lish

Even if you haven't used Lish, consider it compromised, because according to Linode support all Linodes are assigned a random Lish password by default.

Since those peo­ple are the only ones fi­nan­cially sup­port­ing the con­tent, pub­lish­ers in­creas­ingly are shap­ing their sto­ries to ap­peal to them.

Text­book pub­lish­ers pro­duce such large text­books so they can charge you $150 for each text­book.

If all Lish passwords had been stored in the clear, I think they would have said that.

The lish passwords are the easiest to abuse immediately, but the larger impact is on all the user accounts with weak reused passwords.

And that's probably a lot more people than had exposed lish passwords.

It's very likely that people reused their root login passwords as their Lish passwords, meaning that Linodes running without firewalled sshd are potentially vulnerable.

I believe the correct approach for us is to assume all Lish password where in clear text until a good explanation is given.

Yesterday the news was all focused on the credit card information but now it makes sense why Lish passwords were not working (when I was 100% sure I had it correct--Friday's email said nothing about lish iirc).

I'm pretty sure it was all Lish passwords.

Also: "It's very likely that people reused their root login passwords as their Lish passwords..." Really?

Quoting Linode: "There were occurrences of Lish passwords in clear text in our database.

They say they have "invalidated all affected Lish passwords effective immediately".

I hope Linode communicated who had "the occurrences" of compromised cleartext Lish passwords, so that those users could take appropriate action.

Lish passwords in the clear might have been in support tickets stored in the same database, or chat logs.

Lish &c are a big plus for virtualized nodes, but I think I'll live without it.

DO doesn't have a console access utility like Linode's [Lish]?