As per guidelines of responsible disclosure, I contacted digitaloceans a good 10 hours before going public. I also contacted them again -before- going public, telling them I would do so, and why.

I feel I have done my best to ensure this does not harm them in any way, while making sure customers are protected.

I also want to point out that this entry was truncated. My full disclosure is, suitably, on full disclosure (the list). There, I explain that I consider DO one of the best cloud shops out there, and I will happily continue using them. I am not an angry customer. I am a current customer, but this is still information that people should be aware of, I believe. Anwyay, do with it as you please. Digital Ocean are aware of it and on top of it (I believe). I wanted to give customers the same chance.

Indeed. I believe it might still be possible to arp spoof, if the arp table is leaking MAC. There seem to be no more IP packets leaking in this manner, though, which was the real concern, imo. DO has probably already remedied the rest, and if not, they most likely will shortly.

All in all, a productive communication that worked out well.

Thanks, guys!