suspeneded accounts behavior!

[w3it]

For the second time I have lost a client due to an un-announced Dathorn suspension of an account. The culprit this time is an unsecure version of phpBB.

My Gripes:
1. The original version of phpBB was installed via cPanel at Dathorn. I just logged into the suspended account and note that their is an upgrade available for the phpBB. If there is an upgrade available in cPanel and all I have to do is run it... why is it not automatically upgraded anyway? If the upgrade will break the script, then it is ridiculous to offer the option in cPanel in the first place!

2. If security is important to Dathorn, why on earth use a forum to announce and not a mailing list like every other security concious concern I know. Even phpBB seem to have sent out a security note to those concerned! I read through this forum and found I have to subscribe to a forum to get such details! Why? I pay a subscription that uses my email quite nicely for Dathorn, is it so difficult for them to have a mailing list!? security-announce@dathorn.com is a typical suggestion.

3. Clairvoyance or some form of ESP is obviously needed as far as supporting my clients at Dathorn is concerned. How the hell am I supposed to track what FREE scripts customers are using within their accounts? Does Dathorn expect that with every security notice, we have to go into all our accounts and see if that particular sciript is being used? Lets be realistic.

4. Support! Trouble ticket turn around has been good but Dathorn are not alone there. The idea of suspending an account WITHOUT prior notice and with such utter disregard for YOUR customers , in my opinion, shows an incredible lack of care for YOUR business.

The email I received from Dathorn informing me of the suspension was un-informative and had no disregard what so ever for the account in question.
This is a sentence from te email "This sort of activity will not be tolerated any further". If I send this to any client of mine, I would have no suprises in expecting a cancellation in return. I would never send such an email to a client as I would hope to be some what more diplomatic.

The email should at least offer some "useful" advice as to how to resolve the situation. It is the scripts fault, NOT my clients and you are punishing them.


DATHORN, LET US KNOW WHAT ACCOUNTS ARE USING SCRIPTS THAT NEED UPGRADING AND WE MIGHT BE ABLE TO DO SOMETHING ABOUT IT! JUST TO SUSPEND ACCOUNTS SHOWS JUST HOW MUCH DATHORN CARES ABOUT MY BUSINESS.


I find this an incredibly unethical and unhelpful approach by Dathorn.


Looking forward to discussions on this as maybe I am expected to check EVERY account or that I have missed something?!?

Regards

[brett]

Amen! I didn't have the guts cuz I still have some accounts here.

[AndrewT]

This has been discussed many times before. The bottom line here is that you are entirely responsible for the content on all of your domains and updating all of your scripts as new versions are available. We cannot just standby and allow you to run old versions of scripts that have widely known exploits that allow users to do nearly anything they wish to our servers.

[w3it]

Amen! I didn't have the guts cuz I still have some accounts here.

I see what you mean... my trouble ticket was created 7 hours ago. Flagged for admin 6 hours ago. A client calling again an hour ago. No sign of Andrew.

I take it there is only one "admin" behind Dathorn?

[AndrewT]

I see what you mean... my trouble ticket was created 7 hours ago. Flagged for admin 6 hours ago. A client calling again an hour ago. No sign of Andrew.

I take it there is only one "admin" behind Dathorn?

I sincerely apologize for the way that your ticket was handled, that obviously was not the way that it was meant to be handled and it will be addressed.

[AndrewT]

w3it, your domain in question was running phpBB 2.0.5. phpBB 2.0.6 was released on 8/3/2003. The current version is 2.0.17 which was released on 7/19/2005 and is available via cPanel. This could have easily been prevented had the domain owner kept the scripts updated.

[w3it]

Andrew
thought I would comment here from now on as you seem to be more responsive and curtious in the public forums than when using the private trouble tickets.

Could you comment on the question of a refund which you also seem to have missed in my submitted trouble ticket. As you have cost me a client, I do not think it unreasonable. I am refunding them and having to help move their site.

This has cost me a lot of time, money and energy. Lastly it has caused my client a lot of anguish as they are on tour and obviously their site is part of their marketing.

Regards

[-Oz-]

I'm pretty sure the policy here is no refunds for these things. Keeping scripts up to date can't be done automatically because it would mess up modifications for most scripts. Also, if you're not secure, and someone gets it. You can affect hundreds of other websites on the server, so...

[w3it]

w3it, your domain in question was running phpBB 2.0.5. phpBB 2.0.6 was released on 8/3/2003. The current version is 2.0.17 which was released on 7/19/2005 and is available via cPanel. This could have easily been prevented had the domain owner kept the scripts updated.

Andrew

some domain owners or as I prefer to call them, customers, cannot keep track of emails. You cannot expect them to keep track of scripts they employ?

The scripts are supplied as a service - in cPanel you should have "use at your peril" if this is your attitude. It is easy to install via cPanel for a reason, so that any novice can build a forum or what so ever they wish to employ on their site.

With that same NOVICE in mind, YOU should also provide a NOVICE approach to upgrading and not expect them to track the script makers site, etc for any and all issues!

This could have easily been prevented if you had listened to past arguments and actually provided a solution that YOUR customers are obviously wanting.


Regards

[w3it]

I'm pretty sure the policy here is no refunds for these things. Keeping scripts up to date can't be done automatically because it would mess up modifications for most scripts. Also, if you're not secure, and someone gets it. You can affect hundreds of other websites on the server, so...

so... we venture down other solutions. How does cPanel track what accounts have what scripts and their version installed. I can see it does due to the option to upgrade from/to. Can a simple script be made that runs through the "cPanel database" and notify the account contact or WHM contact of the affending account/script?

Remember, YOU are the guys with your fingers on the pulse and closest to the information. Surely it would not be difficult to inform us (your customers) a little rather than to just kill our business.


Kind of getting the feeling Im wasteing my time here... Would appreciate any other views than admin/moderators. Preferably those of you that have customer sites on these servers.


Regards

[AndrewT]

Our ToS and AUP clearly state our no refund policy.

There were not even reasonable attempts made to upgrade that script at all. It was over 2 years old. It was not like an update was released last week and you had failed to upgrade it to that newer version and it was exploited, that would be an entirely different story. This here was a complete disregard for the upgrade process. If they cannot keep track of installed scripts then they certianly shouldn't be installed in the first place. You can limit this using the feature manager in WHM. You are ultimately the source for your customer's support, not us.

[Buddha]

so... we venture down other solutions. How does cPanel track what accounts have what scripts and their version installed. I can see it does due to the option to upgrade from/to. Can a simple script be made that runs through the "cPanel database" and notify the account contact or WHM contact of the affending account/script?

AFAIK, cpanel has no database associating accounts and scripts.

Remember, YOU are the guys with your fingers on the pulse and closest to the information. Surely it would not be difficult to inform us (your customers) a little rather than to just kill our business.

No we are closer to our own customers than Dathorn and this is information we should have not Dathorn.

Kind of getting the feeling Im wasteing my time here... Would appreciate any other views than admin/moderators. Preferably those of you that have customer sites on these servers.

You get no sympathy from me especially since you don't want to take any responsibility. Keep up the good work Andrew.

[ZYV]

Well, I am actually not hosted at Dathorn, just having a friend having a big account here, seriousely thinking on purchasing my own following his example. I read the forums here and the threads on WHT, and Dathorn really seems to be the ideal place for me: no support for basic things like "dude, how do I upload files by FTP to my account?", but inexpensive and feature-rich.

But one things which really turns me off is the suspension policy. Well, I will probably use my account to host the personal websites of family members etc., but anyway, I see people get their clients' accounts suspended just like this without getting a timely notice from Andrew like "Guy, your domain xxx.com is running an old phpBB version for ages, I am going to suspend it now, please upgrade immedeately then unsuspend it". I feel this is that simple, why just not do it?

Am I missing some point here?

[AndrewT]

Well, I am actually not hosted at Dathorn, just having a friend having a big account here, seriousely thinking on purchasing my own following his example. I read the forums here and the threads on WHT, and Dathorn really seems to be the ideal place for me: no support for basic things like "dude, how do I upload files by FTP to my account?", but inexpensive and feature-rich.

But one things which really turns me off is the suspension policy. Well, I will probably use my account to host the personal websites of family members etc., but anyway, I see people get their clients' accounts suspended just like this without getting a timely notice from Andrew like "Guy, your domain xxx.com is running an old phpBB version for ages, I am going to suspend it now, please upgrade immedeately then unsuspend it". I feel this is that simple, why just not do it?

Am I missing some point here?

It is not our responsibility to go through every domain on all of our servers and check script versions. That is entirely your responsibility. We suspend accounts like this one in particular when the script has already been exploited, in this case which was used to further run a trojan to exploit other phpBB installation on other servers. We are not simply suspending accounts based on the fact that they are using old versions, a problem has to occur with this before we actually suspend an account. But once a script has been exploited it simply is not reasonable for us to send e-mail notification and wait for actions to be taken. This is a shared hosting environment and everything you do can possibly effect every other customer on the server. We ultimately have to do what is necessary for the greater good of the server and other customers on it.

[sdjl]

I'm all for the suspension policy.

If you're running your own business you have to take responsibility, just like any other business in the material world.

I manually check all of my accounts every month or so. Fair enough i don't have vast hordes of accounts, but then if you do, and this is your lively hood or business, it's something you'll have to get into your routine or business plan.

David