4 ms·

Those comments really got to me too. What really struck me was that they seemed to be angry at Jorform! These angry users are talking about security too as if t

Those comments really got to me too. What really struck me was that they seemed to be angry at Jorform! These angry users are talking about security too as if they were attacked or something. I really feel for the users but at the same time I'm angry at them for placing the blame where it doesn't belong. Instead of being mad at Jotform they should be mad at the government. A while back I was advocating that we reach out to such people and explain this SOPA censorship stuff in a way they understand and this is precisely why. SOPA's supporters have done a really great job of training regular folks to think like some of these angry users making them think that somehow it was Jotform that did wrong. If they only knew how totally arbitrary this stuff is I think they'd be mad at the Feds like they should be. It's so sickening that the government probably just hurt not one but maybe thousands of companies in one fell swoop and everyone's pissed at the wrong guy. Then the politicians want to go around talking about creating jobs... Ha! How about destroying them? That's what it looks like to me.

benologist 15y ago
Why shouldn't they be angry at jotform? It looks like they had no expedited process for reporting phishing forms which had to have been a known risk somewhere around #1 on their list of known risks, they actually made it easier to go upstream instead of searching for their contact page (only linked in the footer) and hoping someone replies today. Did they have any automated detection? If they didn't have a "report a bad form" button then maybe they didn't even try and find bad forms ... like anything with a sign in button or password field. 2 million forms is too many to inspect, but you could narrow that list down very easily. What happened to them sucks but it seems like the problem could probably have been avoided. Edit: it let me make a form with "Account number" and "Password" complete with emailing me what people put in it which is suggestive of no preventative measures at all.
- AndyJPartridge 15y ago
  Some good points. But surely they should have been sent a warning, even a 24 hour one, to remove some content before just being wiped off the Internet. This action is business destroying and draconian.
  - benologist 15y ago
    Don't get me wrong, I absolutely agree they shouldn't have been destroyed and that GoDaddy has no right to be the executioner.
    - sukuriant 15y ago
      Then how do you rectify the statement you made that their customers should be angry with them, and that they shouldn't be destroyed? I really want to hear this.
      - benologist 15y ago
        Because there are two things here: 1) GoDaddy overstepping their bounds and shutting down a website 2) JotForm having inadequate, perhaps even non-existant measures in place to prevent or respond to phishing Obviously #1 dwarfs #2 significantly but that doesn't make #2 okay.
        sukuriant 15y ago
        How doesn't it? The argument could be made that GoDaddy would have done that deed anyway, even if (2) hadn't been rectified. GoDaddy might not have, if those provisions had been in place. Do these sorts of stories with GoDaddy happen often?
        benologist 15y ago
        GoDaddy's actions don't cancel it out because ignoring or not adequately preparing for phishing was wrong every single day and a foreseeable problem for about a decade now. They had a responsibility to prevent this for their paying users. Maybe it wouldn't have saved them, but there are a lot of free-x-hosting companies out there that haven't been shut down in spite of abuse.
        sukuriant 15y ago
- meow 15y ago
  Do you think this would have been averted if they took all the measures you are proposing ? There are no set guide lines here according to which the government is taking down stuff.. This is not DMCA related to create an process to take down stuff.. Even if they could not find the contact page, taking the whole website seems to be ridiculous thing to do. I think things like this will make websites with user generated content to move away from .com domains and even move into countries where there is more due process to things like this.
  - benologist 15y ago
    I think there's a decade of history that shows it could probably have been avoided - they're not the first free-x-hosting company to ever be abused for phishing.
    - Zirro 15y ago
      The history of this matter stopped being relevant when domain-seizures stopped being the last option.
      - benologist 15y ago
        The same risk existed last year alongside the many exploitable-by-phishing flavors of hosting. Although this wasn't even a domain seizure, this is just an overzealous domain registar which has also, always, been a risk to web services.
- nitrogen 15y ago
  Edit: it let me make a form with "Account number" and "Password" complete with emailing me what people put in it which is suggestive of no preventative measures at all. See this comment by the founder of Jotform: http://news.ycombinator.com/item?id=3597821 http://news.ycombinator.com/item?id=3597821 (Relevant quote: "Our Bayesian phishing filter has suspended 65.000 accounts last year.")
mansolo 15y ago
JotForm should have bailed from GoDaddy when most other people did. Instead, they were apathetic and took a chance with their business and all of their clients as well. Damn right it's their fault.
- sukuriant 15y ago
  Now thiiis is a valid reason for it being their fault
  - chives 15y ago
    Even if its not. Bail from Godaddy.com. Seriously. Granted the same problem may persist given that .coms have a US based organization that governs them (I think). Nonetheless, this is the exact same godaddy.com that supported SOPA. There have been so many forks in the road where the obvious choice was to bail on GoDaddy.com. Yet, they stayed and here they are. This is why we can't have nice things.
    - colechristensen 15y ago
      Verisign, an American company based in Virginia, is the authoritative registrar for .com and .net.
      - Revisor 15y ago
        More precisely Verisign is the registrY, GoDaddy the registrAR. Not that it changes anything in this case.
- rbanffy 15y ago
  I'm not sure many US-based registrars would be willing go against a law enforcement agency. Or would be able to do it twice. It all depends on what was on the letter they got and who sent it. Should they have ditched GoDaddy? Most probably yes. Would that save them now? I wouldn't bet my company.
  - 15y ago
mrschwabe 15y ago
That's the big joke man... modern day 'politicians' do not seek to create jobs. They seek control and power. It's up to nerds like us to design, develop and innovate systems that decentralize not only the internet - but politics as well.

benologist 15y ago

Why shouldn't they be angry at jotform? It looks like they had no expedited process for reporting phishing forms which had to have been a known risk somewhere around #1 on their list of known risks, they actually made it easier to go upstream instead of searching for their contact page (only linked in the footer) and hoping someone replies today. Did they have any automated detection? If they didn't have a "report a bad form" button then maybe they didn't even try and find bad forms ... like anything with a sign in button or password field. 2 million forms is too many to inspect, but you could narrow that list down very easily. What happened to them sucks but it seems like the problem could probably have been avoided. Edit: it let me make a form with "Account number" and "Password" complete with emailing me what people put in it which is suggestive of no preventative measures at all.

AndyJPartridge 15y ago
Some good points. But surely they should have been sent a warning, even a 24 hour one, to remove some content before just being wiped off the Internet. This action is business destroying and draconian.
- benologist 15y ago
  Don't get me wrong, I absolutely agree they shouldn't have been destroyed and that GoDaddy has no right to be the executioner.
  - sukuriant 15y ago
    Then how do you rectify the statement you made that their customers should be angry with them, and that they shouldn't be destroyed? I really want to hear this.
    - benologist 15y ago
      Because there are two things here: 1) GoDaddy overstepping their bounds and shutting down a website 2) JotForm having inadequate, perhaps even non-existant measures in place to prevent or respond to phishing Obviously #1 dwarfs #2 significantly but that doesn't make #2 okay.
      - sukuriant 15y ago
        How doesn't it? The argument could be made that GoDaddy would have done that deed anyway, even if (2) hadn't been rectified. GoDaddy might not have, if those provisions had been in place. Do these sorts of stories with GoDaddy happen often?
        benologist 15y ago
        GoDaddy's actions don't cancel it out because ignoring or not adequately preparing for phishing was wrong every single day and a foreseeable problem for about a decade now. They had a responsibility to prevent this for their paying users. Maybe it wouldn't have saved them, but there are a lot of free-x-hosting companies out there that haven't been shut down in spite of abuse.
        sukuriant 15y ago
meow 15y ago
Do you think this would have been averted if they took all the measures you are proposing ? There are no set guide lines here according to which the government is taking down stuff.. This is not DMCA related to create an process to take down stuff.. Even if they could not find the contact page, taking the whole website seems to be ridiculous thing to do. I think things like this will make websites with user generated content to move away from .com domains and even move into countries where there is more due process to things like this.
- benologist 15y ago
  I think there's a decade of history that shows it could probably have been avoided - they're not the first free-x-hosting company to ever be abused for phishing.
  - Zirro 15y ago
    The history of this matter stopped being relevant when domain-seizures stopped being the last option.
    - benologist 15y ago
      The same risk existed last year alongside the many exploitable-by-phishing flavors of hosting. Although this wasn't even a domain seizure, this is just an overzealous domain registar which has also, always, been a risk to web services.
nitrogen 15y ago
Edit: it let me make a form with "Account number" and "Password" complete with emailing me what people put in it which is suggestive of no preventative measures at all. See this comment by the founder of Jotform: http://news.ycombinator.com/item?id=3597821 http://news.ycombinator.com/item?id=3597821 (Relevant quote: "Our Bayesian phishing filter has suspended 65.000 accounts last year.")

mansolo 15y ago

JotForm should have bailed from GoDaddy when most other people did. Instead, they were apathetic and took a chance with their business and all of their clients as well. Damn right it's their fault.

sukuriant 15y ago
Now thiiis is a valid reason for it being their fault
- chives 15y ago
  Even if its not. Bail from Godaddy.com. Seriously. Granted the same problem may persist given that .coms have a US based organization that governs them (I think). Nonetheless, this is the exact same godaddy.com that supported SOPA. There have been so many forks in the road where the obvious choice was to bail on GoDaddy.com. Yet, they stayed and here they are. This is why we can't have nice things.
  - colechristensen 15y ago
    Verisign, an American company based in Virginia, is the authoritative registrar for .com and .net.
    - Revisor 15y ago
      More precisely Verisign is the registrY, GoDaddy the registrAR. Not that it changes anything in this case.
rbanffy 15y ago
I'm not sure many US-based registrars would be willing go against a law enforcement agency. Or would be able to do it twice. It all depends on what was on the letter they got and who sent it. Should they have ditched GoDaddy? Most probably yes. Would that save them now? I wouldn't bet my company.
- 15y ago

mrschwabe 15y ago

That's the big joke man... modern day 'politicians' do not seek to create jobs. They seek control and power. It's up to nerds like us to design, develop and innovate systems that decentralize not only the internet - but politics as well.