It’s an undesirable situation for everyone involved – you, the other customers, and us. In the end a business decision had to be made for the benefit and stability of our customers and our server. No hard feelings, nothing personal, just trying to maintain the high quality of service that we have always provided, and will continue to provide.

Anyone wanting to “warn” someone else about us should know that best efforts are made to assist every customer, even for an unmanaged service such as the VDS offerings.

I agree with putting this issue to rest. Best of luck to you all, and congratulations on your success. I am proud to be part of the company that hosted jquery.com on a server that had uptimes as long as 277 days without a single issue, requiring a reboot only for proactively installing a new kernel to address security updates (this is documented in our forums). Take care.

@ Rey “and running during our previous host’s less than business-like termination of the hosting service”

its comments like the above which are unfounded and unnecessary.

@Jeff: John has clarified what you meant by shared hosting and also the immediacy of your decisions.

Hopefully, this issue can be put to rest as there’s lots to be done with the jQuery library.

Unfortunately, in a situation like this it’s not always possible to provide “due notice” – since the attacks were occurring immediately. They did give me continued access to the server, to move information off – but since the direction of the attacks was undetermined, they had to shut down all, possibly-breached, services (such as the web server).

Next, I don’t consider a VDS to be shared hosting solution and from your website, neither do you. To quote from your own marketing material:

“A virtual dedicated server (VDS) acts like a dedicated server in every way – while retaining the ease-of-use of virtual hosting. VDS costs far less than dedicated, but you get root access, your own mail server, your own IP number, and a lot more. It’s the choice for serious developers, ecommerce sites, or any other Web business that’s outgrown its shared hosting environment.”

The last sentence is a complete contradiction to your statement.

Finally, nobody on the jQuery team has either mentioned your company name nor publicly lambasted you. If anything, all of us have avoided mentioning the issue and focused on thanking folks for their support. What others not associated with the project find via their own initiative is their prerogative.

Irregardless of the circumstances, you shut down the jQuery site with no notice and shut out a number of people that are dependent on this open source project for their day to day work. If you had given John ample notice that the site needed to be moved, especially considering the past issues that you mentioned, I’m sure that he would’ve obliged, moved the site and helped alleviate your immediate concerns.

===
@Nice: We weren’t on a shared server.
Comment by Rey Bango — May 8, 2007
===

Yes, you were on a shared server. Oblivious to the server being hacked repeatedly for days at a time, oblivious about the service you had.

The author of this article is apparently not a big fan of fact checking. The fact is that the customer’s server was hacked twice, and the attacks that occurred as a result affected all customers on the server for a brief period of time in both cases. Efforts were made to protect all customers on the server, including the server hosting jquery.com. Assistance was offered by the hosting company to determine the method of attack after the first attack. No response was given to the hosting company from the customer in regards to the aforementioned offering of assistance.

If a customer fails to maintain control over their server multiple times, resulting in attacks that can negatively affect performance of all customers on the server, then that customer will be asked to leave. One customer’s website and needs do not trump the needs of the customer base on the server as a whole.

The customer in this case was not shut off by the hosting company, immediate actions were taken in both cases to protect everyone on the server, and the customer was informed that he could keep his hosting services with us, but that the attacked site would need to find a new host.

If you are going to assume the role of a Linux system’s administrator, then you must do your duty to be one. It is not the hosting company’s fault that the customer’s server was hacked and DDoSd (not DoSd), nor is it the hosting company’s fault that the local system’s administrator (customer) failed to investigate the issue to patch the hole, resulting in the second attack which prompted the hosting company to inform the customer that the site would need to find a new home. Nice try shifting the blame on the hosting company with lies and misinfomation though.

“our host didn’t want to deal with the influx of traffic that was bombarding us, so they simply just kicked us out.”

Is not a true statement. John — really, I expected better out of you.

A true statement would be:

“My server was compromised not once but twice. In both instances someone setup an IRC server on my server which was the target of a decent sized denial of service attack – 350Mbps+.” “Additionally, since I was unable to determine how the attackers got in (twice), my host asked me to move this website elsewhere as to not further disrupt the service provided to other customers”.

To all of the project supporters, thank you so much for your words of encouragement and continued support. Whether its jQuery, Prototype, Audacity, Gaim or any open source effort, its a shame that some people will do these things just for the sake of doing it.

Thanks again.

I know the UK has easy libel laws, but in what country could revealing their previous provider be construed as libel?

I donated. Go jQuery!

jQuery.com’s recorded IP in 2005-12-12 shows the following whois netblock:
http://whois.domaintools.com/209.8.234.21

CustName: SecurityMinded Technologies LLC. Dba Myriad Network
Address: 37 Pidgeon Hill Drive
Address: #106
City: Sterling
StateProv: VA
PostalCode: 20165
Country: US

My employer kicks ass for figuring out this sort of stuff.

sudhir
http://www.jyog.com

Nonetheless, I am as curious as anyone else to know who they are! They certainly deserve a black eye. [sigh]