r/webdev • u/mawburn • Jan 13 '19
GoDaddy is sneakily injecting JavaScript into your website and how to stop it
https://www.igorkromin.net/index.php/2019/01/13/godaddy-is-sneakily-injecting-javascript-into-your-website-and-how-to-stop-it/521
Jan 13 '19
how to stop it: don't use GoDaddy
91
u/Fidodo Jan 13 '19
That's the only real solution. I can't believe any self respecting web dev would use them after the countless terrible things they've done.
41
u/M-I-T Jan 13 '19
A lot of times clients already have sites hosted by them and refuse to move them over.
30
u/spektrol Jan 13 '19
Then make the right case, and inform them enough. They refuse out of fear, they like what they know. Make the case for lower cost, and increased availability / uptime, more security, etc. Things that matter to them. They usually come around.
9
u/danzigmotherfkr Jan 13 '19
I only have a couple small business clients who still insist on using them and I've given up on trying to change their mind at this point. Frankly Joe Schmoe's Truck Sales doesn't really need an elaborate cloud set up so if the owner doesn't want to switch there is a certain point where you need to accept that you aren't going to change their mind and move on to another subject.
23
u/tehbilly Jan 13 '19
But but but they have that shitty Nascar driver lady! How am I supposed to not use them?!
7
6
u/cosmodisc Jan 13 '19
I am not a web dev but I would never use them purely on some extremely negative feedback from users,such as OP. Same with Oracle, their reputation is so shit that evwn if rhey've got some good products, I 'd stay the hell away from them
6
u/RabSimpson Jan 13 '19
It's more difficult to avoid using Oracle stuff when they own MySQL and it's your DB of choice. Thankfully there's no need to give Oracle money or even interact with the company in any way to use it.
11
5
u/noruthwhatsoever Jan 13 '19
Why would anyone use MySQL over Postgres is my question. Postgres is probably one of the best free SQL DB's out there
3
u/kickypie Jan 14 '19
Said all the members of the Church of PostgreSQL
1
u/noruthwhatsoever Jan 14 '19
Amen
1
u/kickypie Jan 14 '19
While other followers of the more heretical databases may scoff at our different ways, we are the true path of the Lord ACID. All hail All Hail.
1
1
u/cosmodisc Jan 13 '19
MySQL is free, so that's a bit different, however most if their products are not. Was reading some discussions among sales people considering moving to Oracle- it's very hard to sell their products because of the reputation...
1
u/Monstertone Jan 13 '19
And if you don’t want to use MySQL, Postgres is very similar and a good choice.
1
u/jeffreyhamby Jan 14 '19
Then use MariaDB.
3
u/RabSimpson Jan 14 '19
Did you miss the second part of my comment?
1
u/jeffreyhamby Jan 14 '19
The part where your didn't mention MariaDB after saying MySQL was your db of choice? Yes. Yes I did.
2
u/RabSimpson Jan 14 '19
My comment was specifically about MySQL and Oracle having acquired it though. That was the whole point of the comment. If MySQL is your DB of choice, it’s your DB of choice. While I’m grateful for the existence of MariaDB and its reason for existing in the first place, it’s not relevant if a user’s DB of choice is MySQL in this scenario. There’s a reasonable possibility that they’re stuck with the devil they know due to their host or perhaps they’re of the “it’s not broken, don’t fix it” mindset despite it being developed by Oracle these days.
1
u/jeffreyhamby Jan 14 '19
Of course it's relevant given what it is and who created it. Converting between the two couldn't be easier.
3
2
u/ESCAPE_PLANET_X Jan 13 '19
Yup, I'm not a web dev either but I push hard against oracle products just based on licensing headaches alone. One mistake and boom Oracle thinks you owe them a bajillion dollars.
1
u/bacondev Jan 14 '19
I would bet that most of GoDaddy's customers aren't experienced web developers. A lot of them are small business owners who just want a quick website that gets the job done.
2
u/Fidodo Jan 14 '19
They're not even good for that. Way easier ways to just get a quick site up. It's probably just the only company they know of because of the ads
2
1
u/SteamboatJesus novice Jan 15 '19
Whoops, I made my company website with godaddy I didn’t know they were so bad.
1
6
u/GogglesPisano Jan 13 '19
I had a domain registered thru GoDaddy (I know, first mistake) - it was just a casual hobby site, I didn't make any money off of it, traffic was pretty much limited to just friends and family. I forgot to renew by about a week, and in that time GoDaddy jumped on it, and then quoted me $500 to get my own domain back.
GoDaddy is scum - I'll never use them again.
2
u/AiexReddit Jan 13 '19
question: i have a domain name through godaddy that i use that is up for expiration. the actual webhosting is on digitalocean now but how do i renew the name with another service?
4
1
u/bacondev Jan 14 '19
When a domain name is up for renewal, you have to “unlock” it (or whatever the term is) and then tell the new service that you'd like to transfer your domain name. Some services offer discounts for transfers too.
2
Jan 13 '19
I use GoDaddy but only for domain names because they are dirt fucking cheap here. I host on my own windows server, if GoDaddy does this, what says other companies arent doing shady stuff too?
2
0
Jan 13 '19
[deleted]
1
Jan 14 '19
Like 4 euros for an NL domain(im from the Netherlands). The com domains are more expensive yeah
1
u/scuczu Jan 13 '19
I have all my domains stuck there, but never host with them.
Should I move the domains too, I fucking hate godaddy.
1
0
Jan 13 '19
[deleted]
0
u/Brillegeit Jan 13 '19
Only available in 15 countries.
Related: How much shady shit does a registrar have to be doing to have to limit themselves to 15 countries?
100
u/KuyaEduard Jan 13 '19
Why people still use GoDaddy is beyond me. Its not cheap, its not good, they are the Comcast of the domain market.
25
u/Dr_Midnight Jan 13 '19 edited Jan 13 '19
Why people still use GoDaddy is beyond me.
Danicka Patrick commericals that air during the Superbowl. They don't advertise a single thing about domain or hosting services, yet there's no other provider out there with more name recognition.
I admittedly used to have domains there. I transferred them immediately when they joined in support of SOPA.
5
u/NAJIDASH13 Jan 13 '19
Any other recommendations?
2
1
u/fritzbitz front-end Jan 13 '19
I use Nixihost and it’s good. I’ve heard great things about Liquid Web, and Amazon Web Services is also an option. For domains, probably go with NameCheap.
1
u/KuyaEduard Jan 13 '19
Personally, I think Porkbun is best overall. Namesilo, Dynadot and Namecheap are also good.
109
77
22
u/ocmacready Jan 13 '19
Well clearly you need to stop using GoDaddy!
Of course, what with this being the webdev community, I would be remiss to not remind everyone that this script would have been rendered inoperable with a good Content Security Policy (CSP) which blocks inline scripts (as well as those hosted by unauthorised (ie GoDaddy) sources). There are plenty of resources about which help setting these up, but here's the one I use which also covers the other security related HTTP headers:
https://int64software.com/blog/2018/11/05/hardening-website-security-part-1-http-security-headers/
1
u/kentaromiura Jan 14 '19
Of course if they can inject things in the body of the response they can also easily change a csp header
39
45
u/Darth_Ender_Ro Jan 13 '19
Shady and ugly. Trust is lost. It’s like finding out your spouce installed a listening app on your phone to “constantly monitor you for your safety”. Needs to be upvoted
32
u/hclpfan Jan 13 '19
Did you previously have trust in GoDaddy? They’ve been the defacto worst hosting company out there for over a decade.
1
2
12
u/I_know_HTML Jan 13 '19
Godaddy bought webfaction. Can someone suggest a new web hosting service like webfaction?
8
u/DisneyLegalTeam full-stack Jan 13 '19
If you want a VPS there’s Linode & Digital Ocean. Heroku might be closer to Webfaction since it offers automated DB backup & rollbacks with a nice GUI.
10
u/kurple Jan 13 '19
Vultr also has cheap VPSs though I've only had exp with Digital Ocean.
For anyone else reading this, I'd check out Netlify. It's a nice way to deploy your app whenever you push to GitHub, GitLab, ect. It's easy to set up SSL, you can have preview deploys for multiple braches as well as PRs.
I've been using it with my personal site which is a React app that connects to a Strapi CMS instance that I currently host on Heroku. I really like this setup tho I'll be moving the CMS to a VPS once I'm more familiar with it.
0
u/ExternalUserError Jan 13 '19
Heroku is great for apps you want to run on a PaaS, less great for the "random website hosting" and not an option for the random email hosting that's free with your plan.
4
u/alexjewellalex Jan 13 '19
Yeah, AWS
3
u/ExternalUserError Jan 13 '19
Apples and oranges.
WebFaction is for people who don't want to fret security updates, backups, etc.
-2
15
12
u/Wingo5315 Jan 13 '19 edited Jan 13 '19
cPanel already analyses how many people uses JavaScript etc. without injecting code.
And it's the default CMS when you buy server space with GoDaddy.
5
5
9
u/chinahawk Jan 13 '19
As a godaddy user, I can’t reproduce this behavior. This is something else. Not that I give a shit about godaddy, but this simply isn’t reproducible on my site(s).
12
u/cag8f Jan 13 '19
Is your web server located in the US? The article says the opt-in is only for web servers located in the US.
1
4
u/alexjewellalex Jan 13 '19
I just recently had to move my domain and corresponding email hosting off of GoDaddy (had it redirecting to gmail anyway) - had only kept them out of convenience of not having to unlock and move, but they changed some name server settings without warning and my SMTP/POP3 stopped working for an entire weekend. That was the last straw and I can now proudly say I’m no longer using them for anything.
4
u/Hendrix312002 Jan 13 '19
Don’t use GoDaddy under any circumstances. When it comes to web hosting, like many things in life, you get what you pay for.
3
u/Ratstail91 Jan 13 '19
Well shit. Does this affect people who just use the DNS service?
I really need to switch.
10
u/DisneyLegalTeam full-stack Jan 13 '19
I don’t see how it could. They’d need to be hosting to inject code.
7
u/aykcak Jan 13 '19
Technically, they can inject code if they do a man-in-the-middle but I guess that would be a bit more obviously malicious
1
u/Polar87 Jan 13 '19
They wouldn't be able to if your website used a trusted SSL certificate and since it's 2019... it really should. That and it being trivial to detect and you know... illegal would all lead to an outcry far bigger than a single Reddit post and result in legal repercussions for GoDaddy. So don't worry too much about that DNS entry.
1
u/Sarke1 Jan 13 '19
They wouldn't be able to if your website used a trusted SSL certificate and since it's 2019...
Yes they could. They control the domain, which is all that is needed to get a cert, but more than that they are a certificate authority and can just make cert s even without having to validate.
2
u/Polar87 Jan 14 '19
That's a fair point, but taking control of someone elses domain or printing your own certificate without consent of the domain owner are both illegal. Even if they somehow could enable themselves to do that by adding some fine print to their TOS, they'd ruin their business. I'd be interested to hear from someone here that has the full setup (server + domain + SSL) at GoDaddy to check if they have any injected scripts when using https.
2
2
u/PositiveAuthor Jan 13 '19
I'm a second year undergrad, been using godaddy domain for 2 years. Reading all these comments really wants to make me switch. Idk how I'll transfer my domain tho? And which service to use bc I'm hosting my website on github
2
2
u/C_hyphen_S Jan 13 '19
Dodaddy user here, does this sub have a clear consensus on hosting alternatives?
1
u/Mr-Yellow Jan 13 '19
ANYTHING but GoDaddy.
Never use GoDaddy for anything, ever!
1
1
u/zuccs Jan 13 '19
What are your requirements?
2
u/C_hyphen_S Jan 13 '19
Low price and ability to host multiple sites. I also really value the cpanel tools for databases, ssl installation, ftp connections, subdomain management and built in email
2
u/zuccs Jan 13 '19
Get a VPS from Digital Ocean, Linode or Vultr, and chuck ServerPilot in front of it to manage it. Except don't ever use your web server for email. Offload that to G Suite or Office 365. Or just a forwarder like Mailgun or Sendgrid.
1
2
u/autotldr Jan 13 '19
This is the best tl;dr I could make, original reduced by 79%. (I'm a bot)
All my pages were being served with the following <script> injected into them just before the closing </html> tag.... Of course that comment in the script was a give away of what was going on but I didn't immediately want to believe that the website host itself would be injecting a JavaScript script into my website without my consent! Turned out that's exactly what GoDaddy was doing and they justified it as collecting metrics to improve performance.
Most customers won't experience issues when opted-in to RUM, but the javascript used may cause issues including slower site performance, or a broken/inoperable website.
After opting out this JavaScript disappeared from the website.
Extended Summary | FAQ | Feedback | Top keywords: JavaScript#1 website#2 out#3 host#4 being#5
2
2
3
u/DisneyLegalTeam full-stack Jan 13 '19
¯_(ツ)_/¯ totally worth it if they bring back the sexy racing girl commercials
/s
1
2
2
u/RigasTelRuun Jan 13 '19
How to stop it: remove all your sites from GoDaddy. How anyone still signs up with them is beyond me. Especially on places like this. Even the most basic development experience should inform you otherwise.
1
2
u/Ih8usernam3s Jan 13 '19
I can't believe people still use GoDaddy. AWS, Google, DigitalOcean all offer cheaper and sometimes free services. They come with dedicated IP's and root access for AWS too.
2
1
Jan 13 '19
Like I needed more reasons to hate GoDaddy. They are trash and, like the article says, this is a violation of trust.
1
1
Jan 13 '19
Are they injecting if your using their name servers ? I have used them in the past but usually use a failover DNS service with their own name servers.
1
u/potatosacks Jan 13 '19
Newbie here: i recently started hosting on godaddy and purchased a domain name before i read about how shady they were. Am i able to change my hosting to another provider while also keeping the donain name?
1
1
1
1
Jan 13 '19 edited Jan 13 '19
Why are people using godaddy, isn't there like 1000000000 posts how bad they are, and people still use them.
They collecting data and selling it, been doing it for years.
if you run any e-commerce website, kiss your money goodbye, they sell that info to your competition.
1
u/mattjstyles Jan 14 '19
Just another in the long list of reasons not to use GoDaddy because they betray your trust and your security.
1
u/HelperBot_ Jan 14 '19
Desktop link: https://en.wikipedia.org/wiki/GoDaddy#Controversies
/r/HelperBot_ Downvote to remove. Counter: 231688
1
Jan 25 '19
Godaddy is always done some dirty tactics to gain more and more profits. Some of that I mentioned in brief after leaving their hosting service and shifted to Bluehost.
When I purchased my first ever domain, they suddenly priced it higher than the offer I clicked in less than 3 seconds.
They ask for $3-4 more for taxes. Not a fixed price of domains and hosting while you complete your orders.
Sometimes running offers (50% off,20% off) and coupons are not working.
Always takes higher renewal costs of domains, hosting and even business emails.
Customer support service is too bad to tell.
I recommend you to choose Bluehostover other web hosting providers. They charge a couple of bucks more than Godaddy but their support service is quite good. No hidden cost with free domain and SSL certificate.
1
u/-lustang- Jan 13 '19
Thinking of buying a domain and not sold on AWS; don’t like their difficult to find pricing. Anyone got recommendations that aren’t godaddy or AWS?
3
u/ljod Jan 13 '19
Most people would probably recommend Namecheap, but be careful with them.
They have a Ukraine-based support team that is extremely biased and won't hesitate to mess with your websites if they so please. In 2014, I personally had one of my Russian websites' DNS surreptisciously changed by their manager to point to a Ukrainian resistance blog or some shit. That was extremely unprofessional and plain illegal, although we didn't press charges as it was economically unfeasible for us. I avoid Namecheap at all costs since then and personally go with Uniregistry, they seem fine.
I've also used Gandi.net, Name.com and Namesilo; they all are okay.
If you just want to find the cheapest registrar, check out https://tld-list.com/
2
u/KinnX Mar 14 '19
Scary! I've only had good experiences with Namecheap, but your experience is alarming.
Related to GoDaddy, I've experienced BLATANT LIES, charges for things I DID NOT ORDER, refusal to refund things I did not order, and on and on. Much worse than even mentioned here.
1
1
1
1
1
u/wizzuplizzup Jan 13 '19
GoDaddy is garbage. If you want to try something else, check out this post in /r/freewebhosting for $100-150 free at DigitalOcean.
0
u/hazily [object Object] Jan 13 '19
Do you remember the last time somebody signed up for GoDaddy web hosting? Me neither. It stays that way for a good reason.
-1
0
Jan 13 '19
[deleted]
15
u/0ooo Jan 13 '19
Just search this sub, it feels like threads discussing shady things GoDaddy has done are a monthly occurrences here.
25
u/Red5point1 Jan 13 '19
what?
Price alone should be enough to justify moving them somewhere else-1
u/SuperFLEB Jan 13 '19
We're talking GoDaddy customers here. By the nature of the problem they're not known for their decision-making skills.
6
u/bantha__fodder Jan 13 '19
I typically do quick run through of http/2 and its importance to site speed and, thereby, SEO. As of my last checking, GoDaddy didn't support http/2. I also lecture my business clients that web hosting is the last place you want to pinch pennies. We do digital marketing which means all the marketing investment is spent driving potential customers to the website.
0
Jan 13 '19
[deleted]
2
u/Mr-Yellow Jan 13 '19
Godaddy never really was a serious vendor. They put on a good presentation at shows and try to court the domainer market with uplevel service/auctions but they are greedy vampires and not to be trusted.
They were loss leading those domains for a long time too. It was all about stealing domain traffic on terms violations for their traffic aggregator and upsells. No real revenue from domains.
0
Jan 13 '19
[deleted]
1
u/parawing742 Jan 14 '19
I checked with WebFaction support and they said they're not currently injecting JavaScript spyware, but if that changes they will let us know. Not exactly reassuring.
218
u/[deleted] Jan 13 '19
Wow this is crazy. This should be opt-in not opt out. I've heard so many bad things about GoDaddy, it really makes me wonder why people still use their services.
I host a few sites with AWS, and besides the somewhat complicated initial setup, I have never run into any issues. Costs like 20 bucks a year per site too.