We responded to your original ticket in 20 minutes. Your ticket, titled, "fix your fucking vuln"
You submitted it: Posted on Sunday 16th February at 15:08
We responded: Posted on Sunday 16th February at 15:28
We never heard back.
Weeks later, you post on Twitter.
We respond to your ticket again, having not heard from you. We express a desire to review this in greater detail.
We provide two additional, lengthy, detailed responses of what we did and how you can replicate it to test.
In the end, on a fresh OS install on a fresh VPS, what we were able to "recover" was documentation and manpage files related to the OS. As mentioned, this was assumed to be from the OS images provided by Virtualizor. (Will run the same tests on the new stack we're testing since they use cleaner, more minimal OS images)
By your admission you reinstalled your OS from an active XMPP server. There is a reasonable assumption that the files you have recovered are simply the files your XMPP users have sent/received to one another. You can not access data from other users with this method. This is similar to reinstalling the OS on your laptop only to realize you forgot to backup the photos of your wedding, so you run a data recovery tool to see what you can get.
I even offered you another VPS for you to test, so that you could replicate my steps to see if the results were the same. You continue to not respond to the ticket and misrepresent the situation.
In any case, as announced weeks ago, we're in the process of updating and upgrading all of our VPS nodes. If there is something we can do beyond the industry standard practices to make things more private, we absolutely will.
While it's certainly a comical thought to imagine a business opening their doors and waiting years to onboard a single customer, that an upstream swiftly cancels on their behalf, it's nothing more than a far-fetched story that you're telling. Do you genuinely believe that both of these businesses exist to support a single customer?
Abuse complaints have to be valid. Submitting opinion pieces to our inbox is good reading, but beyond that, relatively pointless without links to actual unlawful content. I can't speak on behalf of Crunchbits since we simply lease hardware from them, but they likely subscribe to the same policy that most service providers do.
Except, we don't host them? Didn't you hear, Hurricane Electric didn't allow us to host Kiwifarms.
I haven't followed up with our customer to see who their new hosting provider is.
If you believe we're hosting something illegal, I do encourage you to message our abuse department so we can review it and take appropriate action if deemed necessary. I understand you feel strongly about the issue but we run an honest business and have no hesitation to boot people from our network doing things that are unlawful.
It was later in July. To be clear, filing a complaint is simply an online form. This does not involve or require lawyers or any expense.
The TLDR version is: We filed it as a violation of HB2282, Washignton State's Net Neutrality / Open Internet laws, the AG thought it was an appropriate complaint and forwarded it to HE. This gives them 21 days to respond. They (HE) responded relatively quickly, basically saying, "Nah, no we didn't and no we don't block access to it". At this point it'd be up to us to fight it further. We're not their direct customer, nor will we ever be (now). With that said, they very much WERE blocking access to the subnet as seen here ( https://images2.imgbox.com/b2/ed/Nc8NLQl2_o.png ) and here ( https://images2.imgbox.com/58/e1/1ZIn3YbZ_o.png ).
Absolutely false. We are in no way a 'bulletproof' hoster. You're free to review our IP subnets in use and compare them to actual bulletproof hosting providers. We actively and swiftly remove users engaging in ILLEGAL activity, such as malware, warez, etc.
We're an American based business, registered in Wyoming, and abide by American law. No 'bulletproof hoster' is going to setup shop in America.
Archiving what other people do and say online on and making fun of them on a forum may be mean, but it's not illegal.
With that said, we host many types of clients, including LGBTQ organizations. Privacy and speech is for everyone, that has always been the stance. Our policy is and will remain to be neutral on content, so long as it abides by law.
We filed a complaint with the Washington state AG over their actions. HE's response was more or less technically obtuse garbage and, "You're not our direct customer" (paraphrasing, of course).
So what they did, was take it upon themselves to prevent access to an entire /36 subnet of IPv6 that our customer had announced downstream of us. Not once did an abuse report get sent to us, or our upstream from HE. Nor did we receive any credible abuse reports sent to us directly from those upset that the site exists. Meanwhile, this actually has no direct impact on the website in question's existence as their opposition has learned by now, it's never been truly offline. Just temporarily blocked from certain ISPs.
From an ISP point of view, it's worrying that a transit provider like HE can arbitrarily cancel a customer of yours, or a customer of a customer (, etc) over legal, protected speech. So, from a business standpoint, what does HE have to gain? The people complaining about the site aren't their target market, they're mostly Twitch streamers, Twitter personalities and folks who have a following on popular platforms that already exist. They're not the types to be self-hosting a streaming service who'll need rackspace and transit. So, what is there to gain by bending the knee to them? The safest business decision would be to remain neutral, respond to law enforcement requests if presented with one, and otherwise do the job you're paid to do. The worst business decision is moderating the content of downstream customers, which is what we're seeing now.
You submitted it: Posted on Sunday 16th February at 15:08
We responded: Posted on Sunday 16th February at 15:28
We never heard back.
Weeks later, you post on Twitter.
We respond to your ticket again, having not heard from you. We express a desire to review this in greater detail.
We provide two additional, lengthy, detailed responses of what we did and how you can replicate it to test.
In the end, on a fresh OS install on a fresh VPS, what we were able to "recover" was documentation and manpage files related to the OS. As mentioned, this was assumed to be from the OS images provided by Virtualizor. (Will run the same tests on the new stack we're testing since they use cleaner, more minimal OS images)
By your admission you reinstalled your OS from an active XMPP server. There is a reasonable assumption that the files you have recovered are simply the files your XMPP users have sent/received to one another. You can not access data from other users with this method. This is similar to reinstalling the OS on your laptop only to realize you forgot to backup the photos of your wedding, so you run a data recovery tool to see what you can get.
I even offered you another VPS for you to test, so that you could replicate my steps to see if the results were the same. You continue to not respond to the ticket and misrepresent the situation.
In any case, as announced weeks ago, we're in the process of updating and upgrading all of our VPS nodes. If there is something we can do beyond the industry standard practices to make things more private, we absolutely will.
IncogNET