DigitalOcean

Please add support for logging in with passkeys (webauthn). This is far more secure and easier than using username/password and 2FA. Thanks!

Make login by passkeys possible for project dashboards. Current two-step authentication by SMS is not safe.

You have a partial integration with Google Workspace at the moment with SSO. It would be great, if you could extend it. one way would be to support to send notifications/alerts to Google Chat via webhooks. This is actually rather easy to implement and could be a simple quick-win. So please consider checking it out.

Hello, the metadata service should use https. Without it, it becomes risky to query public_keys. Referring to this service by the way https://docs.digitalocean.com/products/droplets/how-to/retrieve-droplet-metadata/ for example, this repo https://github.com/benpye/alpine-droplet builds an alpine custom image that can be uploaded to Digital Ocean. I notice that it queries the metadata service to populate .ssh/authorized_keys but has to do it over http. https://github.com/benpye/alpine-droplet/blob/master/setup.sh#L27 if there was a MITM they could modify the results to include their own key. Unless this is a secure endpoint how could you trust any data returned from the metadata service? Can digital ocean make this service available via a subdomain or url? This would allow HTTPS and make scripts like the one above more secure. It would also give digital ocean the flexibility to change the service IP if needed without breaking scripts.

The number of possible data sinks for logs is rather limited. Please provide support for OTEL or other open standards, so that one can use a wider variety of observability platforms (like Honeybadger or AppSignal) For example, AppSignal supports multiple different Logging Endpoints, like HTTP, HTTP-JSON, HTTP-Syslog and Syslog. Log messages can formatted as plaintext, Logfmt or JSON. See https://docs.appsignal.com/logging/configuration.html

I have had a great experience with Managed Databases and would like to know if Digital Ocean will be offering Managed Email services in the near future.I have read the Digital Ocean guide that essentially discourages you from creating and attempting to manage an email server, which is not easy task.I alone would switch 12 domains over almost imediately after it was available.This is the only thing that I still use my shared hosting for; custom domain email address.This could bring a lot of new users to the site which is a win for everyone.Thank you for taking the time to read.

It would be amazing to have Alpine Linux images that work well with DigitalOcean VMs, with support for IPv6 and Monitoring properly. The last feedback post on this topic was opened in 2018. Today Alpine Linux has become quite mature and stable, and is a great OS to deploy.

Any plans to offer a SecretsManager as a service?

Please add support timeseries and maybe other modules for Redis

Recently, while trying to log into my DigitalOcean account using my associated email, I encountered an issue. The system responded that the email was not registered. However, when I attempted to reset my password with the same email, I received an email stating that the authentication method was GitHub, and I should use that instead. This caused unnecessary confusion and delay, as I had forgotten I used GitHub for authentication. To improve user experience and reduce confusion, I propose that DigitalOcean enhances its authentication error messages. Instead of simply stating that an email is not registered, the system could provide a more informative message indicating the authentication method associated with the email. For example, instead of "An account with this email does not exist." you could say "An account with this email exists, but the authentication method is via GitHub. Please use GitHub to log in." By doing that you instantly get a few benefits: a) Users will immediately know the correct authentication method, saving time and reducing frustration. b) Clearer error messages will likely decrease the number of support requests related to login issues. c) Users will be reminded of their authentication methods, reinforcing good security practices. While there might be concerns about revealing authentication methods in error messages, the risk is minimal compared to the convenience and clarity it provides. If an unauthorized person already has access to someone's email, they likely can reset passwords and gain access to accounts anyway. Thus, providing the authentication method in the error message doesn't significantly increase security risks.