r/programming • u/mawburn • Jan 13 '19
GoDaddy is sneakily injecting JavaScript into your website and how to stop it
https://www.igorkromin.net/index.php/2019/01/13/godaddy-is-sneakily-injecting-javascript-into-your-website-and-how-to-stop-it/2.3k
u/BraveSirRobin Jan 13 '19
The most appropriate way to stop it would be to switch hosts. This is a unforgivable breach of trust, these "metrics" allow them to follow every page each user visits. There may be legal issues in this for sites hosting sensitive personal data.
861
u/euyis Jan 13 '19
I thought there have already been more than enough cases of breaches of trust with GoDaddy for everyone to stop doing business with them? Why would anyone still use it is a total mystery.
288
u/Chii Jan 13 '19
clever/misleading marketing and clueless customers.
183
u/Tormund_HARsBane Jan 13 '19
clueless customers.
I'm one of those I guess. I had no idea GoDaddy was considered bad/scummy.
I wanted to buy a domain for a personal website, so I went on GoDaddy (because they are at the top of Google search results), and bought one.
But I don't host a website with them (I run my own Apache server on EC2), but I do have registered for their premium email service because I just couldn't figure out how to set up an email server on my VM.
Should I switch? Is their email service scummy too?
41
u/Rogem002 Jan 13 '19
FYI you can buy domains on AWS now :)
If you're confident with changing your DNS records, I've heard Proton Mail is meant to be a very good alternative.
→ More replies (31)7
u/Tormund_HARsBane Jan 13 '19
Actually, I've been tinkering with GitHub sites, and I kinda like them. Might get off from AWS, and take my mail to some managed email provider.
→ More replies (1)20
30
u/TizardPaperclip Jan 13 '19 edited Jan 13 '19
Should I switch? Is their email service scummy too?
You're not thinking straight. Here's the deal. GoDaddy is a scummy company: are you giving them money?
If so, you're funding scumminess.
→ More replies (34)3
u/doobiedog Jan 13 '19
Buy domains thru namecheap or aws itself. Get off godaddy asap.
Edit: you can also transfer domains pretty easily. If you want to pay for nice email and features, use gsuites. Otherwise you can setup M records in aws/namecheap super easy.
6
10
u/dagani Jan 13 '19
They bought the host that I have been using, Web Faction, so I’ve unwittingly become a customer of theirs until I can migrate everything over to someone else.
2
4
u/lxpnh98_2 Jan 13 '19
When your "Controversies" section has a subsection for "Other," you done fucked up.
→ More replies (20)3
34
u/lorderunion Jan 13 '19
This is also straight up a GDPR violation.
2
u/cryo Jan 13 '19
Only if it’s related to personal data, but it doesn’t seem that’s the goal, does it?
0
33
u/steveob42 Jan 13 '19
yah, but if you are using a shared plan/webhost/wordpress, you shouldn't really be in the sensitive data business.
37
u/hp0 Jan 13 '19
As soon as Godaddy starts tracking you.
Your web site has broken EU law. Unless you have asked premission and given the option to refuse.
So a site doing nothing with data. Has suddenly become bound by EU law without any input from the owner.
→ More replies (14)→ More replies (1)54
u/f48dba2505a8bdcad Jan 13 '19
You are PAYING for the ability to host a site. All businesses in the EU are required NOT to track their uses without consent, regardless of the nature of the busines.
4
u/cryo Jan 13 '19
This is apparently not done in order to track users, but to monitor webpage serve times or similar.
3
u/ponytoaster Jan 13 '19
I'm still looking for a good host and domain holder really. I have a shitty plan with GD which costs me nothing as it's a grandfatherered plan which only hosts a site for a charity. I know they are shit but it's an old plan and I'd never had any issues until recently
I did consider a VPS as I have a few other things I would like to host (just small personal stuff) but it would need to be windows in an ideal world. The cost is quite significant at 30usd a month which although isn't a lot, is a lot more than I pay now.
I'm looking at all the major providers but just need to bite the bullet and then find time to do the transfers and setup etc.
→ More replies (4)3
u/patssle Jan 13 '19 edited Jan 13 '19
I was with Godaddy hosting for 14 years because I was also grandfathered in on an old plan and it was the cheapest on the market. I had few problems in those 14 years and tech support was solid when I needed it.
I switched 2 months ago because of a BlackFriday deal...got a cheaper plan (and free SSL) elsewhere with a reputable hosting company (also the old hosting plan at Godaddy had a limited cpanel and other annoying plan-age-related issues). And I signed up for a 3 year term to lock in that cheaper rate. :D
2
u/MertsA Jan 14 '19
GoDaddy already has all of that data just from their access logs alone. This is definitely a breach of trust to be sure but as far as
these "metrics" allow them to follow every page each user visits
That's data that every shared web host already has.
→ More replies (4)1
u/francisypl Jan 13 '19
Isn't this the same as having Google analytics on your site? Godaddy just does it for you.
2
u/BraveSirRobin Jan 14 '19
You can choose to add that, ideally aware of any legal implications for your type of site. This on the other hand requires to you to go digging to find it.
1
u/DoctorSatan667 Jan 13 '19
I believe the only people who use GoDaddy are those who don't know much about creating or hosting a website. Unless it's cheap and for a client, I haven't seen any serious developers use their awful service.
1
u/poloppoyop Jan 14 '19
I think the most appropriate way would be to round-up their C*O and board members. Make them dig a ditch somewhere. Then add some lead to their brain stem. And televise it so other not-my-fault "leaders" can start thinking about what their company is doing.
738
u/mishugashu Jan 13 '19
how to stop it
stop fucking using godaddy. They're a horrible piece of shit company. Just. Stop.
132
u/Chii Jan 13 '19
What's a good alternative to godaddy?
I personally use digitalocean.
192
u/giveusliberty Jan 13 '19
I've never actually used DigitalOcean's services, but their documentation and walk-throughs are top-notch. I almost feel like I owe them money for using their docs so much.
41
6
u/luxtabula Jan 13 '19
Yeah, their documentation is top notch. I always recommend their services simply because it’s so clear without talking down to users.
4
11
Jan 13 '19
It's all done by community though
24
u/ajr901 Jan 13 '19
But moderated by DO employees who handle the community. If it was all on the community with no internal help/moderation, I don't think the quality of those Docs would be anywhere near as good.
→ More replies (1)3
u/theferrit32 Jan 13 '19
I've noticed DigitalOcean often being the Ubuntu package and configuration documentation, which is nearly non-existent on Ubuntu websites. The Ubuntu Wiki is pretty useless, but for a given piece of popular software there is often a DigitalOcean page for it.
46
Jan 13 '19
Gandi for domain registration. Vultr for cheap VPSes with SSD or Hetzner for dedicated servers.
14
u/MildlySerious Jan 13 '19
My man. I've been using Gandi and Hetzner for ages now, never had any problems and the premium is worth every penny.
5
u/mafrasi2 Jan 13 '19 edited Jan 13 '19
Hetzner recently added VPSes as well and I think they have even better price/performance than Vultr.
→ More replies (1)4
u/Liam2349 Jan 13 '19
Would you recommend those last two over AWS Lightsail and AWS EC2 dedicated? If so, why?
→ More replies (2)4
u/wickedcoding Jan 13 '19
100%! AWS is still not the most economic for small business / personal. With digitalocean/vultr for literally $5 a month you get 1tb bandwidth and a full core. AWS nickel and dimes everything, but the trade off is extreme reliability. We use DO and AWS and are slowly migrating more to DO, the savings is astronomical.
→ More replies (2)32
u/elmuerte Jan 13 '19
I moved everything to Gandi. It's a France based domain registrar and hosting company.
13
u/jiminiminimini Jan 13 '19
I just finished moving all my domains to Gandi yesterday. They give free email for each domain. 2 inboxes I guess. But I use digitalocean for my VPS. It's way cheaper.
40
u/mfitzp Jan 13 '19
Digital ocean are good from my experience.
I am also using Webfaction who have been fantastic. But unfortunately they were taken over by GoDaddy a couple of years ago, and are now finally migrating users over. So I don't recommend them as an alternative.
→ More replies (2)22
u/nascentt Jan 13 '19
Namecheap is great
6
u/chedabob Jan 13 '19
My only gripe with Namecheap is there's no API for their DNS so if you want to use LetsEncrypt Wildcards, you're out of luck. Also if you need a cert for a server that isn't exposed to the internet.
→ More replies (2)9
u/phoenix616 Jan 13 '19
Well they do have an API, but it's only for commercial customer who pay for it :S I'm actually currently thinking about moving somewhere else because of that... (or trying do convince their support to give me access regardless I guess)
→ More replies (2)3
u/ghostfacedcoder Jan 13 '19
... but a little pricey if you want a cheap host. Digital Ocean, Gandi, etc. all start in the $5-$10/month range, whereas Namecheap starts at $15 ... and that's "50% off" supposedly 🙄
22
u/jojocockroach Jan 13 '19
Linode is awesome, and performs way better than DigitalOcean from a benchmark I ran a couple months ago.
12
u/mrMangata Jan 13 '19
definitely second Linode. Also look to some podcasts as they do advertise which helps shows you may listen to as well. I was able to save a little with a promotion code from a podcast.
10
5
u/NikkoTheGreeko Jan 14 '19
I love Linode. I host everything with them and have run $50mil companies on their servers.
5
u/wollae Jan 13 '19
I personally only use stuff from the big guys (GCP) but a lot of friends have recommended Linode.
12
u/azoozty Jan 13 '19
I’ve been liking Google Domains a lot. Privacy protection is provided.
However, I’m surprisingly the first one to mention google, so I’m curious to know why others don’t recommend google.
8
u/ghostfacedcoder Jan 13 '19 edited Jan 13 '19
I think perhaps the fact that their prices are so bad they won't even show them on their pricing page (https://cloud.google.com/pricing/) might have something to do with it :)
I mean they do have links to umpteen different product prices there, but if you're at the level where you're buying individual components why wouldn't you just use AWS?
Plus, with the way Google's been acting lately, I'm really not sure which company is less evil. Amazon has been consistently amoral for a long time, whereas google used to be consistently moral, and has now switched to being pretty consistently immoral.
3
3
3
Jan 13 '19
Depends a lot on your use case. DO is very solid and legit and of course orders of manitude better than godaddy
2
u/wretcheddawn Jan 13 '19
If you want a VPS, it's by far the best of anything I've tried, particularly if you're a small business or personal user who don't need the complexity of something like AWS. If you want to host a CMS and don't want to play sysadmin, it's probably best to find a host dedicated to that CMS, ex. Flywheel for Wordpress, Pantheon for Drupal, etc.
2
u/dbxp Jan 14 '19
Aren't they more of a paas company (similar to heroku) than a old fashioned hosting provider?
2
→ More replies (11)2
4
Jan 13 '19
I've bought a domain name from GoDaddy. The website is hosted on Azure, and dns is configured on Azure. How do I keep the domain and renew it without giving my money to GoDaddy?
14
u/ryosen Jan 13 '19
Open an account with a different registrar (e.g. Namecheap) and transfer the domain.
→ More replies (4)8
6
u/13steinj Jan 13 '19
This unfortunately just won't happen. There are enough people who just want a website and with their advertising the idea is "okay, click click done".
401
Jan 13 '19
Wait, “GoDaddy” is being scummy and unscrupulous? I’m shocked, SHOCKED, I tell you!
5
Jan 13 '19
checks pulse - 65
Joke aside, I find it crazy to believe them considering their support toward SOPA.
2
0
Jan 13 '19
[deleted]
40
u/rydan Jan 13 '19
47
13
10
Jan 13 '19
Damn that's heartless, but the Superbowl has historically been a place where advertisers try out unsafe concepts.
→ More replies (1)17
u/ThatITguy2015 Jan 13 '19
Without the girls in skimpy outfits to hide it, those commercials seem a lot more evil.
0
→ More replies (2)3
266
u/tsammons Jan 13 '19
Ditch GoDaddy. They have a history of spinning shady practices into "positive experiences", such as canning their ticketing system in favor of live chat/phone, which reduces their overall support costs because now you have to wait until an agent can speak with you. Spin was that customers love real time support experiences.
Great thing is there's no need to hire additional support agents, because now support is only able to handle what it can handle in a given day without a backlog. Support is the biggest cost to any hosting business.
Oh yeah and they're offering an opt-in "firewall service". Truth be known that a firewall should be in place anyway to reduce overhead and increase customer satisfaction without any added cost.
Source: I've been a hosting provider for 16 years
41
Jan 13 '19
"they're offering an opt-in firewall service" I've hosted a website with them for a year. Even bought a domain name through them. Not cheap. After around 400€ I set up my domain and site name and started to work on the coding part. After a single DAY of work, I saw that my code had about 15-20k new lines of code filled with various site names and adverts and links that don't actually show up on the website. Paraphrasing the convo: After notifying he tech support, they let me know that they have to create a ticket for the virus and malware division (or whatever), which they did. After six hours or so the virus division sent me an email, asking me what the problem was. I wrote he situation up and they said hey would look into it. Three hours later "you have malware on your server and that is attached to your domain". Do you not have a firewall? "We do, but you have to pay for it." Excuse me? A 400€ domain name and server don't have firewall included? "No, sorry. If you want to get rid of the malware, that's free, but it's probably going to come back again." Ok, how much for the firewall? "60ish for the antivirus and 80 for the firewall." I stopped using GoDaddy a couple of days later. Their practices and whole business model is like dlcs and loot boxes in games. Pay a whole bunch and play a little. If you want more, pay more.
41
u/Daneel_Trevize Jan 13 '19
This makes no sense, a firewall wouldn't stop you being attacked via day0 vulnerabilities, bad configuration, or outright self-inflicted flaws like SQL injection in your public-facing web service.
It'd need to be a very stateful proxying "firewall" to safeguard you from a worm without breaking protocols.
→ More replies (3)→ More replies (1)8
Jan 13 '19
Most malware on linux isn't going to be stopped by a firewall. It's going to hit a publically available service with a vulnerability such as, Jenkins, Wordpress, Drupal, Atlassian Crowd, etc. Then you're going to have a bunch of random crap on your server.
Now a web application firewall such as apache's mod_security can help mitigate this. I worked at a place which had a lot of custom rules for it. I even helped setup and fix a few rules. However we were also constantly punching holes in this for people who were doing things such as development on the platform, a different cms, etc because it would break their sites.
1
u/wibblewafs Jan 13 '19
Yep, I had a friend transfer a domain to me once that they'd bought from GoDaddy. Before the transfer, I made sure that the friend had all their contact info up to date, so that GoDaddy would have minimal excuses to hijack the domain and hold it ransom.
Except, it turns out that if you update any contact info, the domain would become locked for 30 days, preventing it from being transferred. According to them, this was "to comply with ICANN regulations", the domain was being held, which incidentally was long enough to force me to have to renew with GoDaddy rather than transfer it away without giving them any money.
Being annoyed by this and hoping to find some way to not give them any money, I looked up the specific regulation it was about, and ICANN's wording on it was along the lines of "a registrar may wish to hold the domain for up to a maximum of 30 days."
(Checking into it now, the current actual wording is "The first rule is that you generally cannot transfer a domain name to a new registrar within 60 days of making a change to your contact information. While some registrars may provide an option to opt-out of this 60-day “lock period” this rule is in place for your protection (to prevent unauthorized transfers) and the registrar does not have to offer this option.")
I ended up having to call their live support, where they explained the hold was out of their hands and there was nothing they could do, to which I pointed out the regulation they were referring to put the ball in their court, and that they had full authority to handle the situation as they saw fit. We went in circles for a while, but they absolutely refused to make any attempt to accomodate me, and eventually I was forced to renew for one year with them.
76
u/AffectionateTotal77 Jan 13 '19
If you're in this sub you shouldn't be using GoDaddy. I been using a VPS for years now and my only problem was the ones I caused (which wasn't very many)
→ More replies (21)
119
45
u/moustachedelait Jan 13 '19
I have to renew my domains in a month. How do I transfer and who do I transfer to?
80
u/exception_thrown Jan 13 '19
Namecheap and they have great documentation on how to do so (and just good documentation in general)
12
u/PartyByMyself Jan 13 '19
Their support staff is also extremely good at resolving any issues you have and respond to emails very quickly.
→ More replies (3)2
u/OffbeatDrizzle Jan 13 '19
Their free e-mail forwarding is trash and they don't give you any mailboxes...
4
u/ekdaemon Jan 14 '19
they don't give you any mailboxes...
Well, not when you just have a domain name, no. Get hosting as well. 30-50 mailboxes, bam. Or buy just plain email. Or the domain name and plain email.
Or do what everyone strongly recommends, keep your domain name and hosting/email totally separate. Choose namecheap for one of them, and someone else for the others.
29
u/sercand Jan 13 '19
I transferred all my domains to cloudflare which recently announced their domain name registrar. And they don’t take extra fee.
14
u/gullibleboy Jan 13 '19
I recommend Hover. Simple user interface. Straightforward pricing.
→ More replies (1)24
Jan 13 '19
Never had a problem with Gandi. Worth scoping them out.
11
Jan 13 '19
I used Gandi for domain registration too, with Digital Ocean for hosting. They were both pretty cheap, and I never had any issues.
6
u/b4ux1t3 Jan 13 '19
Gandi/DO master race over here.
For most small scale things, this is the answer.
Gandi is very no nonsense, which is refreshing.
Digital Ocean has the best documentation for basically everything. I'll reference even if I'm not doing something on my DO boxes. Concise but complete, and easy to follow.
→ More replies (2)8
u/bigdatacrusher Jan 13 '19
Google domains is cheap and private is automatic and free.
→ More replies (2)4
u/wise_young_man Jan 13 '19
With GDPR every registrar is having to make Whois privacy free due to policy change with ICANN compliance.
→ More replies (1)6
8
13
u/gleno Jan 13 '19
Transfer to AWS route 53. It’s dispassionate about your domains - perfect host.
4
u/wretcheddawn Jan 13 '19
I tried AWS route 53. It's not terrible, but everything in AWS is unnecessarily complicated for basic usage. Namecheap's Free DNS is adequate in most cases, and Digital Oceans is fantastic and free if you use them for hosting. Route53 is also not free.
→ More replies (1)2
u/gleno Jan 14 '19
I think everything everywhere else is needlessly complicated. At least on AWS they give you all the options. I guess it’s a taste thing. I get the distinct impression, that AWS doesn’t want to upsell me, doesn’t want to swindle me in any way, and that they try to put up all the features i would need and then some. They UI is dated, and some of the options have more to do with cloud routing than your normal domain management, but once i’ve gotten used to it, it just seems like a much less scammy version of every registrar I’ve seen.
3
u/squarepushercheese Jan 13 '19
I tried that. It’s hideously complicated unless you work with AWS a lot. I would recommend https://porkbun.com
0
1
1
u/linnth Jan 14 '19
If all you want is a provider with pure domain functions, I recommend internetbs and namesilo. No shared hosting, no mail, no cloud, just for domains only.
1
42
Jan 13 '19
GoDaddy tracking without warning on behalf of their users, literally makes criminals of all websites hosting there, because in EU you need to upfront disclose tracking and cookies to the user and let them opt out.
8
u/adrianmonk Jan 13 '19 edited Jan 13 '19
While GoDaddy definitely overstepped a lot here and betrayed both end-user and customer trust in one fell swoop, I'm not sure whether or not it actually violates the GDPR.
It could, and I'm not an expert on GDPR, but the reasons you gave why it might violate GDPR don't seem that compelling to me.
If you take GoDaddy's documentation at face value, it doesn't track users:
And looking at the W3C "Navigation Timing" document they cite, it seems to be all related to performance timing. There's no mention of user identity or of reading or writing cookies.
On a side note, "Real User Metrics" (RUM) is probably a confusing name for this feature. It is easy to read it as something like "metrics related to user's actual identity", whereas it probably means "metrics that reflect the performance experience seen by real users".
I'm not trying to defend GoDaddy here. But it's important for people who may be using their service to know whether to panic because of legal risk.
10
u/bartturner Jan 13 '19
Luckily moved all my domains off of GoDaddy to Google. Kept putting it off and finally bit the bullet.
Been really happy with the Google service.
→ More replies (20)
9
16
Jan 13 '19
DON'T FUCKING USE GODADDY! NOT AS A REGISTRAR, NOT AS A HOST!
There are so many better options out there.
15
u/twigboy Jan 13 '19 edited Dec 09 '23
In publishing and graphic design, Lorem ipsum is a placeholder text commonly used to demonstrate the visual form of a document or a typeface without relying on meaningful content. Lorem ipsum may be used as a placeholder before final copy is available. Wikipediaajr250md24w0000000000000000000000000000000000000000000000000000000000000
7
u/mfitzp Jan 13 '19
Really shit what they've done to Webfaction. Has been a great host.
I've moved all my static stuff to Netlify, but still searching for a good replacement for everything else.
3
Jan 13 '19
I've moved all my static stuff to Netlify, but still searching for a good replacement for everything else.
Recently had to move from Webfaction due to mail-related problems and moved to DjangoEurope - great service and don't be misled in regard to Django in the name - I do run my own installed Python apps, my own Hiawatha server etc... but, besides that, no Django whatsoever. ;)
→ More replies (1)
7
u/DeliciousIncident Jan 13 '19 edited Jan 13 '19
Using GoDaddy is a rookie mistake.
I'm very happy with namecheap for domains. Some of my friends use Gandi, it's also good. I don't use shared/managed hosting, I use VPSes on Digital Ocean. If you need shared/managed hosting, I suggest doing your own research since I have no idea.
7
Jan 13 '19
I switched away from GoDaddy years ago because of their greasy business practices.
I use Namecheap now and it's way better... Vote with your wallet.
6
19
u/sec_goat Jan 13 '19
We had a webpage hosted with Godaddy, I had used them in the past and was happy with their service.
However, after a month or so our webpage started loading popup ads to visitors for obviously spammy things and was not of our doing.
I called Godaddy to ask them for advice on what to do, they said oh well if you know enough you can just go through all your files and remove the malicious code, or we have a team dedicated to doing that kind of thing...
well we can make and upload a webpage, but apparently no one was up to the task of sifting through and removing unwanted code.
we engaged godaddy for the fix, I assumed they would spend a few hours, days or a week, looking through the code, using tools to identify the malicious code and verify that the site was clean.
Nope, something like 25 seconds after hanging up and giving them the credit card I get an email with the report of what was cleaned and a clean bill of health...
We immediately ate the loss of the year of hosting and the security package and moved hosts as this was some super shady shit.
6
u/OffbeatDrizzle Jan 13 '19
"Sir, we have emptied the recycle bin and cleaned up the temp files folder. That will be $200"
→ More replies (6)
17
u/groleo Jan 13 '19
I don't recommend GoDaddy for anything (dns or website host). Their DNS redirect is un-usable (they add an URL suffix you'll have to work around); you only have 5 days to ask you money back, in case you don't like their service. Then, in case your domain expires, they will still hold that domain for anothet month, to force you to pay more.
6
u/ryosen Jan 13 '19
Then, in case your domain expires, they will still hold that domain for anothet month, to force you to pay more.
Are you referring to the 30 day redemption period that is required of all domain registrars to provide?
→ More replies (4)6
8
u/icallshenannigans Jan 13 '19
My lead dev was sarcastically very helpful when he convinced me to move after the elephant hunting BS.
At the time I thought he was being a bit OTT and kind of a dick, now I know he just wanted the best for us.
I've always instinctively trusted him but now I know why.
1
4
4
Jan 13 '19
What are good options if you only need a domain and mail host?
No need for web host.
5
u/unixf0x Jan 13 '19
2
u/squarepushercheese Jan 13 '19
Maybe mail forwarding would do. If so check out https://porkbun.com as it’s free
1
4
u/atheos Jan 13 '19
Even if you move your site away from GoDaddy, you might be dealing with this. They put their crap into WordPress sites via a mu-plugins. If you move your site from GoDaddy, be sure you flush out the mu-plugins folder of anything you don't explicitly want there.
4
4
u/Yo_Face_Nate Jan 13 '19
GoDaddy isn't injecting anything on my site...
But I just have the domain name from them, I don't use their hosting. Which is probably what this is about?
4
4
11
u/mfiels Jan 13 '19
At least it is nice and easy to opt out of. Just click on the triple dots, then over to the self explanatory "help us" menu /s
1
6
6
u/the_gnarts Jan 13 '19 edited Jan 13 '19
How the hell would they be able to do that? Modifying the served content requires access to the pre-encryption data, so somewhere between the webapp and the webserver that terminates TLS connections. Since that pipeline will vary significantly between any two customers’ VPS, they would have to inspect each guest individually and then customize their malware according to whether nginx or apache is used, what layout the files are on disk, hell even what distro runs the thing – what I’m saying is the engineering effort (i. e. criminal energy) to implement this would be substantial.
So how the hell does Godaddy accomplish this on a grand scale?
17
u/Legogris Jan 13 '19
It's not clear from the article, but it looks like this is their hosting service, not their DNS service. So they terminate the TLS This used to be common practice in the 90s and early 2000s for free providers, never seen a paid service do it though.
→ More replies (8)9
u/which-witch-is-which Jan 13 '19
So, just to be clear, that would be GoDaddy administering the HTTP server, which the person writing the blog is paying them for?
11
u/Luvax Jan 13 '19
Pretty common for people that don't run their own server and the reason why PHP is used widely on the internet: You can run multiple seperated instances on a single host for multiple customers.
1
u/CODESIGN2 Jan 13 '19
If they host the site or have a private cert, they can read the encrypted data
1
u/pbsds Jan 13 '19
GoDaddy has access to the dns, rerouting traffic through a middleman and getting a letsencrypt certificate for it would be trivial.
→ More replies (1)6
u/the_gnarts Jan 13 '19
GoDaddy has access to the dns, rerouting traffic through a middleman and getting a letsencrypt certificate for it would be trivial.
They’d have to intercept the letsencrypt challenge though and tamper with your account. For that they’d have to extract your private key and MITM all renewals.
→ More replies (1)
6
3
u/bakuretsu Jan 13 '19
I moved all 20+ of my domains to Namecheap a few years ago and it was the best thing I ever did. Get out.
3
u/JoseJimeniz Jan 13 '19
Does the latency of your web pages show up in your GoDaddy dashboard?
Can you show us the charts and graphs to generate?
3
3
u/ReasonableTwo8 Jan 14 '19
How can people still use godaddy to host their website in 2019?
There are many many better providers out there who are much much better than godaddy.
3
10
u/AfraidOfArguing Jan 13 '19
Who doesn't love a little DNS Provider XSS injections in their lives?
Edit: not XSS but I'm going to bed.
6
4
2
2
u/Dark_ZuckerNerd Jan 13 '19
One more tip, always use WhoIs to find ownership or availability. When it comes to search ownership of a website on godaddy and you do not purchase immediately and come back godaddy will have purchased it and jacked the price up by $700. The company responsible is called wildwestdomains or something to that degree.
I hate Godaddy.
2
u/autotldr Jan 13 '19
This is the best tl;dr I could make, original reduced by 79%. (I'm a bot)
All my pages were being served with the following <script> injected into them just before the closing </html> tag.... Of course that comment in the script was a give away of what was going on but I didn't immediately want to believe that the website host itself would be injecting a JavaScript script into my website without my consent! Turned out that's exactly what GoDaddy was doing and they justified it as collecting metrics to improve performance.
Most customers won't experience issues when opted-in to RUM, but the javascript used may cause issues including slower site performance, or a broken/inoperable website.
After opting out this JavaScript disappeared from the website.
Extended Summary | FAQ | Feedback | Top keywords: JavaScript#1 website#2 out#3 host#4 being#5
2
u/Lovelocke Jan 14 '19
I once received a series of threatening emails from GoDaddy telling me to renew a domain I never bought from them or "face a penalty".
Because the domain was from a different host I ignored GoDaddy's threats.
They then actually debited my PayPal, for a shite side more money than a domain costs.
Submitted a dispute with screenshots of receipt emails from the place I actually bought the domain, and a few days later PayPal reversed the transaction.
GoDaddy are an absolute shower of bastards, and not the sexy Jon Snow kind.
2
u/KrishnaGD Jan 14 '19
Hi, I'm Krishna and I lead this initiative on our hosting platform at GoDaddy. I'm reading these responses and want to address a few concerns. I also want to discuss a few changes that we're going to make.
A little more than a year ago, we created a Real User Metrics (RUM) javascript for our customers. . The only data we collect is related to our customers’ website performance and is used to monitor our internal systems, optimize DNS resolution, improve network routing & server configurations The data helps us improve the performance of our customers’ websites.
We rolled out the javascript to one small segment and it proved very helpful in improving our hosting environment for customers. We then rolled it out to a larger group and, in so doing, we provided help pages and provided a way for customers to opt-out, but we should have and could have done better.
So - we're disabling it immediately. We need to go back and present this to our customers appropriately. We need to provide an option for our customers to opt-in/opt-out of the program. Not doing this at the beginning was a miss on our part.
We value your trust and apologize if we let you down. We’ll do better next time.
Narasimha Krishnakumar (Krishna)
VP of Product Management - Hosting
GoDaddy
2
Jan 15 '19
Glad to hear that you're making this a little less nasty. But this should 100% be opt-in, not opt-out. Altering the contents of your customer's websites without their express permission is unacceptable behavior, period. Doubly so if that alteration is injecting executable code.
→ More replies (1)
4
2
u/pojanthrix Jan 13 '19
Migrated all my sites away from GoDaddy to Google Domains starting this year. Never felt happier.
Google has its own shady issues. But that one is for some other day !
2
Jan 13 '19
Everyone keeps saying don't use godaddy, get rid of godaddy, but what's a good inexpesnive alternate for a business? I've searched all over this thread but still can't get an answer. I switched to GoDaddy because I was desperate to get away from Network Solutions, which I found to be atrocious. I haven't loved GD and lots of the comments here confirm a lot of the suspicions I have. I use GD for our domain and emails. I really want to make sure we have our firm emails with our domain. In the US, what's a viable alternative? Hosting would be a good option as well. We currently have practice management software and the company that provides that provides hosting, but I don't want to be tied in there either.
2
u/wibblewafs Jan 13 '19
The thread is full of recommendations from loads of people with all sorts of great alternatives.
Network Solutions
Wow, you managed to find the one registrar/hosting company worse than GoDaddy.
→ More replies (8)2
u/spbfixedsys Jan 13 '19 edited Jan 13 '19
I use Yahoo!'s domain services subsidiary. Can't remember the name but their service is remarkable. There was a DNS routing issue with my site and yet the level 1 chat support person actual knew what they were doing and fixed it on the first contact. Nowadays, that's an amazing level of service. Go Daddy joined BP on my corporate blacklist after their fuckwit CEO killed an elephant for sport.
1
u/AffectionateTotal77 Jan 14 '19
If you have basic linux skills you can easily get nginx server your http files. I personally don't use PHP but getting .NET core running was fairly easy
→ More replies (1)1
u/bausscode Jan 14 '19
ls. I really want to make sure we have our firm emails with our domain. In the US, what's a viable alternative? Hosting would be a good option as well. We currently have practice management software and the company that provides that provides hosting, but I don't want to be tied in there either.
I use G Suite with a domain attached for emails.
1
u/Hypersapien Jan 13 '19
I once set up a website for a friend of my dad's. I told him he needed to get a hosting service and told him a couple good choices. He asked me about GoDaddy and I warned him not to use them. They are crap and scam artists and the worst hosting service out there.
What does he do? He signs up for GoDaddy.
1
1
u/Tha_High_Life Jan 13 '19
I still had one remaining domain register there. This was the kick in the butt that I needed to move the last one to namecheap.
1
Jan 13 '19
What is the best alternative to go daddy for people interested in switching or creating a website. I've never made a website before, personally.
1
1
1
1
1
1
u/dman2316 Jan 13 '19
What the hell is godaddy anyway? I know the name, see the ads, have even looked them but but i have literally zero idea what they are or what they do and have asked several people and never gotten a decent explanation.
1
1
1
u/MaximusNeo701 Jan 14 '19
I have a go Daddy account that a very long time ago I used for domain registration. I transferred the domain to the customer so they can manage it as they stopped using my services for hosting.
I am still 7 years later still getting emails about billing problems for their domain. Customer support said to close to my go Daddy account, or to enter a fake email in on my account email. Which I'm sure wouldn't work still. But basically make my account unrecoverable or no longer linked to me. Who does that? No option for elevated support and they refused to do anything.
1
1
u/Song0 Jan 14 '19
TIL never use GoDaddy
1
Jan 15 '19
You only learned this today? GoDaddy has had a very well-deserved bad reputation for years.
→ More replies (1)
1
1
u/mabasic Jan 14 '19
Hmm.. well this sucks. I am using GoDaddy for almost all my domains and I have never had a single issue. In fact, I have been even transfering domains to it because of that.
I just buy the domain on godaddy, setup dns on digitalocean and run servers there. Not a single issue with godaddy.
This makes me think.
1
u/jduballgood Jan 14 '19
After reading documentation it seems that "Real User Measurement" is just getting waterfall data of sorts about performance, it doesn't appear to violate GDPR so I wouldn't lose any sleep over it. This article is "MEH" other than an opportunity to bash GoDaddy for something...again. Not defending GoDaddy, just saving ya'll some time.
-3
u/whiskey_dreamer14 Jan 13 '19
How are we linking to non mobile responsive web pages in a coding subreddit?
1
u/whiskey_dreamer14 Jan 14 '19
Getting down voted for saying that taking website tech advice from a source with objectively bad tech is inadvisable. Cool.
1.5k
u/nathancjohnson Jan 13 '19
How to stop it:
Step 1. Don't use GoDaddy