16 ms·

GoDaddy injecting JavaScript into websites and how to stop it

949 points by ikromin 8y ago

good_guy 8y ago
Or you could just move to a better hosting service.
hilyen 8y ago
GoDaddy has always been horrible.
walrus01 8y ago
Nobody should ever use godaddy for a domain registrar or hosting services. Ever inherited a domain that was with them, and had to renew it? The sheer amount of unsolicited add-on offers you have to reject before successfully completing a payment for domain renewal is ridiculous. There's a reason why companies like namecheap which market themselves on "no bullshit" registrar services are popular these days.
- iamdave 8y ago
  I've been buying exclusively from Domai.nr for the last five years now, and I only ever login to buy a new one, or change payment details--which ends up with me rarely having to login. Years ago when I was with GoDaddy and starting my time on the web, it was daily, I knew some of their support people by voice. As far as "no bullshit" registrars, Domai.nr has been short of incredible. Thought I'd share the option if anyone is looking to migrate and at least wants options on the table to think about, along with namecheap.
- notyourwork 8y ago
  Namecheap has been great, I've also had good luck with Gandi.
namuol 8y ago
How to stop it: Use a different hosting service.
- calibas 8y ago
  Their marketing is effective at convincing small business owners they're one of the best choices for hosting. That's pretty much the whole reason they're so successful.
- mark-r 8y ago
  I thought that would be good enough, I went with WebFaction. But it seems they recently merged with GoDaddy, so even though I explicitly avoided them it turned out I didn't. Who's a good alternative these days?
  - ahmedalsudani 8y ago
    Hover, Gandi, Namecheap, AWS, Google, Cloudflare. There are many decent alternatives. From the above, I have used all but Google and Cloudflare. My experience has been pleasant with all that I have used.
    - mrep 8y ago
      Lol. Every company you listed gets blasted all the time here on HN. I normally don't like qoutes but i think the Batman one fits well here with how people perceive companies: 'You Either Die A Hero, Or You Live Long Enough To See Yourself Become The Villain'
    - tracker1 8y ago
      I've been very happy with Google's registrar service... the only down side is you cannot bulk edit contacts. The couple times I've needed support they've been available within a couple minutes (once by phone, twice in browser chat). Not like any other Google support issue. Some prices are a little more than GoDaddy, others a little less, that part was pretty much a wash. The biggest advantage over Google's registrar service, is there's no upsell, at least not that I noticed. They do offer some integrated service options. The included google dns hosting and mail forwarding services are great imho. It could use some slight improvements in UI/UX, but still better than any other registrar I've tried by a large margin. Mileage may vary, of course, but I really do like the service overall. I'm not affiliated with Google, don't always like everything they do, and do have some reservations about them as a company. That said, imho the best registrar option available.
ChuckMcM 8y ago
pretty much pure evil. But hey its GoDaddy right? There are at least three places where you can get injected, one is from the ISP (including phone company networks), one is from the hosting provider, and one is from add-ons in the browser. One of the first Java applets I wrote (and you could easily do this in js) did a hash over the document page and reported if the hash didn't match the one stored in the applet. These days you could throw up an other wise invisible div that said "Page Tampered" please report to webmaster (or you could even do that yourself with a lookup on your hosted side to a script that would log IP/browser etc.
- userbinator 8y ago
  These days you could throw up an other wise invisible div that said "Page Tampered" please report to webmaster (or you could even do that yourself with a lookup on your hosted side to a script that would log IP/browser etc. I've already encountered pages like that, they piss off everyone who uses adblocking/filtering so I would consider it an anti-user technique.
- markdown 8y ago
  > There are at least three places where you can get injected, one is from the ISP I'm not sure if they still do it, but Vodafone in my country (and many others) used to cache and compress photos on all websites, which often led to visible degradation in image quality. Luckily I discovered that their software respected the `Cache-Control: no-transform` header so include that header on all my websites now.
  - int0x80 8y ago
    Vodafone did also inject custom js/html in non HTTPS pages (obviously). This was 2 years ago.
    - markdown 8y ago
      That's right. The js rewrote all image src attributes to point to the "optimised" photos they'd cached.
throwaway8879 8y ago
The best way to stop it is to stop using GoDaddy. About 10 years ago.
willio58 8y ago
All interactions I’ve had with godaddy have been terrible.
kizer 8y ago
That's... very weird. It would seem OK if they were providing a CMS, but injecting when the person is already using their own code, so is likely to figure out what is going on, just doesn't make sense. Not sure how this seems worth it for GoDaddy.
obelos 8y ago
Who ever thought a registrar would be more awful than circa-1999 NetSol?
giancarlostoro 8y ago
I remember when I first bought a domain from them. I guess I fell for the marketing witchcraft, they advertised the domain for a lower price than what I ultimately paid, once I heard about Namecheap I went there and never looked back. My other problem was that their domain management interface was soooo slooooow, it got to me. This was in about 2008, but I rather not fall for their overpriced domains. Edit: My other pet peeve was that they supported SOPA when that whole mess was ongoing. I can't trust them at all since.
- joering2 8y ago
  You shouldn't trust Namecheap either. Just because nothing happened to your domain, doesn't mean when it does Namecheap will help. I had numerous issues over the years including someone being real jerk over their chat and just because of their rudeness and knowing my email and full name, was able to took over my account. Namecheap is not cheapest neither (Namesilo) https://www.trustpilot.com/review/www.namecheap.com https://www.trustpilot.com/review/www.namecheap.com
  - markdown 8y ago
    I've been very happy with Namecheap. I moved all my domains to them year that Godaddy did some bad shit (off the top of my head, they supported SOPA and the CEO Bob Parsons slaughtered an elephant in Zimbabwe for sport).
    - joering2 8y ago
      Well Namecheap is not much better... they are US corporation but CEO is fine to hire people wherever is the cheapest labor to serve american customers. Besides, he sounds super unprofessional to me; 7 months ago he was sparing with me because he chose to be blind who is #2 top registrar [1]. He suppose to know this shit as a CEO, no? Here is another nightmarish story: https://news.ycombinator.com/item?id=18206464 https://news.ycombinator.com/item?id=18206464 At some point they deleted someone's 75 domains without any warning or support to resolve the issue. [1] https://news.ycombinator.com/threads?id=NamecheapCEO https://news.ycombinator.com/threads?id=NamecheapCEO
J253 8y ago
Gandi is my go to alternative. https://www.gandi.net/en https://www.gandi.net/en
- EduardoBautista 8y ago
  Mine as well. Only major registrar with U2F. They seem to take security very seriously.
  - Niten 8y ago
    I've had good luck with Gandi in the past for SSL certificates, and their U2F support makes me inclined to choose them as my new registrar. On the other hand, I've heard less than great things about Gandi's reliability and support lately. If you've had to contact their support team, what's your experience been like?
    - EduardoBautista 8y ago
      I've never had to contact support, which might be a good thing. Although I did leave them for a while and am in the process of moving my domains to them.
  - Jerry2 8y ago
    >Only major registrar with U2F I recently went looking for a registrar and one of the must-haves was U2F. Only Amazon and Google had it. Didn't know that Gandi has it as well. Good to know! PS: I was disappointed that Cloudflare still doesn't have a U2F support yet they are a part of critical infrastructure for much of the web. We ended up not using them because of that.
  - JChase2 8y ago
    Namecheap is supposed to be getting it soon: https://www.namecheap.com/blog/true-totp-2fa-and-u2f-are-coming/ https://www.namecheap.com/blog/true-totp-2fa-and-u2f-are-com...
  - justusthane 8y ago
    Hover has U2F.
jppope 8y ago
might be a good time to remind everyone that cloudflare is providing profit-less domain renewals ;)
- shimms 8y ago
  But with fewer tlds supported (for now). Was excited to move my GoDaddy registered domains there, alas none of them are supported (yet).
- Jerry2 8y ago
  Cloudflare still lacks U2F. For domain names and hosting, this is something that you should not compromise on.
  - user5994461 8y ago
    Cloudflare has had 2 factor authentication for years. https://support.cloudflare.com/hc/en-us/articles/200167866-How-do-I-set-up-two-factor-authentication- https://support.cloudflare.com/hc/en-us/articles/200167866-H...
    - Jerry2 8y ago
      Not U2F. App/SMS 2FA can be bypassed.
guessmyname 8y ago
This is quite ironic because I used to work in the security team at GoDaddy, writing tools to scan and clean websites infected with malicious code injected the same way. To find out that the company is using the same technique (for something less malicious?) is very surprising to me. I guess they never asked for a review of this feature to the security team, otherwise I doubt they would have approved it.
- sk5t 8y ago
  The very notion that GoDaddy could be in a position to "clean" websites of malicious code is--what's the word?--stupefying? profoundly unsettling? mystifying?
  - Wintereise 8y ago
    Why? For those of us who've worked in hosting, it's a routine thing that you help customers do every day. At their scale, trying to automate it hardly seems surprising.
    - bpchaps 8y ago
      Could you give an example of when a customer would need that? I'm missing something.
      - gscott 8y ago
        A lot of SQL injections are malicious ad scripts that will be named the same on each hack. It would be pretty easy to remove something like that as it passes back through Godaddy's router. I would hope they notify the website owner because otherwise you wouldn't know that you have a problem.
      - guessmyname 8y ago
        If a customer’s website is being hosted in a shared account, the infection will quickly spread across the other websites in the same server unless the hosting provider takes the matter in their own hands. Years ago, it was common to simply suspend the infected website until the webmaster finished the cleanup by themselves. Nowadays, instead of suspending a website for a minor infection, some hosting providers simply clean the malicious code automatically, or offer a premium cleanup service if the infection is more complex.
ve55 8y ago
GoDaddy has always been one of the worst providers or registrars someone can use. I wish I was surprised by a practice this bad.
Brajeshwar 8y ago
The best "How to stop it" would be to change registrars. Domain registrar is a highly commoditized, extremely low margin, volume play business. There is always another company better than the other. Personally, I have a ResellerClub account that I 'sell' to myself and my families. I also use name.com and namecheap.com for both my personal and my companies domains. They all are good. There is Google too, and CloudFlare entered the market. Question: Even if one registers with GoDaddy, what if the DNS is at CloudFlare, it won't have this problem, right?
- lathiat 8y ago
  Doesn’t even matter where the DNS is. This is happening on the actual web hosting server.
userbinator 8y ago
Yet all my pages were being served with the following <script> injected into them just before the closing </html> tag... The free hosts I used many years ago would do something similar, with no way to opt out --- that is, until I figured out they were just detecting the '</html>' and inserting before it. Combine that knowledge with the fact that the closing tag of the HTML element is optional, and you can guess what I did pretty easily. ;-)
- jszymborski 8y ago
  If you want valid HTML, and if they aren't parsing the DOM, then the following would likely work as well: 
  - minitech 8y ago
    It’s valid to omit </html> (<html> too, for that matter).
    - naniwaduni 8y ago
      The idea is to have the mangler see </html> and inject their garbage right above it--into a comment. Unrelatedly, <html> is surprisingly hard to omit if you want to properly set the lang attribute.
      - abdusco 8y ago
        Any element can accept `lang` attribute, though. You can put it on the `<body>` element, but it wouldn't be as "proper". https://www.w3.org/International/questions/qa-html-language-declarations#basics https://www.w3.org/International/questions/qa-html-language-...
        naniwaduni 8y ago
        It's actually pretty easy to omit <body> (and <head>), so you don't gain anything from this anyway, either.
ssttoo 8y ago
How is this company still in business is beyond me. Maybe their clients are less savvy (non-HN-frequenting) site owners
- roywiggins 8y ago
  I think that's exactly their target market.
ilaksh 8y ago
Since people are recommending alternatives, take a look at Netlify. It's my new favorite thing. For me GoDaddy is like a client test. If they are using something else for hosting, plus one point to them. If they use GoDaddy for hosting, minus ten points. If you can't convince them to move away from GoDaddy, you probably want to replace that client if possible with a more reasonable or less cheapskate one. Also I believe that https would prevent injections.
- dpacmittal 8y ago
  Netlify is a static site hosting, it's more like Github pages than godaddy hosting.
- yjftsjthsd-h 8y ago
  > Also I believe that https would prevent injections. Depends where it happens. On shared web hosting, they control SSL termination and everything behind it.
foobarbecue 8y ago
I've used godaddy, namecheap, and 101domain. Godaddy was about ten million times better than 101domain in terms of customer service. I'm kind of surprised they would do something this malicious.
- vortico 8y ago
  This article is about GoDaddy web hosting, not DNS.
  - foobarbecue 8y ago
    oops!
thaumaturgy 8y ago
In case this turned out to be misleading, I picked a random GoDaddy-hosted low-cost site (hometailer.com) and yep, there's the code: <script>'undefined'=== typeof _trfq || (window._trfq = []);'undefined'=== typeof _trfd && (window._trfd=[]),_trfd.push({'tccl.baseHost':'secureserver.net'}),_trfd.push({'ap':'cpbh'},{'server':'a2plvcpnl83247'}) // Monitoring performance to make your website faster. If you want to opt-out, please contact web hosting support.</script><script src='https://img1.wsimg.com/tcc/tcc_l.combined.1.0.6.min.js'></script> https://img1.wsimg.com/tcc/tcc_l.combined.1.0.6.min.js'></sc... That's pretty gross.
- gigatexal 8y ago
  Happy with my namecheap domain hosted in Linode: never going to touch a godaddy domain for any of my needs.
  - abc-xyz 8y ago
    A lot of people recommending NameCheap in this thread.. it's worth noting that they supposedly gave a warning to a guy running a forum with millions of visitors that they would suspend his account if he didn't remove two images within 24 hours (https://news.ycombinator.com/item?id=14139288 https://news.ycombinator.com/item?id=14139288), and that they're dumping costumers private info (https://news.ycombinator.com/item?id=18063667 https://news.ycombinator.com/item?id=18063667). I'm guessing there are other horror stories as well, but those two alone (which to me sound credible) were enough reason to take my business elsewhere.
    - Fizzadar 8y ago
      This - after their support requested my password over live chat I've since moved every domain I own to Gandi upon renewal.
      - jacurtis 8y ago
        Hey, the same thing happened to me! They asked for my password during a livechat session, and i was like "what the hell". Also, another time I was having problems with their stupid 2FA app (back when they ran their own app and it broke constantly), and their solution was to just disable the 2FA for my account. They said I can set it up again whenever I want to. So then I told the woman, that if someone wanted to hack into my account, they could just open a livechat and get my 2FA disabled and then log in, why should I even bother having 2FA at all if you're just going to disable it. To be fair, they finally moved to a more traditional 2FA now, where you can use any 2FA app instead of their proprietary namecheap app. So they might not do this anymore. I think they were disabling 2FA back when they used their own app for it, because it was super buggy and people (like myself) would get locked out of our accounts for no reason other than their app was buggy.
hilyen 8y ago
The JS file creates cookies, which would break GDPR I am guessing.
- paulie_a 8y ago
  While this seems pretty terrible in general. The GDPR is generally irrelevant. A large amount of websites will never need to even think about GDPR. If anything there is an over reaction complying to a law that will never be applicable. GDPR matters to the EU. It doesn't apply elsewhere.
  - jobigoud 8y ago
    It matters to EU citizens. We are everywhere.
    - markonen 8y ago
      I'm sure it matters to you, but as a rule it doesn't apply to you if you reside outside the EEA. It applies to "an enterprise established in the EEA or—regardless of its location and the data subjects' citizenship—that is processing the personal information of data subjects inside the EEA" (emphasis mine, text from Wikipedia)
      - pmontra 8y ago
        This is the actual text of Article 3 of the Directive. Check point 2. It applies to (for example) an e-commerce in the USA if selling to somebody in the EU or to a USA company doing behavioral tracking if tracking somebody in the EU. In both cases, even if they are not EU citizens. Only the location matters. Territorial scope 1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. 3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.
technion 8y ago
I have created a gist with "beautified" version of the script the inject. https://gist.github.com/technion/5de5739ee803ed0641b2de816600f3c1 https://gist.github.com/technion/5de5739ee803ed0641b2de81660...
djsumdog 8y ago
I'm guessing this is some shared hosting solution where you don't have a lot of control or ability to add things like LetsEncrypt (but I'm sure GoDaddy will sell you their SSL offerings). I noticed some of my sites getting Vodaphone banners when using Ireland/UK sim cards and realize they were injecting crap into my site. That really helped me make the push to use LetsEncrypt on everything. I realize that 3rd party Wi-Fi/ISPs injecting code is a slightly different issue that the one in the article, but the solution is running SSL everywhere. If you need to login to a captive portal that redirects, there's always neverssl.com
- benjaminjackman 8y ago
  > If you need to login to a captive portal that redirects, there's always neverssl.com There's also: http://http.rip http://http.rip (which is easier at least for me to remember for some reason)
  - roywiggins 8y ago
    example.com responds on http, and since it's reserved by IANA I more or less trust it to not serve malware, so I always just use that.
linkmotif 8y ago
Serious question, why do people use GoDaddy? What does it have to offer in terms of price/features/anything that’s better than any other provider?
- joecool1029 8y ago
  It's cheap and it's a big company. They are basically the Walmart of domain registration. Out of having to deal with something like 40 or 50 registrars and resellers over the years I give them a slightly above average rating. Really, for all the bashing this thread people are giving there are far worse. They aren't great, but things will probably work with them. I'll talk about alternatives now. Yeah, I know Gandi is cool, but they want too much money so majority of people pass them by. If you want a really horrid example: 1and1 is a company that sets the bar. They buy up superbowl and print ads to lure in old people with cheap domain registrations (like $1 or so). Once sucked in they use a careful reading of the ICANN regulations to maximize difficulty in doing anything. Oh, you want a transfer? That's going to be a week. Most things either go over the phone or through a panel that's down or nonfunctional half of the time. Want to change nameserver delegation to your own DNS servers? Fuck you then. They wipe the current DNS records and process the change in a couple days. Your site can take a vacation. Now, I hear a lot of people saying Namecheap is a good choice. They are ok, we recommend them but their panel likes to shit the bed and it can take hours to push DNS updates when things aren't running great there. They finally got off being an ENOM reseller, which is great. ENOM are assholes. I had a client that hired an ENOM reseller some time ago to register their domain and host their site. The reseller's company's owner got arrested and/or deported and while we were able to save the client's files the domain expired with no way for us to renew it. The good news is you can gripe up the chain to ENOM which will require a 5 year domain registration for $200. That's it in a nutshell. They are a large company which has a service that mostly works for a cheaper price than arguably better options like Gandi. Shout out to other terrible registrars like Yahoo Small Business (ugh)
  - rawoke083600 8y ago
    "Now, I hear a lot of people saying Namecheap is a good choice. They are ok, we recommend them but their panel likes to shit the bed and it can take hours to push DNS updates when things aren't running great there." Yup !! Thats my experience also !
austincheney 8y ago
This has convinced me to take precautions. I am adding some logic to my site that if there are more than two script tags (I only have 2) replace body content with error text and send an xhr notification back to the server so that the server will know their pages are compromised It’s as simple as document.getElementsByTagName(“script”).length EDIT: Here is my tested more sane approach: https://gist.github.com/prettydiff/f9f85fffb00a903ecd3f2cfe0c276d62 https://gist.github.com/prettydiff/f9f85fffb00a903ecd3f2cfe0... I do not have an xhr notification in place in the gist, because I have not written a service to receive it yet.
- ATsch 8y ago
  You could do this much easier and better with a Content-Security-Policy. Whitelist the things you want to allow, and set a report-uri to get notified of any CSP violations.
  - austincheney 8y ago
    CSP wont help you if you authorize scripts with a source of self or if the malicious script contains a relative "src" attribute. This approach has the added benefit of letting you know that malicious things are happening.
    - lozenge 8y ago
      CSP has report options.
- franciscop 8y ago
  What about those plugins that the user chose and add a script tag? While they should be becoming less common (since I read it's a bad practice), they are still out there.
- im3w1l 8y ago
  Did you consider a "silent alarm", that only phones home without displaying an error?
throwdaddy425 8y ago
This is facepalm-worthy and very unsettling. This is why I use NameCheap.
dizzyfingers 8y ago
I’ve followed HN for around 10 years now but even basic stuff like this can come across as jazz to me. Funny thing is I understand jazz at a professional level. I feel foolish because I use godaddy, because they have good customer service and their interface is easy to understand but as a HN lurker I want to have good web etiquette. I’m going to see about turning this feature off in the way the author describes but what can I do to stay clear of the Kenny Gs of tech? Full disclaimer I have nothing against Kenny G, and even respect him, just one of those jazz expressions...
- Jedi72 8y ago
  Companies that do this kind of garbage don't deserve your dollars. Its not enough to apologise after the fact, or offer opt-out, or any other half measures. I'm moving my domains over to someone else this week because of this.
- DonHopkins 8y ago
  You shouldn't use godaddy unless you support exterminating elephants. https://gawker.com/5787676/meet-godaddys-ridiculous-elephant-killing-ceo https://gawker.com/5787676/meet-godaddys-ridiculous-elephant...
ATsch 8y ago
I think it's pretty unfortunate that even now, CSPs are getting so little love in the comments of a post where they would have easily prevented this script from loaded at all, and could have helped the author discover the script the second it was added. For the unitiated, Content Security Policies (CSP) allow you to, among other things, define a whitelist of origins for things like scripts, css etc. and also notify you of violations. There is little excuse to not set a strong CSP on your sites if you can and you'll be glad you have it once something does happen.
- Semaphor 8y ago
  > There is little excuse to not set a strong CSP on your sites true, but > if you can IIRC that excludes every website with Google Adsense and even just using a manual ad network includes always fiddling with your CSP.
  - kgwxd 8y ago
    Anyone using either of those doesn't care about user security and privacy anyway.
  - dcbadacd 8y ago
    > There is little excuse to not set a strong CSP on your sites Can't use CSP if you want any ads on your page usually. If anyone here knows an ad provider that plays nice with CSP and pays okay then please do let me know, I'd love to securely monetize a few webapps of mine.
- DCoder 8y ago
  Then again, Vodafone Portugal was caught rewriting CSPs of all your visited pages to whitelist their own domain last year [0]. [0]: https://twitter.com/JackyHallyday/status/968263408003973121 https://twitter.com/JackyHallyday/status/968263408003973121
  - jopsen 8y ago
    Nothing can save you if you don't trust your hosting provider, or don't use HTTPS. However, "was caught" is important :) The more noise they make the more likely they are to get caught.
boramalper 8y ago
> …and how to stop it by not using GoDaddy. I mean sure, it’s fixable, but this shouldn’t be a norm (for a paid service)!
oyebenny 8y ago
How does someone stop their internet service provider from doing this?
- ndnxhs 8y ago
  VPN/https
ddtaylor 8y ago
> "Monitoring performance" I can't think of anything related to performance of the server that can/should be monitored using a client-side script versus a server-side component.
heipei 8y ago
I originally built a service to detect exactly this kind of large-scale injection of content and similar occurrences (e.g. library prevalence etc). This is a perfect example of how to find the GoDaddy injected content: https://urlscan.io/search/#%22tcc_l.combined.1.0.6.min.js%22 https://urlscan.io/search/#%22tcc_l.combined.1.0.6.min.js%22 Another provider I found doing something similar is 000WebHost: https://urlscan.io/search/#filename%3A000webhost https://urlscan.io/search/#filename%3A000webhost They "just" inject a footer with an image and a link to their service though. Not sure how common this is in the low-cost hosting space.
- ndnxhs 8y ago
  000webhost also had their database leaked with plain text passwords.
Too 8y ago
Enabling HTTPS only should stop this right? Or are they able to inject it even then since they are the hosting provider?
- tuxone 8y ago
  No and yes.
  - m-ueberall 8y ago
    Are you sure they have full access to your TLS certificates? Or can't you bring your own in this case?
    - tuxone 8y ago
      They host the website thus they can inject anything anywhere in the body before https kicks in.
    - dan1234 8y ago
      It depends how the code is being injected. If they’re using a an output filter on the web server, they could do it before the encryption stage. See http://nginx.org/en/docs/http/ngx_http_sub_module.html http://nginx.org/en/docs/http/ngx_http_sub_module.html & https://httpd.apache.org/docs/2.4/filter.html https://httpd.apache.org/docs/2.4/filter.html
dzek69 8y ago
It reminds me times of 5MB free web hosting from 2000 or so. A lot of them was doing it.
zzo38computer 8y ago
If someone is injecting JavaScript codes into your website and you do not want, put your own JavaScript codes which cause it to display a message asking the user to disable JavaScript if they want to access your webpage!
zaro 8y ago
> Luckily there is a way to turn this off Luckily I am not using GoDaddy and most probably never will.
charliebrownau 8y ago
stop using godaddy problem fixed
pdkl95 8y ago
The document ($PAGE + $NEW_JS_SCRIPT) is a new, different work. I doubt the added Javascript is a large enough change to be considered "transformative" and worthy of a separate copyright. The new work isn't a fair use of the original work, because it doesn't meet the statutory requirements[1]: 1) isn't a protected use (education, journalism, criticism, etc), 2) the original work is usually creative and (patently) published, and 3) the entire original work was included. Since the Javascript was added without without consent (or even any notification), we can assume GoDaddy hasn't negotiated with the original authors for a license to made derivative works. Therefor this is probably a violation of copyright. Does anybody using GoDaddy for hosting want to sue GoDaddy? Statutory damages up[2] to $150,000 per work adds up fast. [1] https://www.law.cornell.edu/uscode/text/17/107 https://www.law.cornell.edu/uscode/text/17/107 [2] actual damage amount in copyright cases varies a lot - this is simply an upper limit
- naniwaduni 8y ago
  Sadly, I think they have their ass covered in their TOS, under "User Content Other Than User Submissions": "You hereby grant GoDaddy a worldwide, non-exclusive, royalty-free, sublicensable (through multiple tiers), and transferable license to use, reproduce, distribute, prepare derivative works of, combine with other works, display, and perform your User Content in connection with this Site, the Services and GoDaddy’s (and GoDaddy’s affiliates’) business(es), including without limitation for promoting and redistributing all or part of this Site in any media formats and through any media channels without restrictions of any kind and without payment or other consideration of any kind, or permission or notification, to you or any third party." I'll admit I didn't look that closely though.
- beokop 8y ago
  While you’re at it, why not sue for emotional distress? Or lost income for the time reading this instead of billing clients? I’m all for GoDaddy being held responsible but advocating this kind of copyright abuse is as ridiculous as it is scary. Are we going to start suing CDN’s for setting custom HTTP headers now?
- jopsen 8y ago
  You've presumably given GoDaddy a license to serve your content if you're hosting it on GoDaddy. It's probably all covered by some user agreement. I think the important part is: Use a hosting provider you trust!
robin_reala 8y ago
I use a CSP on my site to work around potential JS injections: script-src 'none'. Possibly a little heavy handed but it does the job.
quickthrower2 8y ago
GoDaddy: the SourceForge of web hosting.
- tracker1 8y ago
  ^^^ This is a very appropriate analogy.
throwaway321388 8y ago
This is nothing. India's state-owned ISP BSNL routinely injects js tracking and ads into HTTP pages. https://www.reddit.com/r/india/comments/8wj6ec/bsnl_and_mtnl_are_injecting_malicious_ads_on/ https://www.reddit.com/r/india/comments/8wj6ec/bsnl_and_mtnl... It's not surprising that this PSU like every other in India is being destroyed from the inside, and is well on its way into the mouths of the private vulture funds.
Hoasi 8y ago
Not surprising given GoDaddy's long history of malpractice and terrible behavior. "Oh, but we've changed" they said... Glad I ran away from anything they touched since they acquired Media Temple.
toyg 8y ago
Sigh. It’s crap like this that will eventually force me to leave WebFaction (that GoDaddy acquired), after a decade of excellent service. I never touched GoDaddy, but it looks like the plague comes to you these days.
- ris 8y ago
  This. WebFaction, in my eyes, is as good as shared hosting can get. Built an entire company on top of its robustness & trustworthiness. I was beyond dismayed when I heard the news of the acquisition (sorry, "partnership") and every time the GoDaddy integration is mentioned I go surveying the alternatives.
- kpozin 8y ago
  I'm in the same boat. Have you found any decent replacement for WebFaction?
  - toyg 8y ago
    Not really - the market has moved on to PaaS, a reliable shared-hosting-cum-shell with a Python slant is not easy to come by. I’ll probably go with an OpenBSD vps somewhere, praying not to get hacked, plus Heroku for when I really can’t be arsed to look after a service. Quite a pain in the ass, though. At least my domains are already on Gandi...
demarq 8y ago
probably should be a ask hn, but in 2019 isn't there a ready to go docker image or something that allows you to be your own webhost. Isn't it weird that we still pay for someone to run an apache instance for us on the web?
- Koffiepoeder 8y ago
  1) You need an ISP which allows this (opening ports 80 and 443), or that allows hosting more generally. 2) It is probably not a good idea to have people manage webservers without in-depth security and server knowledge. 3) You still have to arrange DNS-hosting. 4) Webhosting can be a lot of things, e.g. database hosting, http website hosting, email hosting, etc... 5) When hosting your own website, traffic bursts might become a problem for your own internet. Do you really want to open your own IP for DDoS attacks? 6) Probably external nameservers (e.g. cloudflare) would be a good idea (see 5). 7) By hosting your own server, you have a lot more legal liabilities. There's a lot more to this than you would think on first sight. I outlined just a few problems and issues above, but there's probably many more. Truth is that it's probably not a good idea to host your own website if you're just a small business, or hobbyist (unless you want to learn something).
  - demarq 8y ago
    okay, good points. > You need an ISP which allows this (opening ports 80 and 443) Anywhere on the internet that allows you to run a box allows you pretty much any port you like. DO, Linode, Light Sail > It is probably not a good idea to have people manage webservers without in-depth security and server knowledge. Yes. But in my experiences most pwning happens due to application sec rather than server sec. i.e wordpress/drupal instances that aren't updated regularly and vulnerable plugins installed on the same. But I see your point, and I think it applies to any DIY effort. > database hosting, http website hosting, email hosting Yeah, when you sign up to any host out there they give email, seo, and logging. But I feel most clients would only really need database + app + email services. And for email Gmail and Proton are really the only quality choices. So you could get away with only offering database + app hosting. > You still have to arrange DNS-hosting. no, I think most domain registras will do this for you and offer a decent interface around this. I use namecheap and they are just stellar! > When hosting your own website, traffic bursts might become a problem This is the same for most webhosts anyway. In fact the problem is worse for webhosts. The cheapest box on Digital Ocean can easily outperform you run of the mill webhosting package. The resources available to each app on shared hosting is laughable for anything but you mom and pops local bakery or blog. > Do you really want to open your own IP for DDoS attacks? I don't think this is a problem you can get away from either way. You eventually have to use a service like cloudflare as you mentioned for this; webhosted or DIY. > By hosting your own server, you have a lot more legal liabilities. I agree with you on this one.
Crontab 8y ago
It is kind of sad how every single web-based technology is turned against us. I shudder to think what they will be able to do with Web Assembly.
zimbatm 8y ago
> how to stop it When faced with egregious business practices the best option is to switch company. What guarantees do we have that GoDaddy won't toggle the switch back at some point, or introduce other trackers? There are plenty of website hosting solutions out there. While at it, switch your domain registrar to a reputable one like https://www.gandi.net/ https://www.gandi.net/
- otachack 8y ago
  Yep, and tons of others. And, it seems, they all require the feature to transfer providers. Consumers have the upper hand and should take advantage of it. I guess it requires awareness, though.
- hellofunk 8y ago
  Gandi might be great for common domain suffixes, but their support for country-specific domains is poor, they just don't offer that many. If you're not in the U.S. it can be frustrating.
  - techaddict009 8y ago
    Name.com is good in that case.
- theWheez 8y ago
  This specific instance says a lot about how GoDaddy conducts their business. Enough to keep me away.
ojosilva 8y ago
I've switched to name.com a while back due to decent pricing and an easy to use rest api to change some of my subdomains ip address dynamically. Has any one encountered sleezy practices like GoDaddy with name.com? I take my domain registrars reliability and business practices very seriously!
MrMorden 8y ago
Pair Domains takes my money and provides me exactly what they advertise. The only issue I've had is that their DNS service doesn't have all the record types I want, so I use CloudFlare for that.
DonHopkins 8y ago
Why are you using godaddy in the first place? It's not like they aren't universally reviled for many good reasons. You deserve what you get for not educating yourself about what a terrible company they are and voting with your feet. You might as well be complaining that you're surprised Larry Ellison isn't looking out for your best interests, David Miscavige tried to brainwash you, Donald Trump didn't tell you the truth, and Rick James ground his muddy cowboy boots all over your suede couch. https://www.youtube.com/watch?v=ddIz-ydl6Yk https://www.youtube.com/watch?v=ddIz-ydl6Yk
- rdiddly 8y ago
  Habitual line-steppers, all.
- wpietri 8y ago
  I don't think victims ever "deserve what they get". Yes, he's responsible for the outcome. But outfits like GoDaddy exist because they're good enough at advertising and PR to fool the novice. People can't be experts in everything. Blame should stick to the bad actor, not the people they sucker.
  - JohnFen 8y ago
    > People can't be experts in everything. But you don't have to be an expert to conduct a web search. > Blame should stick to the bad actor, not the people they sucker. I mostly agree with this, but I have a hard time not placing just a little blame on the people who don't engage in even the bare minimum of research.
    - DonHopkins 8y ago
      >But you don't have to be an expert to conduct a web search. And if you don't know how to conduct a web search, you shouldn't be building a web site. >... placing just a little blame on the people who don't engage in even the bare minimum of research And GoDaddy's uncritical customers tend to be the kind of people who are easily influenced instead of permanently repelled by the kind of commercials GoDaddy is infamous for running. https://www.youtube.com/watch?v=ri47wy0scmk https://www.youtube.com/watch?v=ri47wy0scmk https://www.youtube.com/watch?v=B0cu7kRcQcs https://www.youtube.com/watch?v=B0cu7kRcQcs
EastSmith 8y ago
Spend half a day moving all my domains out of godaddy to cloudflare. Never felt better.
dguo 8y ago
I see a lot of mentions of Namecheap in these comments, but I recently discovered another option on tld-list[1]: Porkbun[2]. I don't need much out of a registrar, so price is the main consideration, and Porkbun's renewal prices are significantly cheaper ($8.70 for a .com, versus $13.16 on Namecheap). I would consider using Cloudflare's new at-cost registrar service[3] for everything, but they don't allow you to use non-Cloudflare nameservers. I've also experienced strange issues with logging in to Namecheap. From what I remember, I kept getting a server error message. Sometimes it happened after submitting my password, and sometimes it happened after submitting my 2FA code. Customer support couldn't help, and the issue went away the next day. [1]: https://tld-list.com https://tld-list.com [2]: https://porkbun.com https://porkbun.com [3]: https://www.cloudflare.com/products/registrar/ https://www.cloudflare.com/products/registrar/
lkdjjdjjjdskjd 8y ago
Switching away from GoDaddy seems like a better approach. On a related note, last I tried Cloudflare (a couple of years ago) they also injected JavaScript into my site. The JavaScript was larger than my site.
openloop 8y ago
aplus.net
tr33house 8y ago
went to Google domains a while back and never turning back. Waiting for my domains with them to expire before turning them all over. GoDaddy runs its business like they only want to do business once with you
sonnyblarney 8y ago
Anyone care to explain, line by line, what that JS actually does?
- technion 8y ago
  It's going to take some time to break it down line by line because it's minified and reads like garbage. But look at line #230. You're basically seeing a list of information it gathers, and everything above helps populate that information. Then everything below posts it off to their server.
tyingq 8y ago
Since it appears to be opt-out and hidden, this seems like it might be in violation of CFAA.
ykevinator 8y ago
Injecting is misleading, why don't people just use Amazon, is it just too much work or is shared hosting that much cheaper including cost of maintenance?
- dylan604 8y ago
  Shared hosting is typically a set amount per month. AWS is a mystery on pricing.
oneepic 8y ago
I read the code gist that someone else posted earlier...can someone explain to me exactly why this is gross in the first place? I can easily imagine a scenario where someone innocently added this code with good intentions (i.e. purely for performance data that sites can use) as opposed to being evil. It may be the case that there wasn't enough internal review of the code in question, and that's all. Also you have the ability to opt out...
adanto6840 8y ago
Apparently my ISP (Cox) injects stuff as well? I've never seen this message before, but just now stumbled on it for the first time -- have been with them for 5+ years now, first time I've seen this message though. https://imgur.com/a/f4BLf3h https://imgur.com/a/f4BLf3h Aside from the cap topic, it's outrageous to me that they find it OK to alter/inject into HTTP responses like this. Send me an email, sure -- but to alter responses?!
- bo1024 8y ago
  Just to be clear, this is a different kind of injection. Yours is at the visitor end (the ISP modifies the page while delivering it) while the original is at the server end (GoDaddy modifies the page while serving it).
- tracker1 8y ago
  This is an issue with many, especially mobile, carriers... the key is to use HTTPS everywhere, and send issues/requests to sites not HTTPS to switch. Let's Encrypt removes the last reason why a site shouldn't be all HTTPS. Note: fixing redirect rules for logins on some sites is a significant PITA, but should be adjusted accordingly by now anyway.
droithomme 8y ago
This can cause massive unwanted legal liabilities to the customer under GDPR.
KrishnaGD 8y ago
Hey everyone, Krishna here, I’m on the hosting team here at GoDaddy. There are some excellent points in this thread. I wanted to give a little bit of background about GoDaddy’s use of Real User Metrics (RUM) and our plan regarding its use moving forward. A little more than a year ago, we created a RUM javascript for our customers. The javascript is extremely lightweight and evaluates hosting performance only. We did this to create a better hosting environment for our customers. We rolled this out to a small subset of customers. As the RUM proved very beneficial in optimizing our hosting platform for our customers, we decided to roll it out to a wider audience. That said, we clearly could have better communicated this program. Based on all the feedback, we have decided to turn off the RUM javascript immediately and focus on designing the program so that customer participation is on an opt-in only basis. While the RUM data is beneficial in helping us improve our customers’ website performance, we regret that the implementation has upset many of our customers and we apologize for any inconvenience this has caused. Narasimha Krishnakumar VP of Product Management - Hosting GoDaddy
- Calib3r 8y ago
  If there is a chance this would break someone's website, why would you default this feature to being on? Please Daddy, don't be so rough.
  - KrishnaGD 8y ago
    We are not perfect and should have thought through this more. We created the script to be as non-intrusive and lightweight as possible. The number of incidents we saw were so minimal, we kept moving. We’ve obviously learned a lot from this and it will be 100% opt-in when we reintroduce it later.
JohnFen 8y ago
Wow. This is completely over the line and unacceptable. It appears that GoDaddy's reputation for being dodgy is well-earned.

949 points by ikromin 8y ago

good_guy 8y ago

Or you could just move to a better hosting service.

hilyen 8y ago

GoDaddy has always been horrible.

walrus01 8y ago

Nobody should ever use godaddy for a domain registrar or hosting services. Ever inherited a domain that was with them, and had to renew it? The sheer amount of unsolicited add-on offers you have to reject before successfully completing a payment for domain renewal is ridiculous. There's a reason why companies like namecheap which market themselves on "no bullshit" registrar services are popular these days.

iamdave 8y ago
I've been buying exclusively from Domai.nr for the last five years now, and I only ever login to buy a new one, or change payment details--which ends up with me rarely having to login. Years ago when I was with GoDaddy and starting my time on the web, it was daily, I knew some of their support people by voice. As far as "no bullshit" registrars, Domai.nr has been short of incredible. Thought I'd share the option if anyone is looking to migrate and at least wants options on the table to think about, along with namecheap.
notyourwork 8y ago
Namecheap has been great, I've also had good luck with Gandi.

namuol 8y ago

How to stop it: Use a different hosting service.

calibas 8y ago
Their marketing is effective at convincing small business owners they're one of the best choices for hosting. That's pretty much the whole reason they're so successful.
mark-r 8y ago
I thought that would be good enough, I went with WebFaction. But it seems they recently merged with GoDaddy, so even though I explicitly avoided them it turned out I didn't. Who's a good alternative these days?
- ahmedalsudani 8y ago
  Hover, Gandi, Namecheap, AWS, Google, Cloudflare. There are many decent alternatives. From the above, I have used all but Google and Cloudflare. My experience has been pleasant with all that I have used.
  - mrep 8y ago
    Lol. Every company you listed gets blasted all the time here on HN. I normally don't like qoutes but i think the Batman one fits well here with how people perceive companies: 'You Either Die A Hero, Or You Live Long Enough To See Yourself Become The Villain'
  - tracker1 8y ago
    I've been very happy with Google's registrar service... the only down side is you cannot bulk edit contacts. The couple times I've needed support they've been available within a couple minutes (once by phone, twice in browser chat). Not like any other Google support issue. Some prices are a little more than GoDaddy, others a little less, that part was pretty much a wash. The biggest advantage over Google's registrar service, is there's no upsell, at least not that I noticed. They do offer some integrated service options. The included google dns hosting and mail forwarding services are great imho. It could use some slight improvements in UI/UX, but still better than any other registrar I've tried by a large margin. Mileage may vary, of course, but I really do like the service overall. I'm not affiliated with Google, don't always like everything they do, and do have some reservations about them as a company. That said, imho the best registrar option available.

ChuckMcM 8y ago

pretty much pure evil. But hey its GoDaddy right? There are at least three places where you can get injected, one is from the ISP (including phone company networks), one is from the hosting provider, and one is from add-ons in the browser. One of the first Java applets I wrote (and you could easily do this in js) did a hash over the document page and reported if the hash didn't match the one stored in the applet. These days you could throw up an other wise invisible div that said "Page Tampered" please report to webmaster (or you could even do that yourself with a lookup on your hosted side to a script that would log IP/browser etc.

userbinator 8y ago
These days you could throw up an other wise invisible div that said "Page Tampered" please report to webmaster (or you could even do that yourself with a lookup on your hosted side to a script that would log IP/browser etc. I've already encountered pages like that, they piss off everyone who uses adblocking/filtering so I would consider it an anti-user technique.
markdown 8y ago
> There are at least three places where you can get injected, one is from the ISP I'm not sure if they still do it, but Vodafone in my country (and many others) used to cache and compress photos on all websites, which often led to visible degradation in image quality. Luckily I discovered that their software respected the `Cache-Control: no-transform` header so include that header on all my websites now.
- int0x80 8y ago
  Vodafone did also inject custom js/html in non HTTPS pages (obviously). This was 2 years ago.
  - markdown 8y ago
    That's right. The js rewrote all image src attributes to point to the "optimised" photos they'd cached.

throwaway8879 8y ago

The best way to stop it is to stop using GoDaddy. About 10 years ago.

willio58 8y ago

All interactions I’ve had with godaddy have been terrible.

kizer 8y ago

That's... very weird. It would seem OK if they were providing a CMS, but injecting when the person is already using their own code, so is likely to figure out what is going on, just doesn't make sense. Not sure how this seems worth it for GoDaddy.

obelos 8y ago

Who ever thought a registrar would be more awful than circa-1999 NetSol?

giancarlostoro 8y ago

I remember when I first bought a domain from them. I guess I fell for the marketing witchcraft, they advertised the domain for a lower price than what I ultimately paid, once I heard about Namecheap I went there and never looked back. My other problem was that their domain management interface was soooo slooooow, it got to me. This was in about 2008, but I rather not fall for their overpriced domains. Edit: My other pet peeve was that they supported SOPA when that whole mess was ongoing. I can't trust them at all since.

joering2 8y ago
You shouldn't trust Namecheap either. Just because nothing happened to your domain, doesn't mean when it does Namecheap will help. I had numerous issues over the years including someone being real jerk over their chat and just because of their rudeness and knowing my email and full name, was able to took over my account. Namecheap is not cheapest neither (Namesilo) https://www.trustpilot.com/review/www.namecheap.com https://www.trustpilot.com/review/www.namecheap.com
- markdown 8y ago
  I've been very happy with Namecheap. I moved all my domains to them year that Godaddy did some bad shit (off the top of my head, they supported SOPA and the CEO Bob Parsons slaughtered an elephant in Zimbabwe for sport).
  - joering2 8y ago
    Well Namecheap is not much better... they are US corporation but CEO is fine to hire people wherever is the cheapest labor to serve american customers. Besides, he sounds super unprofessional to me; 7 months ago he was sparing with me because he chose to be blind who is #2 top registrar [1]. He suppose to know this shit as a CEO, no? Here is another nightmarish story: https://news.ycombinator.com/item?id=18206464 https://news.ycombinator.com/item?id=18206464 At some point they deleted someone's 75 domains without any warning or support to resolve the issue. [1] https://news.ycombinator.com/threads?id=NamecheapCEO https://news.ycombinator.com/threads?id=NamecheapCEO

J253 8y ago

Gandi is my go to alternative. https://www.gandi.net/en https://www.gandi.net/en

EduardoBautista 8y ago
Mine as well. Only major registrar with U2F. They seem to take security very seriously.
- Niten 8y ago
  I've had good luck with Gandi in the past for SSL certificates, and their U2F support makes me inclined to choose them as my new registrar. On the other hand, I've heard less than great things about Gandi's reliability and support lately. If you've had to contact their support team, what's your experience been like?
  - EduardoBautista 8y ago
    I've never had to contact support, which might be a good thing. Although I did leave them for a while and am in the process of moving my domains to them.
- Jerry2 8y ago
  >Only major registrar with U2F I recently went looking for a registrar and one of the must-haves was U2F. Only Amazon and Google had it. Didn't know that Gandi has it as well. Good to know! PS: I was disappointed that Cloudflare still doesn't have a U2F support yet they are a part of critical infrastructure for much of the web. We ended up not using them because of that.
- JChase2 8y ago
  Namecheap is supposed to be getting it soon: https://www.namecheap.com/blog/true-totp-2fa-and-u2f-are-coming/ https://www.namecheap.com/blog/true-totp-2fa-and-u2f-are-com...
- justusthane 8y ago
  Hover has U2F.

jppope 8y ago

might be a good time to remind everyone that cloudflare is providing profit-less domain renewals ;)

shimms 8y ago
But with fewer tlds supported (for now). Was excited to move my GoDaddy registered domains there, alas none of them are supported (yet).
Jerry2 8y ago
Cloudflare still lacks U2F. For domain names and hosting, this is something that you should not compromise on.
- user5994461 8y ago
  Cloudflare has had 2 factor authentication for years. https://support.cloudflare.com/hc/en-us/articles/200167866-How-do-I-set-up-two-factor-authentication- https://support.cloudflare.com/hc/en-us/articles/200167866-H...
  - Jerry2 8y ago
    Not U2F. App/SMS 2FA can be bypassed.

guessmyname 8y ago

This is quite ironic because I used to work in the security team at GoDaddy, writing tools to scan and clean websites infected with malicious code injected the same way. To find out that the company is using the same technique (for something less malicious?) is very surprising to me. I guess they never asked for a review of this feature to the security team, otherwise I doubt they would have approved it.

sk5t 8y ago
The very notion that GoDaddy could be in a position to "clean" websites of malicious code is--what's the word?--stupefying? profoundly unsettling? mystifying?
- Wintereise 8y ago
  Why? For those of us who've worked in hosting, it's a routine thing that you help customers do every day. At their scale, trying to automate it hardly seems surprising.
  - bpchaps 8y ago
    Could you give an example of when a customer would need that? I'm missing something.
    - gscott 8y ago
      A lot of SQL injections are malicious ad scripts that will be named the same on each hack. It would be pretty easy to remove something like that as it passes back through Godaddy's router. I would hope they notify the website owner because otherwise you wouldn't know that you have a problem.
    - guessmyname 8y ago
      If a customer’s website is being hosted in a shared account, the infection will quickly spread across the other websites in the same server unless the hosting provider takes the matter in their own hands. Years ago, it was common to simply suspend the infected website until the webmaster finished the cleanup by themselves. Nowadays, instead of suspending a website for a minor infection, some hosting providers simply clean the malicious code automatically, or offer a premium cleanup service if the infection is more complex.

ve55 8y ago

GoDaddy has always been one of the worst providers or registrars someone can use. I wish I was surprised by a practice this bad.

Brajeshwar 8y ago

The best "How to stop it" would be to change registrars. Domain registrar is a highly commoditized, extremely low margin, volume play business. There is always another company better than the other. Personally, I have a ResellerClub account that I 'sell' to myself and my families. I also use name.com and namecheap.com for both my personal and my companies domains. They all are good. There is Google too, and CloudFlare entered the market. Question: Even if one registers with GoDaddy, what if the DNS is at CloudFlare, it won't have this problem, right?

lathiat 8y ago
Doesn’t even matter where the DNS is. This is happening on the actual web hosting server.

userbinator 8y ago

Yet all my pages were being served with the following <script> injected into them just before the closing </html> tag... The free hosts I used many years ago would do something similar, with no way to opt out --- that is, until I figured out they were just detecting the '</html>' and inserting before it. Combine that knowledge with the fact that the closing tag of the HTML element is optional, and you can guess what I did pretty easily. ;-)

jszymborski 8y ago
If you want valid HTML, and if they aren't parsing the DOM, then the following would likely work as well: 
- minitech 8y ago
  It’s valid to omit </html> (<html> too, for that matter).
  - naniwaduni 8y ago
    The idea is to have the mangler see </html> and inject their garbage right above it--into a comment. Unrelatedly, <html> is surprisingly hard to omit if you want to properly set the lang attribute.
    - abdusco 8y ago
      Any element can accept `lang` attribute, though. You can put it on the `<body>` element, but it wouldn't be as "proper". https://www.w3.org/International/questions/qa-html-language-declarations#basics https://www.w3.org/International/questions/qa-html-language-...
      - naniwaduni 8y ago
        It's actually pretty easy to omit <body> (and <head>), so you don't gain anything from this anyway, either.

ssttoo 8y ago

How is this company still in business is beyond me. Maybe their clients are less savvy (non-HN-frequenting) site owners

roywiggins 8y ago
I think that's exactly their target market.

ilaksh 8y ago

Since people are recommending alternatives, take a look at Netlify. It's my new favorite thing. For me GoDaddy is like a client test. If they are using something else for hosting, plus one point to them. If they use GoDaddy for hosting, minus ten points. If you can't convince them to move away from GoDaddy, you probably want to replace that client if possible with a more reasonable or less cheapskate one. Also I believe that https would prevent injections.

dpacmittal 8y ago
Netlify is a static site hosting, it's more like Github pages than godaddy hosting.
yjftsjthsd-h 8y ago
> Also I believe that https would prevent injections. Depends where it happens. On shared web hosting, they control SSL termination and everything behind it.

foobarbecue 8y ago

I've used godaddy, namecheap, and 101domain. Godaddy was about ten million times better than 101domain in terms of customer service. I'm kind of surprised they would do something this malicious.

vortico 8y ago
This article is about GoDaddy web hosting, not DNS.
- foobarbecue 8y ago
  oops!

thaumaturgy 8y ago

In case this turned out to be misleading, I picked a random GoDaddy-hosted low-cost site (hometailer.com) and yep, there's the code: <script>'undefined'=== typeof _trfq || (window._trfq = []);'undefined'=== typeof _trfd && (window._trfd=[]),_trfd.push({'tccl.baseHost':'secureserver.net'}),_trfd.push({'ap':'cpbh'},{'server':'a2plvcpnl83247'}) // Monitoring performance to make your website faster. If you want to opt-out, please contact web hosting support.</script><script src='https://img1.wsimg.com/tcc/tcc_l.combined.1.0.6.min.js'></script> https://img1.wsimg.com/tcc/tcc_l.combined.1.0.6.min.js'></sc... That's pretty gross.

gigatexal 8y ago
Happy with my namecheap domain hosted in Linode: never going to touch a godaddy domain for any of my needs.
- abc-xyz 8y ago
  A lot of people recommending NameCheap in this thread.. it's worth noting that they supposedly gave a warning to a guy running a forum with millions of visitors that they would suspend his account if he didn't remove two images within 24 hours (https://news.ycombinator.com/item?id=14139288 https://news.ycombinator.com/item?id=14139288), and that they're dumping costumers private info (https://news.ycombinator.com/item?id=18063667 https://news.ycombinator.com/item?id=18063667). I'm guessing there are other horror stories as well, but those two alone (which to me sound credible) were enough reason to take my business elsewhere.
  - Fizzadar 8y ago
    This - after their support requested my password over live chat I've since moved every domain I own to Gandi upon renewal.
    - jacurtis 8y ago
      Hey, the same thing happened to me! They asked for my password during a livechat session, and i was like "what the hell". Also, another time I was having problems with their stupid 2FA app (back when they ran their own app and it broke constantly), and their solution was to just disable the 2FA for my account. They said I can set it up again whenever I want to. So then I told the woman, that if someone wanted to hack into my account, they could just open a livechat and get my 2FA disabled and then log in, why should I even bother having 2FA at all if you're just going to disable it. To be fair, they finally moved to a more traditional 2FA now, where you can use any 2FA app instead of their proprietary namecheap app. So they might not do this anymore. I think they were disabling 2FA back when they used their own app for it, because it was super buggy and people (like myself) would get locked out of our accounts for no reason other than their app was buggy.

hilyen 8y ago

The JS file creates cookies, which would break GDPR I am guessing.

paulie_a 8y ago
While this seems pretty terrible in general. The GDPR is generally irrelevant. A large amount of websites will never need to even think about GDPR. If anything there is an over reaction complying to a law that will never be applicable. GDPR matters to the EU. It doesn't apply elsewhere.
- jobigoud 8y ago
  It matters to EU citizens. We are everywhere.
  - markonen 8y ago
    I'm sure it matters to you, but as a rule it doesn't apply to you if you reside outside the EEA. It applies to "an enterprise established in the EEA or—regardless of its location and the data subjects' citizenship—that is processing the personal information of data subjects inside the EEA" (emphasis mine, text from Wikipedia)
    - pmontra 8y ago
      This is the actual text of Article 3 of the Directive. Check point 2. It applies to (for example) an e-commerce in the USA if selling to somebody in the EU or to a USA company doing behavioral tracking if tracking somebody in the EU. In both cases, even if they are not EU citizens. Only the location matters. Territorial scope 1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. 3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.

technion 8y ago

I have created a gist with "beautified" version of the script the inject. https://gist.github.com/technion/5de5739ee803ed0641b2de816600f3c1 https://gist.github.com/technion/5de5739ee803ed0641b2de81660...

djsumdog 8y ago

I'm guessing this is some shared hosting solution where you don't have a lot of control or ability to add things like LetsEncrypt (but I'm sure GoDaddy will sell you their SSL offerings). I noticed some of my sites getting Vodaphone banners when using Ireland/UK sim cards and realize they were injecting crap into my site. That really helped me make the push to use LetsEncrypt on everything. I realize that 3rd party Wi-Fi/ISPs injecting code is a slightly different issue that the one in the article, but the solution is running SSL everywhere. If you need to login to a captive portal that redirects, there's always neverssl.com

benjaminjackman 8y ago
> If you need to login to a captive portal that redirects, there's always neverssl.com There's also: http://http.rip http://http.rip (which is easier at least for me to remember for some reason)
- roywiggins 8y ago
  example.com responds on http, and since it's reserved by IANA I more or less trust it to not serve malware, so I always just use that.

linkmotif 8y ago

Serious question, why do people use GoDaddy? What does it have to offer in terms of price/features/anything that’s better than any other provider?

joecool1029 8y ago
It's cheap and it's a big company. They are basically the Walmart of domain registration. Out of having to deal with something like 40 or 50 registrars and resellers over the years I give them a slightly above average rating. Really, for all the bashing this thread people are giving there are far worse. They aren't great, but things will probably work with them. I'll talk about alternatives now. Yeah, I know Gandi is cool, but they want too much money so majority of people pass them by. If you want a really horrid example: 1and1 is a company that sets the bar. They buy up superbowl and print ads to lure in old people with cheap domain registrations (like $1 or so). Once sucked in they use a careful reading of the ICANN regulations to maximize difficulty in doing anything. Oh, you want a transfer? That's going to be a week. Most things either go over the phone or through a panel that's down or nonfunctional half of the time. Want to change nameserver delegation to your own DNS servers? Fuck you then. They wipe the current DNS records and process the change in a couple days. Your site can take a vacation. Now, I hear a lot of people saying Namecheap is a good choice. They are ok, we recommend them but their panel likes to shit the bed and it can take hours to push DNS updates when things aren't running great there. They finally got off being an ENOM reseller, which is great. ENOM are assholes. I had a client that hired an ENOM reseller some time ago to register their domain and host their site. The reseller's company's owner got arrested and/or deported and while we were able to save the client's files the domain expired with no way for us to renew it. The good news is you can gripe up the chain to ENOM which will require a 5 year domain registration for $200. That's it in a nutshell. They are a large company which has a service that mostly works for a cheaper price than arguably better options like Gandi. Shout out to other terrible registrars like Yahoo Small Business (ugh)
- rawoke083600 8y ago
  "Now, I hear a lot of people saying Namecheap is a good choice. They are ok, we recommend them but their panel likes to shit the bed and it can take hours to push DNS updates when things aren't running great there." Yup !! Thats my experience also !

austincheney 8y ago

This has convinced me to take precautions. I am adding some logic to my site that if there are more than two script tags (I only have 2) replace body content with error text and send an xhr notification back to the server so that the server will know their pages are compromised It’s as simple as document.getElementsByTagName(“script”).length EDIT: Here is my tested more sane approach: https://gist.github.com/prettydiff/f9f85fffb00a903ecd3f2cfe0c276d62 https://gist.github.com/prettydiff/f9f85fffb00a903ecd3f2cfe0... I do not have an xhr notification in place in the gist, because I have not written a service to receive it yet.

ATsch 8y ago
You could do this much easier and better with a Content-Security-Policy. Whitelist the things you want to allow, and set a report-uri to get notified of any CSP violations.
- austincheney 8y ago
  CSP wont help you if you authorize scripts with a source of self or if the malicious script contains a relative "src" attribute. This approach has the added benefit of letting you know that malicious things are happening.
  - lozenge 8y ago
    CSP has report options.
franciscop 8y ago
What about those plugins that the user chose and add a script tag? While they should be becoming less common (since I read it's a bad practice), they are still out there.
im3w1l 8y ago
Did you consider a "silent alarm", that only phones home without displaying an error?

throwdaddy425 8y ago

This is facepalm-worthy and very unsettling. This is why I use NameCheap.

dizzyfingers 8y ago

I’ve followed HN for around 10 years now but even basic stuff like this can come across as jazz to me. Funny thing is I understand jazz at a professional level. I feel foolish because I use godaddy, because they have good customer service and their interface is easy to understand but as a HN lurker I want to have good web etiquette. I’m going to see about turning this feature off in the way the author describes but what can I do to stay clear of the Kenny Gs of tech? Full disclaimer I have nothing against Kenny G, and even respect him, just one of those jazz expressions...

Jedi72 8y ago
Companies that do this kind of garbage don't deserve your dollars. Its not enough to apologise after the fact, or offer opt-out, or any other half measures. I'm moving my domains over to someone else this week because of this.
DonHopkins 8y ago
You shouldn't use godaddy unless you support exterminating elephants. https://gawker.com/5787676/meet-godaddys-ridiculous-elephant-killing-ceo https://gawker.com/5787676/meet-godaddys-ridiculous-elephant...

ATsch 8y ago

I think it's pretty unfortunate that even now, CSPs are getting so little love in the comments of a post where they would have easily prevented this script from loaded at all, and could have helped the author discover the script the second it was added. For the unitiated, Content Security Policies (CSP) allow you to, among other things, define a whitelist of origins for things like scripts, css etc. and also notify you of violations. There is little excuse to not set a strong CSP on your sites if you can and you'll be glad you have it once something does happen.

Semaphor 8y ago
> There is little excuse to not set a strong CSP on your sites true, but > if you can IIRC that excludes every website with Google Adsense and even just using a manual ad network includes always fiddling with your CSP.
- kgwxd 8y ago
  Anyone using either of those doesn't care about user security and privacy anyway.
- dcbadacd 8y ago
  > There is little excuse to not set a strong CSP on your sites Can't use CSP if you want any ads on your page usually. If anyone here knows an ad provider that plays nice with CSP and pays okay then please do let me know, I'd love to securely monetize a few webapps of mine.
DCoder 8y ago
Then again, Vodafone Portugal was caught rewriting CSPs of all your visited pages to whitelist their own domain last year [0]. [0]: https://twitter.com/JackyHallyday/status/968263408003973121 https://twitter.com/JackyHallyday/status/968263408003973121
- jopsen 8y ago
  Nothing can save you if you don't trust your hosting provider, or don't use HTTPS. However, "was caught" is important :) The more noise they make the more likely they are to get caught.

boramalper 8y ago

> …and how to stop it by not using GoDaddy. I mean sure, it’s fixable, but this shouldn’t be a norm (for a paid service)!

oyebenny 8y ago

How does someone stop their internet service provider from doing this?

ndnxhs 8y ago
VPN/https

ddtaylor 8y ago

> "Monitoring performance" I can't think of anything related to performance of the server that can/should be monitored using a client-side script versus a server-side component.

heipei 8y ago

I originally built a service to detect exactly this kind of large-scale injection of content and similar occurrences (e.g. library prevalence etc). This is a perfect example of how to find the GoDaddy injected content: https://urlscan.io/search/#%22tcc_l.combined.1.0.6.min.js%22 https://urlscan.io/search/#%22tcc_l.combined.1.0.6.min.js%22 Another provider I found doing something similar is 000WebHost: https://urlscan.io/search/#filename%3A000webhost https://urlscan.io/search/#filename%3A000webhost They "just" inject a footer with an image and a link to their service though. Not sure how common this is in the low-cost hosting space.

ndnxhs 8y ago
000webhost also had their database leaked with plain text passwords.

Too 8y ago

Enabling HTTPS only should stop this right? Or are they able to inject it even then since they are the hosting provider?

tuxone 8y ago
No and yes.
- m-ueberall 8y ago
  Are you sure they have full access to your TLS certificates? Or can't you bring your own in this case?
  - tuxone 8y ago
    They host the website thus they can inject anything anywhere in the body before https kicks in.
  - dan1234 8y ago
    It depends how the code is being injected. If they’re using a an output filter on the web server, they could do it before the encryption stage. See http://nginx.org/en/docs/http/ngx_http_sub_module.html http://nginx.org/en/docs/http/ngx_http_sub_module.html & https://httpd.apache.org/docs/2.4/filter.html https://httpd.apache.org/docs/2.4/filter.html

dzek69 8y ago

It reminds me times of 5MB free web hosting from 2000 or so. A lot of them was doing it.

zzo38computer 8y ago

If someone is injecting JavaScript codes into your website and you do not want, put your own JavaScript codes which cause it to display a message asking the user to disable JavaScript if they want to access your webpage!

zaro 8y ago

> Luckily there is a way to turn this off Luckily I am not using GoDaddy and most probably never will.

charliebrownau 8y ago

stop using godaddy problem fixed

pdkl95 8y ago

The document ($PAGE + $NEW_JS_SCRIPT) is a new, different work. I doubt the added Javascript is a large enough change to be considered "transformative" and worthy of a separate copyright. The new work isn't a fair use of the original work, because it doesn't meet the statutory requirements[1]: 1) isn't a protected use (education, journalism, criticism, etc), 2) the original work is usually creative and (patently) published, and 3) the entire original work was included. Since the Javascript was added without without consent (or even any notification), we can assume GoDaddy hasn't negotiated with the original authors for a license to made derivative works. Therefor this is probably a violation of copyright. Does anybody using GoDaddy for hosting want to sue GoDaddy? Statutory damages up[2] to $150,000 per work adds up fast. [1] https://www.law.cornell.edu/uscode/text/17/107 https://www.law.cornell.edu/uscode/text/17/107 [2] actual damage amount in copyright cases varies a lot - this is simply an upper limit

naniwaduni 8y ago
Sadly, I think they have their ass covered in their TOS, under "User Content Other Than User Submissions": "You hereby grant GoDaddy a worldwide, non-exclusive, royalty-free, sublicensable (through multiple tiers), and transferable license to use, reproduce, distribute, prepare derivative works of, combine with other works, display, and perform your User Content in connection with this Site, the Services and GoDaddy’s (and GoDaddy’s affiliates’) business(es), including without limitation for promoting and redistributing all or part of this Site in any media formats and through any media channels without restrictions of any kind and without payment or other consideration of any kind, or permission or notification, to you or any third party." I'll admit I didn't look that closely though.
beokop 8y ago
While you’re at it, why not sue for emotional distress? Or lost income for the time reading this instead of billing clients? I’m all for GoDaddy being held responsible but advocating this kind of copyright abuse is as ridiculous as it is scary. Are we going to start suing CDN’s for setting custom HTTP headers now?
jopsen 8y ago
You've presumably given GoDaddy a license to serve your content if you're hosting it on GoDaddy. It's probably all covered by some user agreement. I think the important part is: Use a hosting provider you trust!

robin_reala 8y ago

I use a CSP on my site to work around potential JS injections: script-src 'none'. Possibly a little heavy handed but it does the job.

quickthrower2 8y ago

GoDaddy: the SourceForge of web hosting.

tracker1 8y ago
^^^ This is a very appropriate analogy.

throwaway321388 8y ago

This is nothing. India's state-owned ISP BSNL routinely injects js tracking and ads into HTTP pages. https://www.reddit.com/r/india/comments/8wj6ec/bsnl_and_mtnl_are_injecting_malicious_ads_on/ https://www.reddit.com/r/india/comments/8wj6ec/bsnl_and_mtnl... It's not surprising that this PSU like every other in India is being destroyed from the inside, and is well on its way into the mouths of the private vulture funds.

Hoasi 8y ago

Not surprising given GoDaddy's long history of malpractice and terrible behavior. "Oh, but we've changed" they said... Glad I ran away from anything they touched since they acquired Media Temple.

toyg 8y ago

Sigh. It’s crap like this that will eventually force me to leave WebFaction (that GoDaddy acquired), after a decade of excellent service. I never touched GoDaddy, but it looks like the plague comes to you these days.

ris 8y ago
This. WebFaction, in my eyes, is as good as shared hosting can get. Built an entire company on top of its robustness & trustworthiness. I was beyond dismayed when I heard the news of the acquisition (sorry, "partnership") and every time the GoDaddy integration is mentioned I go surveying the alternatives.
kpozin 8y ago
I'm in the same boat. Have you found any decent replacement for WebFaction?
- toyg 8y ago
  Not really - the market has moved on to PaaS, a reliable shared-hosting-cum-shell with a Python slant is not easy to come by. I’ll probably go with an OpenBSD vps somewhere, praying not to get hacked, plus Heroku for when I really can’t be arsed to look after a service. Quite a pain in the ass, though. At least my domains are already on Gandi...

demarq 8y ago

probably should be a ask hn, but in 2019 isn't there a ready to go docker image or something that allows you to be your own webhost. Isn't it weird that we still pay for someone to run an apache instance for us on the web?

Koffiepoeder 8y ago
1) You need an ISP which allows this (opening ports 80 and 443), or that allows hosting more generally. 2) It is probably not a good idea to have people manage webservers without in-depth security and server knowledge. 3) You still have to arrange DNS-hosting. 4) Webhosting can be a lot of things, e.g. database hosting, http website hosting, email hosting, etc... 5) When hosting your own website, traffic bursts might become a problem for your own internet. Do you really want to open your own IP for DDoS attacks? 6) Probably external nameservers (e.g. cloudflare) would be a good idea (see 5). 7) By hosting your own server, you have a lot more legal liabilities. There's a lot more to this than you would think on first sight. I outlined just a few problems and issues above, but there's probably many more. Truth is that it's probably not a good idea to host your own website if you're just a small business, or hobbyist (unless you want to learn something).
- demarq 8y ago
  okay, good points. > You need an ISP which allows this (opening ports 80 and 443) Anywhere on the internet that allows you to run a box allows you pretty much any port you like. DO, Linode, Light Sail > It is probably not a good idea to have people manage webservers without in-depth security and server knowledge. Yes. But in my experiences most pwning happens due to application sec rather than server sec. i.e wordpress/drupal instances that aren't updated regularly and vulnerable plugins installed on the same. But I see your point, and I think it applies to any DIY effort. > database hosting, http website hosting, email hosting Yeah, when you sign up to any host out there they give email, seo, and logging. But I feel most clients would only really need database + app + email services. And for email Gmail and Proton are really the only quality choices. So you could get away with only offering database + app hosting. > You still have to arrange DNS-hosting. no, I think most domain registras will do this for you and offer a decent interface around this. I use namecheap and they are just stellar! > When hosting your own website, traffic bursts might become a problem This is the same for most webhosts anyway. In fact the problem is worse for webhosts. The cheapest box on Digital Ocean can easily outperform you run of the mill webhosting package. The resources available to each app on shared hosting is laughable for anything but you mom and pops local bakery or blog. > Do you really want to open your own IP for DDoS attacks? I don't think this is a problem you can get away from either way. You eventually have to use a service like cloudflare as you mentioned for this; webhosted or DIY. > By hosting your own server, you have a lot more legal liabilities. I agree with you on this one.

Crontab 8y ago

It is kind of sad how every single web-based technology is turned against us. I shudder to think what they will be able to do with Web Assembly.

zimbatm 8y ago

> how to stop it When faced with egregious business practices the best option is to switch company. What guarantees do we have that GoDaddy won't toggle the switch back at some point, or introduce other trackers? There are plenty of website hosting solutions out there. While at it, switch your domain registrar to a reputable one like https://www.gandi.net/ https://www.gandi.net/

otachack 8y ago
Yep, and tons of others. And, it seems, they all require the feature to transfer providers. Consumers have the upper hand and should take advantage of it. I guess it requires awareness, though.
hellofunk 8y ago
Gandi might be great for common domain suffixes, but their support for country-specific domains is poor, they just don't offer that many. If you're not in the U.S. it can be frustrating.
- techaddict009 8y ago
  Name.com is good in that case.
theWheez 8y ago
This specific instance says a lot about how GoDaddy conducts their business. Enough to keep me away.

ojosilva 8y ago

I've switched to name.com a while back due to decent pricing and an easy to use rest api to change some of my subdomains ip address dynamically. Has any one encountered sleezy practices like GoDaddy with name.com? I take my domain registrars reliability and business practices very seriously!

MrMorden 8y ago

Pair Domains takes my money and provides me exactly what they advertise. The only issue I've had is that their DNS service doesn't have all the record types I want, so I use CloudFlare for that.

DonHopkins 8y ago

Why are you using godaddy in the first place? It's not like they aren't universally reviled for many good reasons. You deserve what you get for not educating yourself about what a terrible company they are and voting with your feet. You might as well be complaining that you're surprised Larry Ellison isn't looking out for your best interests, David Miscavige tried to brainwash you, Donald Trump didn't tell you the truth, and Rick James ground his muddy cowboy boots all over your suede couch. https://www.youtube.com/watch?v=ddIz-ydl6Yk https://www.youtube.com/watch?v=ddIz-ydl6Yk

rdiddly 8y ago
Habitual line-steppers, all.
wpietri 8y ago
I don't think victims ever "deserve what they get". Yes, he's responsible for the outcome. But outfits like GoDaddy exist because they're good enough at advertising and PR to fool the novice. People can't be experts in everything. Blame should stick to the bad actor, not the people they sucker.
- JohnFen 8y ago
  > People can't be experts in everything. But you don't have to be an expert to conduct a web search. > Blame should stick to the bad actor, not the people they sucker. I mostly agree with this, but I have a hard time not placing just a little blame on the people who don't engage in even the bare minimum of research.
  - DonHopkins 8y ago
    >But you don't have to be an expert to conduct a web search. And if you don't know how to conduct a web search, you shouldn't be building a web site. >... placing just a little blame on the people who don't engage in even the bare minimum of research And GoDaddy's uncritical customers tend to be the kind of people who are easily influenced instead of permanently repelled by the kind of commercials GoDaddy is infamous for running. https://www.youtube.com/watch?v=ri47wy0scmk https://www.youtube.com/watch?v=ri47wy0scmk https://www.youtube.com/watch?v=B0cu7kRcQcs https://www.youtube.com/watch?v=B0cu7kRcQcs

EastSmith 8y ago

Spend half a day moving all my domains out of godaddy to cloudflare. Never felt better.

dguo 8y ago

I see a lot of mentions of Namecheap in these comments, but I recently discovered another option on tld-list[1]: Porkbun[2]. I don't need much out of a registrar, so price is the main consideration, and Porkbun's renewal prices are significantly cheaper ($8.70 for a .com, versus $13.16 on Namecheap). I would consider using Cloudflare's new at-cost registrar service[3] for everything, but they don't allow you to use non-Cloudflare nameservers. I've also experienced strange issues with logging in to Namecheap. From what I remember, I kept getting a server error message. Sometimes it happened after submitting my password, and sometimes it happened after submitting my 2FA code. Customer support couldn't help, and the issue went away the next day. [1]: https://tld-list.com https://tld-list.com [2]: https://porkbun.com https://porkbun.com [3]: https://www.cloudflare.com/products/registrar/ https://www.cloudflare.com/products/registrar/

lkdjjdjjjdskjd 8y ago

Switching away from GoDaddy seems like a better approach. On a related note, last I tried Cloudflare (a couple of years ago) they also injected JavaScript into my site. The JavaScript was larger than my site.

openloop 8y ago

aplus.net

tr33house 8y ago

went to Google domains a while back and never turning back. Waiting for my domains with them to expire before turning them all over. GoDaddy runs its business like they only want to do business once with you

sonnyblarney 8y ago

Anyone care to explain, line by line, what that JS actually does?

technion 8y ago
It's going to take some time to break it down line by line because it's minified and reads like garbage. But look at line #230. You're basically seeing a list of information it gathers, and everything above helps populate that information. Then everything below posts it off to their server.

tyingq 8y ago

Since it appears to be opt-out and hidden, this seems like it might be in violation of CFAA.

ykevinator 8y ago

Injecting is misleading, why don't people just use Amazon, is it just too much work or is shared hosting that much cheaper including cost of maintenance?

dylan604 8y ago
Shared hosting is typically a set amount per month. AWS is a mystery on pricing.

oneepic 8y ago

I read the code gist that someone else posted earlier...can someone explain to me exactly why this is gross in the first place? I can easily imagine a scenario where someone innocently added this code with good intentions (i.e. purely for performance data that sites can use) as opposed to being evil. It may be the case that there wasn't enough internal review of the code in question, and that's all. Also you have the ability to opt out...

adanto6840 8y ago

Apparently my ISP (Cox) injects stuff as well? I've never seen this message before, but just now stumbled on it for the first time -- have been with them for 5+ years now, first time I've seen this message though. https://imgur.com/a/f4BLf3h https://imgur.com/a/f4BLf3h Aside from the cap topic, it's outrageous to me that they find it OK to alter/inject into HTTP responses like this. Send me an email, sure -- but to alter responses?!

bo1024 8y ago
Just to be clear, this is a different kind of injection. Yours is at the visitor end (the ISP modifies the page while delivering it) while the original is at the server end (GoDaddy modifies the page while serving it).
tracker1 8y ago
This is an issue with many, especially mobile, carriers... the key is to use HTTPS everywhere, and send issues/requests to sites not HTTPS to switch. Let's Encrypt removes the last reason why a site shouldn't be all HTTPS. Note: fixing redirect rules for logins on some sites is a significant PITA, but should be adjusted accordingly by now anyway.

droithomme 8y ago

This can cause massive unwanted legal liabilities to the customer under GDPR.

KrishnaGD 8y ago

Hey everyone, Krishna here, I’m on the hosting team here at GoDaddy. There are some excellent points in this thread. I wanted to give a little bit of background about GoDaddy’s use of Real User Metrics (RUM) and our plan regarding its use moving forward. A little more than a year ago, we created a RUM javascript for our customers. The javascript is extremely lightweight and evaluates hosting performance only. We did this to create a better hosting environment for our customers. We rolled this out to a small subset of customers. As the RUM proved very beneficial in optimizing our hosting platform for our customers, we decided to roll it out to a wider audience. That said, we clearly could have better communicated this program. Based on all the feedback, we have decided to turn off the RUM javascript immediately and focus on designing the program so that customer participation is on an opt-in only basis. While the RUM data is beneficial in helping us improve our customers’ website performance, we regret that the implementation has upset many of our customers and we apologize for any inconvenience this has caused. Narasimha Krishnakumar VP of Product Management - Hosting GoDaddy

Calib3r 8y ago
If there is a chance this would break someone's website, why would you default this feature to being on? Please Daddy, don't be so rough.
- KrishnaGD 8y ago
  We are not perfect and should have thought through this more. We created the script to be as non-intrusive and lightweight as possible. The number of incidents we saw were so minimal, we kept moving. We’ve obviously learned a lot from this and it will be 100% opt-in when we reintroduce it later.

JohnFen 8y ago

Wow. This is completely over the line and unacceptable. It appears that GoDaddy's reputation for being dodgy is well-earned.