DreamHost discloses two-month intrusion into its File Manager, exposing user logins

·8 views

DreamHost has confirmed that attackers had access to its web-based File Manager from August until October 23. During that window, the intruders obtained FTP and SFTP credentials along with some webmail session tokens. Because the breach went undetected for roughly two months, the attackers had a long window to act. Session tokens are especially risky since they can bypass password protection entirely. Affected customers are advised to reset their FTP, SFTP, and email passwords, review their sites for unfamiliar files, and enable multi-factor authentication where available.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Walk-Forward Testing Explained: Two Versions With Different Rigor

Walk-forward analysis is widely regarded as a gold-standard method for validating trading strategies, but the term covers two distinct approaches. The classic method, introduced by Robert Pardo in 1992, optimizes parameters on one period, tests them unchanged on the following period, and rolls the window forward, stitching the out-of-sample segments into a composite curve. A stricter variant, purged walk-forward, also removes training data near test boundaries and adds embargo periods to prevent information leakage across folds. The article argues that vendors claiming walk-forward validation should specify which version they used and whether their verdict depends on it. It also recommends using at least five folds across varied regimes, examining performance trends across folds rather than averages, avoiding re-tuning on out-of-sample data, and following walk-forward testing with forward paper trading.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Keeping AI Products Online During Model Provider Outages With Gateways and Fallbacks

A guide published by Control Plane, a cloud platform vendor, recommends placing an OpenAI-compatible gateway in front of all model calls to keep AI products running when a provider fails. It advises configuring fallback chains that move from the same model in another region to an equivalent model from a different provider, then to a self-hosted open-weight model. The article lists common failure modes, including full outages, elevated error rates, rate limits, latency spikes, regional capacity limits, broken streams, and model deprecations. It also recommends running the gateway and agent services across multiple regions so the resilience layer does not become a single point of failure. Testing with blocked providers and injected errors is suggested to measure fallback speed and output quality.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Kubernetes Secrets Distribute Credentials but Do Not Provide Key Custody

A Kubernetes Secret is well suited to delivering sensitive configuration to workloads, but it is not designed to answer security questions such as identity, authorization, or key custody. Problems arise when one Secret ends up representing identity, enrollment state, rotation, and tenant context all at once, making failures hard to diagnose. The article argues for separating distribution, private-key custody, workload identity, and authorization, so that a private key is never exported to the caller. It also describes a candidate enrollment contract that requires enrolled workload credentials to live in encrypted, CRD-backed custody with a non-exporting signing interface, while forbidding Secret volumes and similar injection methods. The author notes that this contract is not yet qualified and that migration work remains open.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Running Apps Across Regions: Routing, Databases, and Failover for Stateful Workloads

The guide explains that multi-region deployments rely on deploying the same stateless services from one definition to every region, with a health-checked global routing layer sending users to the nearest healthy region. Each database needs its own data topology, such as a single primary with replicas, multi-primary, or distributed SQL, chosen according to tolerance for write latency and data loss. Stateless services fail over through routing changes, whereas databases require promotion steps that must be designed and tested in advance. Automatic failover depends on quorum, so two locations tolerate no location loss, three tolerate one, and five tolerate two. The article notes it is published by Control Plane, which offers a multi-location platform and database templates.

0 comments Read more at DEV Community