane, "Coupling"

I thought that was very insightful, even though it's probably designed to sound silly. Interacting with others (sexually or otherwise) is just a band-aid; it can be helpful for jumpstarting self-esteem, but by itself isn't going to do much for you if you're not at peace with yourself.

Re:Tragic

[Eivind Eklund]

There are getting-laid-geeks. They mostly hang out at http://www.fastseduction.com/ (or used to, anyway - I've not been tracking that community for a few years.)

Eivind, living with his fiancee and getting married in September.

Re:Tragic

[NoobixCube]

Night clubs. The girls that go to night clubs seldom know what a neckbeard is; at least around here, anyway. If your neckbeard is short, you can pass it off as "rugged good looks". Worked for me, anyway, and I'm the furthest thing from rugged, and I have the kind of confidence in my looks that would lead to eating and exercising disorders (like gym memberships!) in anyone who cared.

Re:Tragic

[Oldav]

I lost my closest freind, who was a super smart guy, 20 odd years ago. He was a defence dept researcher, and brilliant programmer and musician.(How many people get a navy ship to play with for their projects) At only 25 he could not snap out of the life loop he was in. The effects of his actions continue right up to now, for all his friends. Suicide is very common in weapons researchers sadly. It is incredibly sad when we lose someone both brilliant and modest.

Re:Tragic

[WuphonsReach]

There are also two sides to depression. Externally influenced, triggered by stressors such as job loss, deaths in the family / community / circle of friends, or other major life changing events. Then there's the internal side, where the depressed individual can't stop focusing on every bad thing that they've done, said, chosen, etc.

External events come and go, but can be very overwhelming in the short-term. The internal side tends to be more chronic and permanent as the individual builds up more and more negative experiences (and pretty much ignores anything positive that happens, or discounts it).

For a chronic sufferer, we're talking sleepless nights where you lay awake as your mind chases down all of the bad memories. All of those regrets that you've ever had ("why did I do that", "why did I say that") circle and circle around your head for hours on end. Now, it's normal to have regret and feel sadness, but it's not normal to dwell on a mistake for weeks and months at a time, night after night. Even when you recognize the pattern and apply coping skills learned in therapy, it can be a bit like putting a finger in a leaky dike.

Eventually, things spiral downwards. Sometimes accelerated by outside influences such as those mentioned above. You can have loss of focus, difficulty doing simple things (everything seems like a big production, so you procrastinate), job performance plummets, and you often feel like you're living behind a fog. At that point, often you start to experience a real pain. Sorta like stress pain, but very much a constant pain that you try different things to get away from (sleep, alcohol, drugs, sex, gambling, risk taking).

At the end of that cycle, I found myself curled up on the floor in my living room, middle of the day, just wishing that the pain would stop. At that point, you're tired of it all, and pretty much just want it to end. My red flag was researching suicide methods online, looking for a sure-kill method. The next morning I woke up (without trying anything) and went to the doctor's office to get help.

Chronic long-term depression sucks donkey balls. It was a wonderful day when the medications and therapy (to learn good coping skills) started working. Every month, I'd go back to the doctor and realize that I felt twice as good as the previous month, which felt twice as good as the month before that.

In fact, I can easily tell when I've missed a few days of medication, because I find myself laying awake at night, once again thinking about all the stupid things that I've done in the past rather then looking forward. The meds don't make me "happy", they just bring me closer to "normal" where I can deal with things and don't feel overwhelmed.

Re:Tragic

[Anonymous Coward]

Yes, it's called "Getting Laid on a Regular Basis" tends to wipe that depression and self-destructive instinct right out of you.

I wish that were true :(

Re:Completely tasteless

[daveime]

I'd have thought the primary purpose of *any* individual article is to stay on topic, lest it become a free-for-all or nonsense.

As the topic in question here included "Head of LxLabs found hanged", I don't see any problem in discussing it, and apparently neither did the author.

But, hey, you obviously know better than everyone ... let me guess, you're Rob's mother ?

Translation

[Anonymous Coward]

Let me rephrase what you just said:

    Death is not funny.

    Anyone who thinks it is should go die.

That about sum it up?

Re:Translation

[EddyPearson]

Mod parent up + 1 Funny.

Chief?

[Anonymous Coward]

The discovery of 24 security vulnerabilities may have contributed to the death of the chief of LxLabs.

The chief? What? He no see-um vulnerabilities? His tribe name-um new chief yet?

Heartfelt condolences

[hesaigo999ca]

My condolences to his family, and the company....this is a sad tragic event.

maybe sympathy feeds their illness

[circletimessquare]

i knew a chick in high school who tried to commit suicide a couple of times. each time there was an outpouring of attention and concern, that would fade, then she would try to kill herself again. eventually, she succeeded

there is a such a thing as munchausen syndrome, where people seek sympathy by faking a medical condition

http://en.wikipedia.org/wiki/Munchausen_syndrome

i think the constellation of reasons people commit suicide is a lot broader than munchausen syndrome, but i think there are a lot of similiarities in a large range of reasons that involve this sort of sick seeking of attention, this idea that putting yourself in jeopardy is the way you obtain love from the people around you. suicide is essentially an ultimate form of narcissism, however faulty the circuits that lead to that consuming narcissism, that's what suicide essentially is. some are organic failings, some are personality failings

the instinct of the poster you are responding too, however insensitively arrived at, could actually more helpful than your approach. a lot of personality and psychological problems that we all have, right up to and including outright mental illness, are made worse by sympathy

"tough love", outright hostility and anger, might be a more appropriate external stimulus for a lot of mental conditions, including a lot of suicidal behavior. not all of it of course. and this "tough love" should be motivated by higher nobility than just pure outright disdain, but it is often said that those who mean the best often do the worst damage, and in the case of suicidal people and sympathy, you may actually be looking at the ultimate culmination of that little bit of pop wisdom. that sympathy for them at the wrong set of psychological conditions created their suicidal tendencies in the first place

BACKUPS???

[Anonymous Coward]

I'm having a hard time understanding why this wasn't recoverable. Some would say the only good feature of running a VM is statefull snapshots.
Of all the servers i run the only ones that are running in VM's are because the client wanted to be able to snapshot the whole deal while running as often as hourly so recovery was as simple as resuming an earlier backup snapshot. To me this is one of the only good things about VM's and in their instance it was worth the performance issues.

Were there no backup's? Someone was running over 100,000 VM's and not even a weekly backup? I find this odd.

Re:BACKUPS???

[Anonymous Coward]

They have backups at least of some of the servers (how else would they be restoring the data). However, since the software is still vulnerable, the restored servers can be formatted again at any time.

Zombies

[Zancarius]

How does a genetic predisposition for suicide propagate...?

Maybe zombies can procreate!

Wouldn't that bring a whole new twist?

hypervisor/virtualization?

[TheLink]

But is a hypervisor or virtualization really involved?

Seems to me that the software involved was some sort of web hosting software.

Which to me is rather different from the vmware, virtualbox, xen sort of stuff.

An exploit in those would be a bit more interesting (though not unexpected).

Whereas an exploit in some random PHP web hosting software is about as surprising as an exploit in Yet Another PHP Bulletin Board.

The guy hanging himself is noteworthy though.

Re:Completely tasteless

[Anonymous Coward]

No one gives a shit what you think, mall cop.

Shut up.

[Anonymous Coward]

Maybe you're only interested in the technical, but many /.ers are interested in the personal and social aspects of this story. You can tell, because they are discussing it. If you don't want to comment on that, don't. If you don't want to read about it, don't. People mod you insightful, but what insight have you brought to the table? You've basically walked into a conversation that you aren't interested in, and told everyone to shut up, without adding anything relevant . You must be great at parties.

hi you're a callous douchebag

[BitterAndDrunk]

It's not called that

To borrow a hackneyed cliche: "Sex is like air, it's only a big deal if you're not getting any"

regular sex does little to cure depression.
More likely, the depressed individual will reach for any sort of escape (sex, drugs, alcohol, other) to alleviate said depression.

Mostly it doesn't work.

Re:hi you're a callous douchebag

[turbidostato]

"More likely, the depressed individual will reach for any sort of escape (sex, drugs, alcohol, other) to alleviate said depression. "

So you don't think there's any difference between looking for such a escape either on "sex, drugs and alcohol" or "suicide"?

working at mcdonalds

[Anonymous Coward]

uhm you might not be able to buy food or housing on 7 dollars an hour

That choice is the point

[Anonymous Coward]

You chose the obligations. You're still choosing to live up to them. Acknowledge that choice and what it means. Always be aware of that choice, and you'll realise you're never trapped.

Who's the smart one, though?

[6Yankee]

We try very hard to live well within our means. We've got a very affordable mortgage on our house. We bought a used car a few years back and paid for it in full, with cash. We don't have a lot of expensive hobbies. We don't have a pile of debt. But if I lost my job we'd be pretty much screwed.

I'm much the same (though still clearing off a mess I got myself into at university). I don't even have a TV. I bought a studio flat that cost a very reasonable 1.5x salary. I'm in negative equity, one paycheck away from bankruptcy, repossession, and all that fun stuff, and if I lose my job I'm screwed.

My friend has the house mortgaged up to something like twice its value, has a very shiny new car, every toy in the house you could wish for, etc. He's in negative equity, one paycheck away from bankruptcy, repossession, and all that fun stuff, and if he loses his job he's screwed.

Who's the smart one? I really don't know. Since we're both just as buggered when the money stops coming in, and I worry just as much as he does, maybe the clever thing to do is to get in debt up to your eyeballs, have all the fun you can, and wash your hands of it when the music stops. *shrug*

Re:Who's the smart one, though?

[lgw]

I rent. I have a year's expenses in my savings account. I have no worries, except that the government will take my money and give it to your friend to buy more toys (after all, buying toys is economic stimulus, saving is not).

If your mortgage payment is reasonable (and it sounds like it should be), why are you living paycheck to paycheck? Live significantly below your means, save the rest, all your worries vanish. It sounds like you've taken the "strategic" steps needed to live below your means, so your savings should be piling up. Negative equity in your home should affect your ability to save and pay your bills, right?

If your sacrifice of toys hasn't resulted in a significant savings rate, you're doing something wrong somewhere. For me there was an almost immediate reduction in worry, and within a year "one paycheck" worrys vanished entirely, and I was starting to worry about my investment portfolio instead.

Re:Who's the smart one, though?

[6Yankee]

Food for thought - thanks.

In about six months I'll have a month's salary saved, but there'll still be debt for a while after that. I've always had it hammered into me that paying off debt should come before saving - Motley Fool, for example, is very big on it - and that's what I've always done. It's great, right up until you lose your job and have no savings. I'm not coming out the other end of this contract without something to tide me over for a month or two, at least.

As to where it's all going, I can't identify any one thing. I suspect it's being thrown away on "little treats" - things like grabbing a Starbucks instead of taking a flask of much better coffee into work. I'll be looking at this in more detail. What I should really do is go back to what I did when I first came out of university: set up a second account with just an ATM card and pay myself weekly. That worked amazingly well.

Re:Who's the smart one, though?

[lgw]

If you don't mind advice from a stranger who isn't a certified financial advisor, here's a good approach proven at least for me and several friends (US centric, since that's where I am). Divide your post-"cost of breathing" money 3 ways, in a fixed ratio:

* Build a ~$1000 "emergency fund", so that you're not borrowing money when you have big lump expenses: appliance dies, car trouble, sick kid, etc. Devote a fixed amount of money to this every month. In times when you're lucky, and the fund overflows, this is your "mad money". Spend on yourself when nothing has gone wrong recently, or refill the fund after emergencies. If you make a good professional salary, this shold be a small % of your monthly pay.

* Build a ~1 year expenses "disaster fund", against layoffs or getting cancer or the like. One you manage to fill this, devote all these funds to the next bucket, but that will take a few years.

* Build wealth. The following priorities are generally accepted: 401K to the extent it's matched by employer, pay down debt, Roth IRA, 401K to the max, taxable brokerage account.

The key is to allocate funds to all 3 buckets every month (at least until the second fills). I target 50% of take home pay for my fixed costs, but I have that easy since I'm single.

Re:Who's the smart one, though?

[6Yankee]

The advice has to be worth at least what I paid for it ;) I like the approach.

Now for some comic relief

[Anonymous Coward]

read the story on his blog about his junky date: http://ligesh.com/2008/05/drug-binge-at-300-am/

He was most probably not easy to handle and posed as a Nietzschean asshole, but after reading that post I couldn't but like him. And showing off an anti-God tattoo in a country like India deserves a lot of respect.

Re:Now for some comic relief

[Anonymous Coward]

Hey, You are still alive?? I thought you had finally realized how pathetic your life was, and committed suicide.

His reply to a commenter on one of his blog entries.

And a link to his page

[omuls are tasty]

Ligesh has (had) a blog with an about page. Sounds a bit f**** up.

A number of hosts have been hit by this, see e.g. this post at WHT. The software itself is apparently closed source (i.e. obfuscated source). Based on what I read, it was also quite cheap (speculations were ~50 cents for a single VPS), so most budget VPS providers used it.

This includes 2host, where I got an account a few days back. A few hours later I got an e-mail saying they disabled the HyperVM panel. Nice.

Too true about the grammar nazis.

[Ungrounded Lightning]

It appears as though our grammar nazis, in addition to being tactless and unsympathetic, are also unaware that this "rule" in English is merely a suggestion, and not an actual rule.

Too true.

The "Standard English" movement was a creation of east-coast education bureaucrats, trying to impose their ideas on the rest of the country (and perhaps define people from other regions as being less literate).

Note that the "never use a preposition to end a sentence with" pseudo-rule was never a part of colloquial American English grammar. It was part of Latin grammar which they chose to impose on the children of America. They also tried eliminating "ain't", the use of a double-negative for emphasis (which conflicts with symbolic logic but was exactly as valid as sucking a period inside a trailing parenthesis), and the second-person plural "you all".

Re:Too true about the grammar nazis.

[Anonymous Coward]

(Sorry that I'm not logged in...)

You know, the rules of "standard" English are not even standardized throughout the world. For example, British English puts the period outside the quotes in the following sentence, whereas American English would put it inside the quotes:

British: The pot called the kettle "black".
American: The pot called the kettle "black."

In this case, I prefer the British way, because it makes more sense to me as a programmer. The American way just says to me "Syntax Error: expected `.` but found next sentence instead".

Don't dump on WaMu.

[Ungrounded Lightning]

(*cough* AIG, Bank of America, Chase, GM, WaMu *cough*)

Please don't dump on WaMu. The rest might have overextended on bad loans. But as I hear it WaMu was solvent.

I hear they got into a cash crunch after an unfounded flame by Barney Frank started a run on them. Then the regulators, instead of doing their job and loaning them the money to tide them over while they pay off the depositors and gracefully liquidate some assets to cover it, forced them into the deal with Chase - essentially looting WaMu and letting their cronies buy the swag at fence prices.

Bzzzt! Wrong again. Thanks for playing...

[Gary W. Longsine]

Bzzzt! Wrong again. Thanks for playing... You Bet Your Enterprise!

Publishing exploit code :

• lets the bad guys know that you know, (e.g. tips your already weak hand) and
• hands the Script Kiddies a freebee.

Care to play again?

Re:Bzzzt! Wrong again. Thanks for playing...

[FishWithAHammer]

If you really think it wouldn't be in the hands of the script kiddies in short order anyway, you're woefully naive.

Re: What is worse ?

[Anonymous Coward]

When I lost my job back in 2000, I was depressed and feeling unworthy. A feeling of ability to work and meet basic bills turned into a feeling of helplessness. After a while when the credit cards were way out there, my wife decided I was no longer capable of supporting us in the style she had become accustomed to. She committed suicide. Now what I am talking about is where that left me. I felt bad enough to begin with, but after my wife's departure I was beyond suicidal. Not only did I seem to be useless, but I had let down my family. I haven't worked since, and but for the grace of God I would be dead now. Sometimes I feel I should be. This story is all true, I swear.

from a costumer perspective

[laszlomolnar]

I am a costumer of FsckVPS (sister company of Vaserv) and I am one of the unlucky guys who has 100% data loss on his VPS. Unlucky, because not every FsckVPS (and Vaserve) server and VPS have data loss. And unlucky, or idiot, because I have an outdated backup only on my local hard disk.My fresh backup was stored on the server. But, if I would not be so idiot and I would have a fresh backup on my local hard disk or on a remote backup server, what could I do now? Nothing, because all destroyed servers are still offline, offline 3 days after the hacker attack. Vaserv's costumers typically are not large enterprises, but micro companies, small teams, one man projects without sufficient financial and human resources. Just that is why they choose Vaserv's cheap VPS solutions, or at least I choosed FsckVPS for that reason. And just because of small budget I don't able to maintain other VPS as a backup server, and just because of small budget I maintain unmanaged server. I usually work alone on my projects, sometimes I get some help from other people, but usually don't. So I am the businessman, the marketing guru, the SEO expert, the copywriter, the designer, the webmaster and the system admin in one body. I have not enough time, energy to execute everything perfectly, so I haven't got a fresh backup to my local hard disk before this hacker attack happened. I suck this now. I wanted to tell this story from my own perspective, because more people ask here and on other forums, who are such stupid guys, who have not got a fresh backup to their own hard drive? I am! Sorry if my english is not perfect, but I am from Hungary. P.S. Since my vps and websites are still offline I started a blog about this hacker story http://laja404.blogspot.com/

Re:Well... no

[Anonymous Coward]

Hmm guys have you looked at their website, more specifically their fora? This is your run-of-the-mill half-assed Indian company. The website is low-quality, full of stock photos and phony hindu english. When I read the summary I thought 'poor guy' but seriously, have a look at the messages there, the language is *very* tense, feature requests go unanswered for months, bugs go unfixed... I would go as far as suggesting that the breach was orchestrated by one of their very angry customers. This is a company that boasts about world-class stability software, latest version has over 200 new features! Give me a break, it screams CHEAP and BOGUS all over. They are playing way out of their league hosting 1e5 websites.

If you are hosting that many sites (probably about shitty industries too) then go for some real world-class software made in first world countries (where no matter what you do, you can't get away with too much crap) and pay three or four world-class hackers to pull it together, even if you cannot or do not want to pay for the software and everything is pirated, it's okay, you are in India after all. These guys deserved the breach. These companies should never form and operate in the first place.

Quickly

[Anonymous Coward]

How does a genetic predisposition for suicide propagate...?