10 ms·

It's amazing that (approximately) no one cares about stuff like this. GoDaddy was severely breached several times over several years, yet they still rake in bi

It's amazing that (approximately) no one cares about stuff like this. GoDaddy was severely breached several times over several years, yet they still rake in billions of revenue from their millions of customers. Now they have to pay someone to fill out a biennial checklist and... promise to not lie. Awesome. If you own a company, why even bother with security? Security is expensive. Wait until a breach is exposed, offer $10 credit monitoring (at best), accept the free press coverage, maybe pinky promise to not lie if you've been particularly egregious in your handling of multiple incidents, and then carry on like normal. (This is tongue-in-cheek, I work in security, but I am frustrated with how often stories like this one occur)

stackskipton 2y ago
>If you own a company, why even bother with security? Security is expensive. Wait until a breach is exposed, offer $10 credit monitoring (at best), accept the free press coverage, maybe pinky promise to not lie if you've been particularly egregious in your handling of multiple incidents, and then carry on like normal. (This is tongue-in-cheek, I work in security, but I am frustrated with how often stories like this one occur) As SRE, I've heard executives say this "There is no penalty for breaches, why care?"
- reaperducer 2y ago
  As SRE, I've heard executives say this "There is no penalty for breaches, why care?" Depends on the industry. I'm in healthcare, and our legal department is always reminding the devs that even a small breach can be financially catastrophic for the company, as they are totaled as $xx,000 per person affected. We get training on it every six months.
  - stevenicr 2y ago
    I'd like to hear more about this training - I have started to put together some resources to teach C suite, maybe new-to-the-field lawyers, other interested stakeholders - about website compliance issues.. looking to mimic other good training / learning materials, extra info to consider, maybe collab and send business I can't take on, etc.
    - ziddoap 2y ago
      Not the person you are replying to, but I work in security and have spent ~5 years of my career helping various companies set up and maintain security awareness programs. There are some out-of-the-box solutions that can start you on your way to creating a security awareness training program, such as KnowBe4 and ProofPoint (there are others as well, but these are some of the big names). If you don't have in-house security staff, these types of offerings can be quite helpful. For a more grounds-up approach, there are guidelines such as the NIST SP 800-50 "Building a Cybersecurity and Privacy Learning Program" guidance. (https://csrc.nist.gov/pubs/sp/800/50/r1/final https://csrc.nist.gov/pubs/sp/800/50/r1/final) If you have specific questions, I can try to answer them.
      - reaperman 2y ago
        As a technically-minded person, I've found both KnowBe4 and ProofPoint trainings to be very lacking/boring/superficial.
        ziddoap 2y ago
        While I agree with you, that's why they are a starting point for someone looking to stand up a program, not an end point. And, from my experience, many of the trainings that seem almost offensively easy to me (e.g. "How to read a URL") have been some of the ones that received the most positive feedback from non-technical departments. The real key with security awareness training is ensuring the training is at the appropriate level of complexity for the trainee.
        transcriptase 2y ago
        One way to relieve the boredom is to count the number of times you see the people in videos typing away on desktops/monitors with no cables plugged into them.
        datavirtue 2y ago
        KnowBe4 is awesome. It trains everyone to be on the lookout. The penalty for barely screwing up is another boring training session that no one has time for. Very painful. Pain is a great teacher.
  - infogulch 2y ago
    So the answer is to put the same kind of onerous penalties that companies pay for leaking healthcare data and apply them to any PII / user data. If it can't hit the bottom line bigcorps don't care; liability is the only language they understand.
    - reaperducer 2y ago
      So the answer is to put the same kind of onerous penalties that companies pay for leaking healthcare data and apply them to any PII / user data Then you get people on HN shouting "regulatory capture!" and "stifling innovation!"
      - infogulch 2y ago
        Yeah it sucks, but what can you do when you have titanic amoral agents stomping through society? You gotta speak their language. Maybe scale the penalty with the size of the company.
      - jjmarr 2y ago
        You have to provide your email to sign up for HN, however, it is not publicly visible. If YCombinator had to pay $10,000 for leaking a user email, this site isn't going to exist since it's not their core business and represents a huge liability. It's also disproportionate. If my email is leaked in the context of receiving treatment for a stigmatized disease, that's a lot worse than an MMORPG leaking my real name. Maybe some penalty is necessary but $10k or above per user is disproportionate for the vast majority of people. A $50/person penalty with gradations for sensitivity of the information is going to work better in practice. If leaking an SSN is more expensive than an email or site-specific ID, corporations might stop using SSNs to identify people to reduce their exposure
        pbhjpbhj 2y ago
        Have the C-suite hand back their compensation above minimum wage for the last 3 years. Fine the company, all profits, or a percentage of global revenue (and pay that back to customers). If the outcome of ignoring data security is to not make any money then companies will actually do something about it. Penalities should push the company to the point of failing.
  - stackskipton 2y ago
    Except Change Healthcare got hacked, lost a ton of records and they are still operating. So those fines must be, could be up to xx,000 per person affected but in actuality, those affected will get Arbys coupon and C Suite will lose a week of yacht time.
    - junon 2y ago
      Not even that. You always have insurance for this stuff.
      - rendaw 2y ago
        But then the insurance company has to pay, and they'll work hard to make sure it doesn't happen. This doesn't sound like an explanation to me.
        junon 2y ago
        You don't really have a choice, you have to have insurance for breaches (HIPAA term, not strictly the typical cybersec term, means any loss of control of information that results in potential of dissemination of PII).
    - somehnguy 2y ago
      I didn’t even get an Arby’s coupon. I got a letter telling me they gave away my information with a link to an “identity monitoring” site that looks like the CEOs nephew built in a weekend and just errors out when I sign up.
    - ycombinatrix 2y ago
      I'd honestly prefer an Arby's coupon or perhaps a crisp $1 note over "1 year subscription to our credit monitoring service"
  - pyuser583 2y ago
    Yeah I got those trainings when I was merely healthcare adjacent adjacent adjacent.
  - plagiarist 2y ago
    It turns out HIPAA is a pretty good incentive to do the right thing, and the key difference is that there are actual consequences for violating HIPAA. Even better, the consequences are stronger in the event that the company obviously wasn't giving a fuck about security. I wish we had HIPAA for all PII.
    - esafak 2y ago
      But it does slow things down. Startups don't want to deal with that stuff. So they'd have to outsource it. I'm not sure how.
- kstrauser 2y ago
  > As SRE, I've heard executives say this "There is no penalty for breaches, why care?" Honestly, I'm more afraid of reputational loss than government fines. Our customers don't have to use our product. They do because they trust us. Lose that trust and it's awfully hard to get it back.
  - adrr 2y ago
    Crowdstrike took down all windows boxes that had their software installed and didn’t really affect them.
    - jrochkind1 2y ago
      I think customers feel, rightly or wrongly, there's no alternative to CrowdStrike. There are so many alternatives to what GoDaddy provides, it is quite commoditized. But also... true, their customers don't seem to care anyway? Or it's "cost of switch", even just mentally? If you were starting fresh it really wouldn't be any harder at all to go with any of numerous alternatives, but if you already have godaddy...
      - rez9x 2y ago
        I've actually not worked anywhere that has used CrowdStrike. It's usually ruled out as too expensive (I've mostly worked in public sector). I've had very good experiences with Sentinel One and Microsoft Defender. I've had terrible experiences with Trellix and Sophos."Oopsy" aside, is CrowdStrike really that much better than the competition?
        alephnerd 2y ago
        The big four (CRWD, S1, Prisma, and MDE) all mostly comparable tbh. EDR (especially Windows EDR) is heavily commodified.
        esafak 2y ago
        A commodified market with no good product? Something is wrong here.
- honestSysAdmin 2y ago
  [flagged]
  - demosthanos 2y ago
    It's a bit exhausting that every time anyone says anything about executives in any context, we have to make sure to bring up the cold-blooded murder of one of them and make sure to remind everyone that some people on the internet think that that murder was justified. It's free internet points, I guess, but it's also not constructive and frankly more than a little bit creepy.
    - honestSysAdmin 2y ago
      [flagged]
      - deleted 2y ago
        [deleted]
        honestSysAdmin 2y ago
        [flagged]
    - datavirtue 2y ago
      It's the time we live in.
    - inetknght 2y ago
      > It's free internet points, I guess, but it's also not constructive and frankly more than a little bit creepy. What makes you think it's not constructive?! I think it's worth discussing why a large number (possibly even a majority!) of people want to murder executives. Telling those people to shut up removes yet another way for them to express their opinions. I think taking notice of the room is very constructive. I think having a point to discuss (even if it's violence) is constructive. Talk is cheap, after all; and talk is way cheaper than murder. Moreover, I've heard many many many people insist that violence is never the answer. Alas, they forget that violence is how most countries were founded; ignore that many laws and regulations are written in blood; and rarely consider the situations where all other solutions have been explored and exhausted. Further, if business is so worried about costs, and violence can be cheaper than exploring all alternative options, then there's definitely a business mindset to that. And business is what you want to discuss anyway, right? If you really think violence is never the answer then you should do everything in your power to prevent it. So instead of insulting someone for expressing an opinion, perhaps you should talk to them instead. You might discover a new/unique point of view, or you might even be able to change their mind.
- benoau 2y ago
  We’Ve eVaLuaTeD the RisKs
ToucanLoucan 2y ago
If you don't make the fines or whatever substantially more than the profit of the illicit or negligent conduct, it isn't a consequence. It's a budget line-item. Every regulatory agency in America has been stripped to the bones by decades of budget cuts and never ending accusations of "stifling innovation" and we're shocked now that companies get away with both metaphorical and actual murder.
zelphirkalt 2y ago
They profit a lot from uninformed CTOs and founders just going for whatever they heard of, instead of looking into whether it is a good provider, footing their businesses on shaky foundations.
- reaperducer 2y ago
  They profit a lot from uninformed CTOs and founders just going for whatever they heard of, instead of looking into whether it is a good provider If it wasn't for those old Super Bowl ads, GoDaddy wouldn't exist today. Sex sells.
- wswope 2y ago
  Yeah - selection bias and apathy is the root of it, IMO. GoDaddy attracts the unwashed masses who don’t care about security, and who remain unphased after learning about breaches. Meanwhile, the tech-savvy crowd who would care about breaches already know to avoid GoDaddy and view the inevitable breaches as the plebs reaping what they’ve sown. Ergo, no one getting breached by GoDaddy cares, and nobody informed watching it happen feels a need to intervene.
DonHopkins 2y ago
The elephant in the room may be GoDaddy's historical total disregard for security, but hey, those pesky elephants won't shoot themselves! GoDaddy CEO's graphic elephant hunt video sends his clients flocking to competitors, and helps raise $20,000 for elephant charity: https://www.dailymail.co.uk/news/article-1374679/GoDaddy-CEO-Bob-Parsons-elephant-shooting-video-pays-Namecheap-Save-Elephants.html https://www.dailymail.co.uk/news/article-1374679/GoDaddy-CEO... GoDaddy CEO Kills Elephant: https://www.youtube.com/watch?v=YnM5yTW2B3g https://www.youtube.com/watch?v=YnM5yTW2B3g
- runnr_az 2y ago
  Bob hasn't been CEO of GoDaddy since 2011
  - DonHopkins 2y ago
    I know, that's exactly why I wrote "historic", but the current owners gave him an enormous amount of money, didn't clean up their act, and GoDaddy CONTINUES to be terrible. The security breach we're discussing didn't happen 14 years ago, as you well know. They have a long and infamous track record and toxic corporate culture and unethical business practices and willfully misleading negligence of security that show no signs of improving. So charming that you're on such a familiar first name basis with a piece of shit like Bob Parsons. Are you friends? Are you actually carrying the water for GoDaddy, or think it's ok to murder elephants and run incredibly sexist commercials while never giving a shit about security or customers? Yuck.
retrochameleon 2y ago
They are also the worst hosting provider I have ever worked with, multiple times. Awful customer support and high prices. The only reason I work with them anymore is to migrate new customers to a different provider.
gtech1 2y ago
So basically like Microsoft ?
overstay8930 2y ago
Most companies are way too incompetent to even know how to secure their own data because it is just too expensive to actually hire someone that knows what they're doing - so most of the "cybersecurity" industry is just grifters talking about buzzwords and building dashboards to show how good they are at patching CVEs. I have had to tell multiple cybersecurity vendors that brag about working with huge companies and governments that we cannot work with them because of how poor their own cybersecurity practices are (i.e. not using secure compute/hardware crypto when dealing with our private keys). These are companies that should know better, I have had to stop ADP professional services more than once from disabling certificate validation on critical pipelines pertaining to confidential employee and customer information. I do not want to imagine what happens at 99% of companies with cybersecurity teams that don't even know what certificate validation is.
dustywusty 2y ago
The sad truth is that for the most part, the web hosting industry has normalized a fairly lax approach to security, and sees settlements like this, and even breaches, as a cost of doing business. Look at Wordpress maintenance, for example. It's a tough business hosting arbitrary UGC, and doing it well costs a lot of time effort and money (ask me how I know). But I fully agree: treating this as just another line-item cost is absurd.
deleted 2y ago
[deleted]
wsatb 2y ago
GoDaddy had really good marketing at one point and as of the last time I used it, which was years ago, they make it very difficult (I'm pretty sure by design) to leave. Their UX was one of the worst I've ever experienced in my life and they were consistently moving things around to make it worse. They essentially trap you, and someone without either the savvy or diligence will just give up.
burningChrome 2y ago
True story. I worked for a medium sized company. They had a very large commercial e-commerce site for their customers. They used Wordpress sites that were hosted on GoDaddy. I worked there for two years. They never updated any of their passwords for GoDaddy or their Wordpress sites. Its been almost ten years since I've worked there and I occasionally log on just to see if they've updated anything. Nope. Last time I checked was early 2024. Still nothing was updated. I mean, someone gets access to their GoDaddy account and within minutes will have full control of a major bit of their business. Talk about playing with fire.
- philsnow 2y ago
  > Its been almost ten years since I've worked there and I occasionally log on just to see if they've updated anything. Nope. Last time I checked was early 2024. Still nothing was updated. ... but.. why? Why let them live rent-free in your mind? Why admit to that in even a pseudonymous space?
to11mtm 2y ago
I've had a dim view of them ever since my first interaction with Domains by Proxy (At the time, I recall finding that many 'windows support' scam sites and other malware distribution was showing up under their domains, and every attempt to uncover would only lead to a 'oh that account is now banned but we wont tell you thx'.) ... Honestly it reminds me of how some Internet VOIP providers won't tell the name of the business who actually bought the number (Which, of course, complicates the ability to collect on TCPA when it's a number used for spam.)
roenxi 2y ago
I'd be less amazed if people could articulate why this matters. What is the harm being done here and why is it more costly than GoDaddy raising their prices by a few dollars?
- barryrandall 2y ago
  One example: They're selling domain registration privacy, but don't sufficiently secure the private data. The entire Domains by Proxy dataset is available on the dark web.

stackskipton 2y ago

>If you own a company, why even bother with security? Security is expensive. Wait until a breach is exposed, offer $10 credit monitoring (at best), accept the free press coverage, maybe pinky promise to not lie if you've been particularly egregious in your handling of multiple incidents, and then carry on like normal. (This is tongue-in-cheek, I work in security, but I am frustrated with how often stories like this one occur) As SRE, I've heard executives say this "There is no penalty for breaches, why care?"

reaperducer 2y ago
As SRE, I've heard executives say this "There is no penalty for breaches, why care?" Depends on the industry. I'm in healthcare, and our legal department is always reminding the devs that even a small breach can be financially catastrophic for the company, as they are totaled as $xx,000 per person affected. We get training on it every six months.
- stevenicr 2y ago
  I'd like to hear more about this training - I have started to put together some resources to teach C suite, maybe new-to-the-field lawyers, other interested stakeholders - about website compliance issues.. looking to mimic other good training / learning materials, extra info to consider, maybe collab and send business I can't take on, etc.
  - ziddoap 2y ago
    Not the person you are replying to, but I work in security and have spent ~5 years of my career helping various companies set up and maintain security awareness programs. There are some out-of-the-box solutions that can start you on your way to creating a security awareness training program, such as KnowBe4 and ProofPoint (there are others as well, but these are some of the big names). If you don't have in-house security staff, these types of offerings can be quite helpful. For a more grounds-up approach, there are guidelines such as the NIST SP 800-50 "Building a Cybersecurity and Privacy Learning Program" guidance. (https://csrc.nist.gov/pubs/sp/800/50/r1/final https://csrc.nist.gov/pubs/sp/800/50/r1/final) If you have specific questions, I can try to answer them.
    - reaperman 2y ago
      As a technically-minded person, I've found both KnowBe4 and ProofPoint trainings to be very lacking/boring/superficial.
      - ziddoap 2y ago
        While I agree with you, that's why they are a starting point for someone looking to stand up a program, not an end point. And, from my experience, many of the trainings that seem almost offensively easy to me (e.g. "How to read a URL") have been some of the ones that received the most positive feedback from non-technical departments. The real key with security awareness training is ensuring the training is at the appropriate level of complexity for the trainee.
      - transcriptase 2y ago
        One way to relieve the boredom is to count the number of times you see the people in videos typing away on desktops/monitors with no cables plugged into them.
      - datavirtue 2y ago
        KnowBe4 is awesome. It trains everyone to be on the lookout. The penalty for barely screwing up is another boring training session that no one has time for. Very painful. Pain is a great teacher.
- infogulch 2y ago
  So the answer is to put the same kind of onerous penalties that companies pay for leaking healthcare data and apply them to any PII / user data. If it can't hit the bottom line bigcorps don't care; liability is the only language they understand.
  - reaperducer 2y ago
    So the answer is to put the same kind of onerous penalties that companies pay for leaking healthcare data and apply them to any PII / user data Then you get people on HN shouting "regulatory capture!" and "stifling innovation!"
    - infogulch 2y ago
      Yeah it sucks, but what can you do when you have titanic amoral agents stomping through society? You gotta speak their language. Maybe scale the penalty with the size of the company.
    - jjmarr 2y ago
      You have to provide your email to sign up for HN, however, it is not publicly visible. If YCombinator had to pay $10,000 for leaking a user email, this site isn't going to exist since it's not their core business and represents a huge liability. It's also disproportionate. If my email is leaked in the context of receiving treatment for a stigmatized disease, that's a lot worse than an MMORPG leaking my real name. Maybe some penalty is necessary but $10k or above per user is disproportionate for the vast majority of people. A $50/person penalty with gradations for sensitivity of the information is going to work better in practice. If leaking an SSN is more expensive than an email or site-specific ID, corporations might stop using SSNs to identify people to reduce their exposure
      - pbhjpbhj 2y ago
        Have the C-suite hand back their compensation above minimum wage for the last 3 years. Fine the company, all profits, or a percentage of global revenue (and pay that back to customers). If the outcome of ignoring data security is to not make any money then companies will actually do something about it. Penalities should push the company to the point of failing.
- stackskipton 2y ago
  Except Change Healthcare got hacked, lost a ton of records and they are still operating. So those fines must be, could be up to xx,000 per person affected but in actuality, those affected will get Arbys coupon and C Suite will lose a week of yacht time.
  - junon 2y ago
    Not even that. You always have insurance for this stuff.
    - rendaw 2y ago
      But then the insurance company has to pay, and they'll work hard to make sure it doesn't happen. This doesn't sound like an explanation to me.
      - junon 2y ago
        You don't really have a choice, you have to have insurance for breaches (HIPAA term, not strictly the typical cybersec term, means any loss of control of information that results in potential of dissemination of PII).
  - somehnguy 2y ago
    I didn’t even get an Arby’s coupon. I got a letter telling me they gave away my information with a link to an “identity monitoring” site that looks like the CEOs nephew built in a weekend and just errors out when I sign up.
  - ycombinatrix 2y ago
    I'd honestly prefer an Arby's coupon or perhaps a crisp $1 note over "1 year subscription to our credit monitoring service"
- pyuser583 2y ago
  Yeah I got those trainings when I was merely healthcare adjacent adjacent adjacent.
- plagiarist 2y ago
  It turns out HIPAA is a pretty good incentive to do the right thing, and the key difference is that there are actual consequences for violating HIPAA. Even better, the consequences are stronger in the event that the company obviously wasn't giving a fuck about security. I wish we had HIPAA for all PII.
  - esafak 2y ago
    But it does slow things down. Startups don't want to deal with that stuff. So they'd have to outsource it. I'm not sure how.
kstrauser 2y ago
> As SRE, I've heard executives say this "There is no penalty for breaches, why care?" Honestly, I'm more afraid of reputational loss than government fines. Our customers don't have to use our product. They do because they trust us. Lose that trust and it's awfully hard to get it back.
- adrr 2y ago
  Crowdstrike took down all windows boxes that had their software installed and didn’t really affect them.
  - jrochkind1 2y ago
    I think customers feel, rightly or wrongly, there's no alternative to CrowdStrike. There are so many alternatives to what GoDaddy provides, it is quite commoditized. But also... true, their customers don't seem to care anyway? Or it's "cost of switch", even just mentally? If you were starting fresh it really wouldn't be any harder at all to go with any of numerous alternatives, but if you already have godaddy...
    - rez9x 2y ago
      I've actually not worked anywhere that has used CrowdStrike. It's usually ruled out as too expensive (I've mostly worked in public sector). I've had very good experiences with Sentinel One and Microsoft Defender. I've had terrible experiences with Trellix and Sophos."Oopsy" aside, is CrowdStrike really that much better than the competition?
      - alephnerd 2y ago
        The big four (CRWD, S1, Prisma, and MDE) all mostly comparable tbh. EDR (especially Windows EDR) is heavily commodified.
        esafak 2y ago
        A commodified market with no good product? Something is wrong here.
honestSysAdmin 2y ago
[flagged]
- demosthanos 2y ago
  It's a bit exhausting that every time anyone says anything about executives in any context, we have to make sure to bring up the cold-blooded murder of one of them and make sure to remind everyone that some people on the internet think that that murder was justified. It's free internet points, I guess, but it's also not constructive and frankly more than a little bit creepy.
  - honestSysAdmin 2y ago
    [flagged]
    - deleted 2y ago
      [deleted]
      - honestSysAdmin 2y ago
        [flagged]
  - datavirtue 2y ago
    It's the time we live in.
  - inetknght 2y ago
    > It's free internet points, I guess, but it's also not constructive and frankly more than a little bit creepy. What makes you think it's not constructive?! I think it's worth discussing why a large number (possibly even a majority!) of people want to murder executives. Telling those people to shut up removes yet another way for them to express their opinions. I think taking notice of the room is very constructive. I think having a point to discuss (even if it's violence) is constructive. Talk is cheap, after all; and talk is way cheaper than murder. Moreover, I've heard many many many people insist that violence is never the answer. Alas, they forget that violence is how most countries were founded; ignore that many laws and regulations are written in blood; and rarely consider the situations where all other solutions have been explored and exhausted. Further, if business is so worried about costs, and violence can be cheaper than exploring all alternative options, then there's definitely a business mindset to that. And business is what you want to discuss anyway, right? If you really think violence is never the answer then you should do everything in your power to prevent it. So instead of insulting someone for expressing an opinion, perhaps you should talk to them instead. You might discover a new/unique point of view, or you might even be able to change their mind.
benoau 2y ago
We’Ve eVaLuaTeD the RisKs

ToucanLoucan 2y ago

If you don't make the fines or whatever substantially more than the profit of the illicit or negligent conduct, it isn't a consequence. It's a budget line-item. Every regulatory agency in America has been stripped to the bones by decades of budget cuts and never ending accusations of "stifling innovation" and we're shocked now that companies get away with both metaphorical and actual murder.

zelphirkalt 2y ago

They profit a lot from uninformed CTOs and founders just going for whatever they heard of, instead of looking into whether it is a good provider, footing their businesses on shaky foundations.

reaperducer 2y ago
They profit a lot from uninformed CTOs and founders just going for whatever they heard of, instead of looking into whether it is a good provider If it wasn't for those old Super Bowl ads, GoDaddy wouldn't exist today. Sex sells.
wswope 2y ago
Yeah - selection bias and apathy is the root of it, IMO. GoDaddy attracts the unwashed masses who don’t care about security, and who remain unphased after learning about breaches. Meanwhile, the tech-savvy crowd who would care about breaches already know to avoid GoDaddy and view the inevitable breaches as the plebs reaping what they’ve sown. Ergo, no one getting breached by GoDaddy cares, and nobody informed watching it happen feels a need to intervene.

DonHopkins 2y ago

The elephant in the room may be GoDaddy's historical total disregard for security, but hey, those pesky elephants won't shoot themselves! GoDaddy CEO's graphic elephant hunt video sends his clients flocking to competitors, and helps raise $20,000 for elephant charity: https://www.dailymail.co.uk/news/article-1374679/GoDaddy-CEO-Bob-Parsons-elephant-shooting-video-pays-Namecheap-Save-Elephants.html https://www.dailymail.co.uk/news/article-1374679/GoDaddy-CEO... GoDaddy CEO Kills Elephant: https://www.youtube.com/watch?v=YnM5yTW2B3g https://www.youtube.com/watch?v=YnM5yTW2B3g

runnr_az 2y ago
Bob hasn't been CEO of GoDaddy since 2011
- DonHopkins 2y ago
  I know, that's exactly why I wrote "historic", but the current owners gave him an enormous amount of money, didn't clean up their act, and GoDaddy CONTINUES to be terrible. The security breach we're discussing didn't happen 14 years ago, as you well know. They have a long and infamous track record and toxic corporate culture and unethical business practices and willfully misleading negligence of security that show no signs of improving. So charming that you're on such a familiar first name basis with a piece of shit like Bob Parsons. Are you friends? Are you actually carrying the water for GoDaddy, or think it's ok to murder elephants and run incredibly sexist commercials while never giving a shit about security or customers? Yuck.

retrochameleon 2y ago

They are also the worst hosting provider I have ever worked with, multiple times. Awful customer support and high prices. The only reason I work with them anymore is to migrate new customers to a different provider.

gtech1 2y ago

So basically like Microsoft ?

overstay8930 2y ago

Most companies are way too incompetent to even know how to secure their own data because it is just too expensive to actually hire someone that knows what they're doing - so most of the "cybersecurity" industry is just grifters talking about buzzwords and building dashboards to show how good they are at patching CVEs. I have had to tell multiple cybersecurity vendors that brag about working with huge companies and governments that we cannot work with them because of how poor their own cybersecurity practices are (i.e. not using secure compute/hardware crypto when dealing with our private keys). These are companies that should know better, I have had to stop ADP professional services more than once from disabling certificate validation on critical pipelines pertaining to confidential employee and customer information. I do not want to imagine what happens at 99% of companies with cybersecurity teams that don't even know what certificate validation is.

dustywusty 2y ago

The sad truth is that for the most part, the web hosting industry has normalized a fairly lax approach to security, and sees settlements like this, and even breaches, as a cost of doing business. Look at Wordpress maintenance, for example. It's a tough business hosting arbitrary UGC, and doing it well costs a lot of time effort and money (ask me how I know). But I fully agree: treating this as just another line-item cost is absurd.

deleted 2y ago

[deleted]

wsatb 2y ago

GoDaddy had really good marketing at one point and as of the last time I used it, which was years ago, they make it very difficult (I'm pretty sure by design) to leave. Their UX was one of the worst I've ever experienced in my life and they were consistently moving things around to make it worse. They essentially trap you, and someone without either the savvy or diligence will just give up.

burningChrome 2y ago

True story. I worked for a medium sized company. They had a very large commercial e-commerce site for their customers. They used Wordpress sites that were hosted on GoDaddy. I worked there for two years. They never updated any of their passwords for GoDaddy or their Wordpress sites. Its been almost ten years since I've worked there and I occasionally log on just to see if they've updated anything. Nope. Last time I checked was early 2024. Still nothing was updated. I mean, someone gets access to their GoDaddy account and within minutes will have full control of a major bit of their business. Talk about playing with fire.

philsnow 2y ago
> Its been almost ten years since I've worked there and I occasionally log on just to see if they've updated anything. Nope. Last time I checked was early 2024. Still nothing was updated. ... but.. why? Why let them live rent-free in your mind? Why admit to that in even a pseudonymous space?

to11mtm 2y ago

I've had a dim view of them ever since my first interaction with Domains by Proxy (At the time, I recall finding that many 'windows support' scam sites and other malware distribution was showing up under their domains, and every attempt to uncover would only lead to a 'oh that account is now banned but we wont tell you thx'.) ... Honestly it reminds me of how some Internet VOIP providers won't tell the name of the business who actually bought the number (Which, of course, complicates the ability to collect on TCPA when it's a number used for spam.)

roenxi 2y ago

I'd be less amazed if people could articulate why this matters. What is the harm being done here and why is it more costly than GoDaddy raising their prices by a few dollars?

barryrandall 2y ago
One example: They're selling domain registration privacy, but don't sufficiently secure the private data. The entire Domains by Proxy dataset is available on the dark web.