GoDaddy Wants Your Root Password

Johnny Fusion writes "The writer of the Securi Security Blog had an alarming awakening when a honeypot on port 22 on a GoDaddy-hosted VPS recorded login attempts using his GoDaddy username and password and even an attempt to login as root. It turns out the attempt was actually from within GoDaddy's network. Before he could 'alert' GoDaddy about the security breach, he got an email from GoDaddy Demanding his root login credentials. There is an update where GoDaddy explains itself and says they will change policy."

Comments

Fail

[Anonymous Coward]

Apparently submitter didn't RTFA.

Fail.

They physically own the box

[SpazmodeusG]

You already trust them 100% if you let them have access to your box

/That sounded wrong somehow

Re:They physically own the box

[LostCluster]

Yep. Reminds me of when I tried to set up a firewall password for a software vendor, only to find my boss constantly deleting it. He wanted to make a big deal out of every time they wanted to log in... I had problems that only they could solve so I needed them in frequently. He was basically wasting my time.

Re:They physically own the box

[mrsteveman1]

I've said it before, i'll say it again.

Always use protection when VPS'ing.

Re:They physically own the box

[WrongSizeGlass]

It's simple: All your passwords are belong to us.

Re:They physically own the box

[Anonymous Coward]

TWSS

Re:They physically own the box

[goldaryn]

I don't mind them having my password

It's SAGAPO

Re:They physically own the box

[mysidia]

Well, I understand why he'd want to delete it. But a password expiration should be used instead, and it shouldn't be removed until a period of time when it is no longer going to be frequently needed.

Re:They physically own the box

[Hurricane78]

Yes and no. It’s like having an apartment. The landlord might own it. But it’s still highly illegal for him to go into your apartment without you allowing it. It’s the same thing as breaking it.

The question of trust was not the point. The point is, that the landlord is telling you, to give you a copy of keys of the apartment, or he’d throw you out.
In Germany, he would get dragged to court, and lose big time, when trying this on anyone.

The same should be true for GoDaddy. Everything else would be laws not keeping up with progress.

Re:They physically own the box

[postbigbang]

It's unethical and definitely borders on breach, not to mention access laws in many jurisdictions.

It's bad behavior, and given their track record, they'll pull something like this again. Just loved those cuties at CES this year....

Re:They physically own the box

[Anonymous Coward]

Two things:

First, your boss is right - it *should* be a big deal each time an external party wants access to your system.

Second, your boss wasn't wasting *your* time. As you were being paid by him, it was his time you were wasting.

Re:They physically own the box

[aiht]

Actually, since the boss was the one causing the delay, it was his time he was wasting.

Re:They physically own the box

[c_forq]

Yes and no. It’s like having an apartment. The landlord might own it. But it’s still highly illegal for him to go into your apartment without you allowing it. It’s the same thing as breaking it.

In many jurisdictions it is often only required to give advanced notice. I know in my area they only have to give 24 hour notice. Their purpose for entry can be to display the apartment for a potential renter, for city/state inspections, or for maintenance. They don't have to ask, they only have to tell you. Most do ask, but mainly because having a good reputation in a competitive market is valuable.

Re:They physically own the box

[icebike]

Define "Your Box".

The guy was running "Virtual Private Servers". In effect, renting a virtual machine on a GoDaddy box.

That is slightly different than running his own box, because when malware is served or spam sent from that box it is GoDaddy that is on the hook.

His big mistake was assuming a VPS was HIS. Its really just a rented room, and just like a landlord can take steps to make sure meth is not brewed in his building, GoDaddy can protect their network.

Re:They physically own the box

[cayenne8]

"Yes and no. It's like having an apartment. The landlord might own it. But it's still highly illegal for him to go into your apartment without you allowing it."

Interesting...maybe it varies from state to state, but pretty much every lease I've ever signed specifically states the landlord can enter your premise pretty much any time they wish for whatever reason....without notice.

You might wanna check your lease..or local state regulations, this certainly isn't a national thing that you stated.

Re:They physically own the box

[Anonymous Coward]

You should get familiar with your rights, then. Landlords have to give 24 hour notice before entering your apartment. Failure to do this constitutes breaking and entering and I have taught one of my landlords this lesson the hard way.

Re:They physically own the box

[Anonymous Coward]

Yes and no. It’s like having an apartment. The landlord might own it. But it’s still highly illegal for him to go into your apartment without you allowing it. It’s the same thing as breaking it

I'm not sure about Germany, but in the US...

Most leases give the landlord ability to enter the apartment for any reason given 24 hours notice, or with no notice in an emergency situation. What landlord doesn't have his own set of keys?

Re:They physically own the box

[Anonymous Coward]

You already trust them 100% if you let them have access to your box

That's what she said!

Re:They physically own the box

[Anonymous Coward]

I know in CA (pretty sure NY too) it either has to be an emergency (house was on fire, bathroom was flooding) or they have to give you at least 24 hours notice. By leasing the apartment the landlord releases their right to access to the lessee. I'm not sure what constitutes a valid request for access and I'm sure that varies from place to place, but no place I know of allows free access to a private dwelling just because you own the building. So my landlord walks in on my wife in the shower and that's ok because he owns the building? If that's the case where you live please let me know so I can cross that off my list of places to live...

Re:They physically own the box

[John Meacham]

Really? that is crazy. I am in california and there are fairly strong restrictions on when a landlord can enter property and a lease can't change that. you can apparently look them up by state here:

http://portal.hud.gov/portal/page/portal/HUD/topics/rental_assistance/tenantrights

Re:They physically own the box

[Jurily]

As you were being paid by him

Bullshit.

Re:They physically own the box

[Anonymous Coward]

You don't change locks when you move in somewhere? Stupid, stupid, stupid.

Re:They physically own the box

[Anonymous Coward]

Assuming the rental is in the states, laws vary from state to state, and sometimes even city to city. Some need 24 hours before entering, some don't. Even so, in cases of emergencies, they can enter right away. Also, there are some laws which allow for inspections at any time, which is ripe for abuse.

To give an example of how laws vary, my college sits on two cities. Renting on one side gives stronger tenant protections, such as 24 hour notice, while the other does not. Depending on which side of a street you're on determines which city ordinances apply.

Re:They physically own the box

[mpe]

You should get familiar with your rights, then. Landlords have to give 24 hour notice before entering your apartment. Failure to do this constitutes breaking and entering and I have taught one of my landlords this lesson the hard way.

The "hard way" can be very hard in certain parts of the US where the intruder can face summery execution...

Re:They physically own the box

[ArsenneLupin]

Landlords have to give 24 hour notice before entering your apartment.

24 hours? That's not much. Imagine you're on holiday, or even just away for the weekend...

Re:They physically own the box

[im_thatoneguy]

Yeahhhhhh.... that's not actually the case in any state I've ever lived in. It's your space. Your landlord can enter if they have reasonable belief that the property is in immediate danger (leaking pipe, smoke etc...) but otherwise they have to give you notice in advance.

Re:They physically own the box

[Jedi Alec]

Thus giving the landlord a perfectly valid excuse for kicking in the door of what is still his property and sending you the bill?

Wow, am I glad I've got a landlord I can trust...if he wants something he gives me a call and we come to an arrangement, same thing the other way around.

Re:They physically own the box

[mcvos]

Actually, since the boss was the one causing the delay, it was his time he was wasting.

It was company time he was wasting. Not every boss is automatically owner of the company.

Re:They physically own the box

[Anonymous Coward]

I'm wasting my time posting this.

Re:They physically own the box

[twelveinchbrain]

It was company time *you* were wasting. You should not leave your firewall open to a vendor for an indefinite time.

Re:They physically own the box

[SpasticWeasel]

Especially in July and August

Re:They physically own the box

[idontgno]

Please look up the phrase "delegated authority".

In principle, it was company time that he was authorized to waste, if necessary in his judgment. Especially if he had budgetary authority or timecard approval rights.

And, FWIW, yeah, for once the boss was right. External access to internal network or system assets should be equivalent to escorted access to a secure physical facility. Approved case-by-case, limited-time, and monitored.

Re:They physically own the box

[idontgno]

"Summertime, and the killin' is easy..."

What, no Gershwin fans out here?

Re:They physically own the box

[Anonymous Coward]

summery execution

Wintry execution is better...

Re:They physically own the box

[dgym]

We set up an authorized SSH key on every VPS at provisioning time, and tell our customers about it. However, as you state, having access is one thing and having permission to use that access is another entirely. We will only access a customer's VPS with their explicit consent, to do anything else would be immoral and illegal.

This would be quite different if it was a managed VPS, as that implies permission, otherwise how would the hosting provider be able to manage it? However, it does not seem to be the case here.

If the host found that the VPS was doing anything against their TOS (they suspected malware, and could have confirmed that from the network traffic) then the proper cause of action would be to notify the customer, and if they deemed it necessary they could have cut it off from the network until the customer responds. Attempting to gain unauthorized access is not the right approach, it is a quick way to lose customers and it is also illegal just about anywhere with computer crime laws.

Re:They physically own the box

[Tim C]

Well, he did say "in Germany" so it's just possible that he doesn't live in the US...

On the other hand, there are similar legal provisions here in the UK - landlords have to give notice if they want to enter the property while you're renting it, they can't just turn up and demand to be let in (or let themselves in).

(Of course there are also provisions for dealing with unreasonable tenants - you can't keep a landlord out forever, you do have to let them in at some point when they ask)

Re:They physically own the box

[Nyder]

Yes and no. It’s like having an apartment. The landlord might own it. But it’s still highly illegal for him to go into your apartment without you allowing it. It’s the same thing as breaking it.

The question of trust was not the point. The point is, that the landlord is telling you, to give you a copy of keys of the apartment, or he’d throw you out.
In Germany, he would get dragged to court, and lose big time, when trying this on anyone.

The same should be true for GoDaddy. Everything else would be laws not keeping up with progress.

I guess you've never lived in an apartment.

Your landlord has a copy of your key already.

Re:They physically own the box

[bkpark]

Only in certain parts, unfortunately.

In California, castle doctrine isn't absolute: I am not allowed to kill my landlord if he is running away from the property after being beaten (only) half to death for breaking and entering.

Apparently there has to be an immediate threat to my life or something.

Re:They physically own the box

[BobMcD]

And, FWIW, yeah, for once the boss was right. External access to internal network or system assets should be equivalent to escorted access to a secure physical facility. Approved case-by-case, limited-time, and monitored.

This. If audits are involved, the company will be expected to have a reasonable amount of knowledge over who has access to the system. Open-ended vendor accounts need to be justified to the auditors. Nothing short of daily, and/or emergency needs are likely to get that done.

In short the boss doesn't get to tell the auditors, "Come on guys, it was a real pain in the ass for my tech to let them back in, cut us some slack." Or rather, if he does try that tactic, he may not be the boss much longer.

As a note to the tech, he's in real danger here if such a gap were to occur. The boss can simply say, "I took every effort to remove it each time I encountered it, and had no idea the employee had defied me yet again." Employee is fired, boss is scolded, and life moves on.

Re:They physically own the box

[Anonymous Coward]

What 3rd-world country do you live in where that isn't plain old burglary?

You pay rent so it becomes _your_ private home.

Re:They physically own the box

[arctan1701]

You should get familiar with your rights, then. Landlords have to give 24 hour notice before entering your apartment. Failure to do this constitutes breaking and entering and I have taught one of my landlords this lesson the hard way.

I discovered that here in Champaign, IL USA that landlords that just enter your apartment with no notice, and even without knocking basically have no repercussion. My lease states that they have to give 24 hours notice, but entering my apartment to "chat" (I think that the person was thinking that no one was home wanted to steal a few valuables) with me while I'm not even clothed isn't enough to do anything in criminal nor civil court. Avoid JSM Apartments in Champaign for all you future University of Illinois students!

Re:They physically own the box

[AzuMao]

You already trust them 100% if you let them have access to your box

FDE + temp sensor in RAM that trashes the key if it's cooled = you don't have to trust them at all. Just be sure to pick an OS that won't need rebooted ever. And disable 1394.

If it needs to be secure through reboots, you'll have to find/make a case that destroys the drives if someone opens/breaches it.

So ya, some measures need taken, but it's far from impossible.

Re:They physically own the box

[alexo]

The "hard way" can be very hard in certain parts of the US where the intruder can face summery execution...

Or in certain parts of Canada, a much harsher wintery execution.

Feature, not a bug.

[LostCluster]

When my trivia game was hosted at EV1Servers (now part of The Planet company) I kept my root password on file with them at all times, and quite a few times support logged in and helped me with a problem, like telling me the reason my webserver went down was that the Warnings file in Apache had hit the Linux system limit.

This isn't GoDaddy the domain registrar looking for your passwords, this is GoDaddy the hosting provider wanting to log in to a customer's VPS that's running on their hardware, and most likely is calming down a paranoid admin if he's yelling at Slashdot about a "security breach" when support wanted to log in.

Nothing to see here... move along.

Re:Feature, not a bug.

[Neil Blender]

Why not just create an alternate account with sudo for them? Why give them root?

Re:Feature, not a bug.

[LostCluster]

If you give them a non-root user with all of the privileges of root, there's no way for them to know if you've really given them root. You're trying rule-out possible problems, you don't want to give support a false answer they can hang their hat on.

Re:Feature, not a bug.

[lymond01]

Why not just create an alternate account with sudo for them?

If I had mod points, I'd bump you up. Your password is your password. Who knows what else a person uses that password for...trying to gain access by using it is tantamount to a phishing scheme. Get your own damn password.

Re:Feature, not a bug.

[maxume]

That is entirely the wrong way to do paranoia.

Re:Feature, not a bug.

[Neil Blender]

If you give them a non-root user with all of the privileges of root, there's no way for them to know if you've really given them root.

sudo su

Re:Feature, not a bug.

[Thinboy00]

Why not just create an alternate account with sudo for them? Why give them root?

Give them sudo and they can grab root whenever they want:
sudo -i
passwd
[input new password twice]
exit

Re:Feature, not a bug.

[batrick]

A VPS is rented space on hardware in the same way you rent an apartment. You don't own the hardware, but that doesn't mean the host can break into your box whenever he wants. Maybe the contract asserts they have that right (you would be an idiot to contract with them). Use Linode (arguably the best VPS provider in the industry): http://linode.com/ (I am not affiliated with Linode.)

Re:Feature, not a bug.

[Thinboy00]

If they have root or sudo then they can change your password behind your back... unless you have a restrictive /etc/sudoers file.

Re:Feature, not a bug.

[SpaceLifeForm]

sudo su -

Re:Feature, not a bug.

[Neil Blender]

Give them sudo and they can grab root whenever they want:/i>

First, why would support change the root password? They can sudo su and get root if you let them.

Second, one nice thing about giving them sudo instead of root is that you can disable/delete the user or change the password. This is preferable to changing the root password after they access it, especially if you have the same root password on dozens of machines.

Re:Feature, not a bug.

[TubeSteak]

Give them sudo and they can grab root whenever they want:

I think the point is that they should never have access to your password.
(Which is why TFA mentions that GoDaddy encrypts the passwords instead of using a one way hash)
If they have sudo and reset your root password, they're going to have to explain themselves later.

Re:Feature, not a bug.

[RoFLKOPTr]

When my trivia game was hosted at EV1Servers (now part of The Planet company) I kept my root password on file with them at all times, and quite a few times support logged in and helped me with a problem, like telling me the reason my webserver went down was that the Warnings file in Apache had hit the Linux system limit.

This isn't GoDaddy the domain registrar looking for your passwords, this is GoDaddy the hosting provider wanting to log in to a customer's VPS that's running on their hardware, and most likely is calming down a paranoid admin if he's yelling at Slashdot about a "security breach" when support wanted to log in.

Nothing to see here... move along.

That would make sense if this was a dedicated server, but this is a VPS. With the two different VM systems I've administered VPSes with (OpenVZ and Xen), you're able to log into any virtual machine as root from the hardware node without a password, negating the need for any of the user's passwords. With OpenVZ it's just `vzctl enter [vpsid]`. There is no reason GoDaddy should be asking for passwords, let alone be automatically probing the VPSes to make sure the passwords on file are correct.

Re:Feature, not a bug.

[Anonymous Coward]

Why don't they just put their own SSH public key in root's authorized_keys file? Surely they have access to the VPS's filesystem...

Re:Feature, not a bug.

[Minwee]

sudo -i

Why waste characters?

Re:Feature, not a bug.

[Tacvek]

Don't you mean "sudo -i". That will launch a root login shell. Using "sudo su -" just makes it look like you never read the sudo manpage.

Re:Feature, not a bug.

[mysidia]

Two things... (1) of course they can determine that after logging in with the credentials.

(2) Godaddy is using fricking Virtuozzo as their VPS hosting platform right?

They technically then don't NEED the root password at all if so.

In theory, they could 'vzctl enter' a customer's VPS from the host node. To be clear: _entering_ a container, spawns a new shell child process with the customer's VZPID, such that the child shell is actually created inside the customer's VPS.

Now there might be some reasons they wouldn't want to do this, or that they'd want to wrap that in additional layers.

Well, the reason is entering a VPS from the host node potentially places the VPS they have entered in control of the user's terminal.

That could in theory be a security risk to GoDaddy's own system.

So by getting the VPS root password, they can enter the VPS over the network, instead of through the hardware node.... thus, not ensuring a VPS can never have control over a terminal logged into the hardware node.

Basically, this is more sound security wise.

Anyways... there definitely doesn't seem to be anything wrong with GoDaddy gaining access to a customer VPS on an official basis, for good reasons, to investigate possible customer abuse or malware.

As long as they follow professional standards, respect customer privacy completely, do not conduct any abuses, such as stealing leaking info, or gratifying personal curiosities (IOW: no abuse whatsoever) -- basically everything you would expect from an admin of Gmail or Yahoo mail (as in not reading your e-mail and using it for personal uses, to satisfy curiosities, blackmail you, etc...).

Oh yeah, and that they exclude any utilization they generate from the customers' bandwidth / resource bills.

Re:Feature, not a bug.

[dissy]

If they have root or sudo then they can change your password behind your back... unless you have a restrictive /etc/sudoers file.

Change yes. View no.

Me giving you root access to my machine does not necessarily give you my passwords.
An easily brute forced hashing for passwords would, as would you installing some software to wait and log when i next typed in a password.

But both of those are illegal, and one would assume a ligit company would not want to do that.

This same legit company however OWNS that computer, so it is not illegal for them to log in as root.
(It probably would be if they claimed they never would, or permission wasn't agreed upon, but neither is the case)

Re:Feature, not a bug.

[Hurricane78]

But they won’t be able to know your actual password. Which was the point.
(Of course that ends, as soon as they install a different “passwd” program, and you use it to enter your new password.)

Re:Feature, not a bug.

[dissy]

If I had mod points, I'd bump you up. Your password is your password. Who knows what else a person uses that password for...trying to gain access by using it is tantamount to a phishing scheme. Get your own damn password.

Ironically, the very last sentence is exactly the solution one should use when choosing what password to set on a machine you do not own that others have full and total access to, physically, electronically, and legally.

If you use the same password on two things, a password being a shared secret, clearly both of those things now have that secret and can use it between each other.

Solution? Get your own damn password! :D

Re:Feature, not a bug.

['Aikanaka]

whut? What version of sudo do you have installed? That option doesn't exist on my box:

$ sudo -i
sudo: Illegal option -i
usage: sudo -V | -h | -L | -l | -v | -k | -K | [-H] [-P] [-S] [-b] [-p prompt] [-u username/#uid] -s |

$ sudo -V
Sudo version 1.6.7p5

Re:Feature, not a bug.

[zoe23]

Or you're using an older version of sudo that doesn't accept "-i" (e.g. =RHEL4)

Re:Feature, not a bug.

[Runaway1956]

Few people RTFA, why would they read a manpage? Come on, this is EARTH, the place with upright monkeys walking around, claiming to be intelligent. No one reads manpages!

Re:Feature, not a bug.

[Eil]

I was just about to write the same thing. This was something that was already brought up weeks ago in an Ask Slashdot. People who who don't have much exposure to the web hosting business (and that includes most Slashdotters) don't understand that web hosting falls into two major categories:

1) Unmanaged

2) Managed

Unmanaged hosting means you have full control over all of the software on your machine. (And by "machine" I mean both a real machine and a VPS or cloud node.) Nobody touches your configuration in the slightest once control has been handed over to you. If something goes wrong, including hardware failure, it's the customer's responsibility to notice it and either fix it or get it fixed. Any technical support beyond typical datacenter stuff usually incurs an hourly fee. Unmanaged hosting is ideal for people who want to admin their setup 100% on their own.

Managed hosting means the web hosting provider monitors the machine which can include external probes (checking for a response on various TCP ports) and internal metrics like system load and disk utilization. When a red flag pops up, a technician logs into the machine and tries to fix whatever is happening. You can call them up with all manner of ridiculous requests ("install WordPress for me and apply this theme") and they have to do it because, well, that's what the customers expect with a managed hosting account. Managed hosting is awesome for people who want a web server but don't have the expertise or will to actually configure and maintain it.

What the submitter ran into is that he though he had unmanaged hosting but actually has managed hosting. I don't completely blame him, because a lot of hosting providers don't explicitly state which style they provide. Sometimes it's even hard to tell after you've purchased the product. But its something you have to figure out or else you're going to be deeply dissatisfied with the company's technical support, as the submitter was.

Re:Feature, not a bug.

[camperdave]

I'm doing paranoia the right way. You're just saying that to get me to lower my guard. My paranoia is good enough, isn't it? What if it isn't? What if you're right? Maybe I am doing paranoia the wrong way. Oh goodness, maybe they already know I'm doing it wrong. Maybe they've already gotten in. Help me!

Re:Feature, not a bug.

[Culture20]

Why is sudo reimplementing partial (root user only) functionality of su? Sudo isn't emacs. Do one thing, and do it well. Let the users put the pieces together. "sudo su -" was good enough for RHEL, so it should be good enough for Fedora (or is that ancestry reversed?).

Re:Feature, not a bug.

[deblau]

http://www.gratisoft.us/sudo/man/sudoers.html

Re:Feature, not a bug.

[OverlordQ]

This isn't GoDaddy the domain registrar looking for your passwords, this is GoDaddy the hosting provider wanting to log in to a customer's VPS that's running on their hardware, and most likely is calming down a paranoid admin if he's yelling at Slashdot about a "security breach" when support wanted to log in.

Why would, nay, should they log in when there are no indications your box is infected? Asking them for help is a bit different then them arbitrarily accessing it whenever they feel like it, 'we have a process' or not. Most sane providers would send you something like "Hey, we think there's malware $foo coming from your box $bar because $baz, can you please look into it" rather then straight accessing your data.

Re:Feature, not a bug.

[spydum]

I don't think many security-minded folks would enable PermitRootLogin for sshd without-password on a public system. Though if they have access to the VPS filesystem, nothing would stop them from doing it themselves.

Re:Feature, not a bug.

[Anonymous Coward]

sudo su -

I've actually seen this in use on production machines. I asked why their unix admins just didn't give them su. I never got an answer.

Re:Feature, not a bug.

[bsDaemon]

:w! :q
the sure-fire way to edit /usr/local/etc/sudoers without using bitch-ass visudo (still must be root, or `sudo vi`, but that should be self-evident).

Re:Feature, not a bug.

[Anonymous Coward]

At the hosting company I work for we place our public key in root's authorized_keys file for all dedicated servers. We've got a jump server in place so that our techs can access the customer's server quickly and easily to fix issues. We do have customers that remove our public key, so when we run into these cases we ask them to either provide us an account with sudo access (if they are technical) or give us the root password (if they aren't). The only time it's a problem is when a customer has removed the public key and forgotten their password, then we'll charge them a small fee since we have to break into the box.

Before you ask, yes we do have a system in place so that the techs never have access to the private key yet can still use ssh.

Re:Feature, not a bug.

[lawpoop]

If they have sudo and reset your root password, they're going to have to explain themselves later.

Forgive me newbishness. What evidence would you have that *they* did this? If they were unscrupulous, couldn't they just say, "LOL Sorry you got rooted. No way it was us. Make sure you don't have a keylogger on your system n00b"

Re:Feature, not a bug.

[DarwinSurvivor]

su simply switches the user, sudo -i actually starts up a new shell (as if you logged in) and parses the .input, etc files and set up the environment variables.

Re:Feature, not a bug.

[DarwinSurvivor]

If visudo is "bitching" at you, you obviously don't know enough about the sudoers file to be editing it manually.

Re:Feature, not a bug.

[DarwinSurvivor]

Not if you edit the sudoers file (visudo) and only give them permission to run certain commands as root.

Re:Feature, not a bug.

[DarwinSurvivor]

$ sudo -V Sudo version 1.7.2p3

Re:Feature, not a bug.

[Random Person 1372]

That looks rather historic. From the sudo changelog:

2004-05-16 18:47 millert

                * CHANGES: There was no 1.6.7p6.

So 1.6.7p5 should be from around 2004.

Re:Feature, not a bug.

[erikina]

If they have sudo and reset your root password, they're going to have to explain themselves later.

Or they could just restore it back to what it was..

Re:Feature, not a bug.

[that this is not und]

especially if you have the same root password on dozens of machines.

Hmmm. Well, I suppose if you have a LOT of luggage that has combination locks....

Re:Feature, not a bug.

[loners]

unless they bothered to save the password files before changing it.

Re:Feature, not a bug.

[Anonymous Coward]

Do people not realize that "giving someone sudo" does not automatically give them full control of the system? Sure if you grew up in Ubuntu land, it does, but you can choose to make sudo only work with an extremely limited set of commands. Just give them sudo access to only the commands they need.

Re:Feature, not a bug.

[haruharaharu]

If you give them a non-root user with all of the privileges of root, there's no way for them to know if you've really given them root.

sudo su

Don't allow su for that account. Do we really need to spell it out? I was at amazon for 3.5 years, pretty much never had root (sudo only) and had zero problems as a result.

Re:Feature, not a bug.

[jimicus]

PermitRootLogin without-password forces root logins to be authenticated using keypairs rather than a password - though the manpage isn't terribly clear on this point. It's actually more secure than PermitRootLogin yes (which allows both keypair and password auth).

If you're going to permit root login remotely at all (rather than using sudo), it's the best way to do it.

Re:Feature, not a bug.

[Anonymous Coward]

if they reset your password before backing up the old file/line and dont undo it later they are dumb.

Re:Feature, not a bug.

[xouumalperxe]

This same legit company however OWNS that computer, so it is not illegal for them to log in as root.

Dunno. I'd compare that to you renting a house. The landlord can't simply waltz in unannounced, even if he owns the house (with some caveats, of course). The same base concept should pretty much apply.

Re:Feature, not a bug.

[xaxa]

Why is sudo reimplementing partial (root user only) functionality of su?

It doesn't need to be root:
sudo -u xaxa -i

Re:Feature, not a bug.

[xaxa]

sudo su -

I've actually seen this in use on production machines. I asked why their unix admins just didn't give them su. I never got an answer.

Because sudo -i (or sudo su -) requires the user's password. su - requires the root password. If there is no root password set then su (to root) is useless. sudo logs to syslog (potentially on a different system). If users know the root password it's easy for them to do things that can't be traced (e.g. log in as root directly, or su to root from any user's account).

Re:Feature, not a bug.

[bsDaemon]

I know plenty about it, and its not complaining at me, I just refuse to use the command. Never have, never will, not going to change.

Re:Feature, not a bug.

[andy.ruddock]

sudo -u user causes sudo to run the specified command as a user other than root.

Re:Feature, not a bug.

[Alpha830RulZ]

There are various log files which record logins and use of sudo. You'd be able to review /var/log/secure, and see a login from IP 1.2.3.4 to the root account. There is a file that records use of sudo, though I don't know it's name off the top of my head. Unless, of course, they were nasty and educated enough to go edit the log files. In that case, there would be artifacts, like the passwd file getting changed during a time when no-one was supposedly logged in.

The existance of thesse log files is one reason for requiring use of sudo for everything. It provides an audit trail of who performed admin actions. Many sites disable root logins once this is set up.

Re:Feature, not a bug.

[dissy]

Dunno. I'd compare that to you renting a house. The landlord can't simply waltz in unannounced, even if he owns the house (with some caveats, of course). The same base concept should pretty much apply.

Well, I do agree that it should be that way.

However your example is only true because there are laws specifically made for renters for that sort of thing.
It is legal for a hosting provider to include such a clause in their EUA still.
* Or at least as of a couple years ago, but I assumed if that changed the story would have made it on a news site for nerds somewhere... ;)

Re:Feature, not a bug.

[Anonymous Coward]

Take at look at env after each of these. "sudo -i" still inherits stuff from the user environment (PATH, MAIL, XAUTHORITY, etc... I get different results in different distros). "sudo su -" is much better. I too wish it didn't look so silly though.

Re:Feature, not a bug.

[Thinboy00]

sudo -i
useradd -G admin foouser
[assuming group admin is a/the group mentioned in /etc/sudoers]
exit

Now they can log in as foouser without telling you about it, esp. if you later revoke their access or something.
If you give someone the ability to become root they can do whatever they want, in principle. If you don't want them to do these things, the simplest way to do that is to not give them root/sudo at all.

Also, since when is it good security policy to "have the same root password on dozens of machines"?

Re:Feature, not a bug.

[xiong.chiamiov]

Why not just create an alternate account with sudo for them? Why give them root?

Give them sudo and they can grab root whenever they want: sudo -i passwd [input new password twice] exit

That assumes that you're giving them permission to run any command using sudo (which, granted, is how most sudoers files are set up). Just allow them to use the things that you think they'll need (which doesn't include visudo or a text editor, else they can change it ;) ).

No Surprises Here

[neoform]

Not surprising at all.

I had a domain with Godaddy a few years ago when they breached ICANN's rules by threatening to confiscate my domain unless I paid them $200, because I had supposedly breached their TOS.

GoDaddy is not to be trusted.

Re:No Surprises Here

[LostCluster]

I had supposedly breached their TOS.

What was your alleged offense and how do we know you didn't do it?

Re:No Surprises Here

[Anonymous Coward]

Care to include some proof to backup your claim?

Re:No Surprises Here

[aflag]

What registrar do you recommend instead?

Re:No Surprises Here

[LostCluster]

And since GoDaddy is aware that their GoDaddy Girls ads gain them some men, but offend some women, they operate several other domain registrar brands that seemingly have no connection.

Re:No Surprises Here

[Thinboy00]

They can't take his domain, regardless of the TOS, if I understand his post correctly. IANAL and IANFamiliarWithICANN'sRulesOrTheTOS.

Re:No Surprises Here

[neoform]

Someone (falsely) accused me of spamming.

However, even *if* I was a spammer, what right does godaddy have to confiscate my domain? I didn't even have any hosting with them, I just had a domain registered. This is clearly against ICANN policy. Registrars are not arbiters who get to take your domain away because they feel like it.

Re:No Surprises Here

[shentino]

Who exactly would spank them if they did?

Rules are no good unless they can be enforced.

Re:No Surprises Here

[Anonymous Coward]

I'm a fan of Hover (formerly DomainDirect). They're the registrar operated by Tucows, not a reseller. Clean interface (if a touch weird) and absolutely none of the sleazy upselling. Domain privacy comes with the registration, no fearmongering like GoDaddy throws at you.

It's a little more, so if you have hundreds of domains, it might make a dent. Otherwise, it's worth the cost of a mocha at starbucks every year to patronize a business that doesn't come off like used car salesmen.

Re:No Surprises Here

[neoform]

This was back in 2005, but lucky for me gmail archives everything. ;)

Dear *******,

Thank you for contacting Go Daddy's Spam and Abuse Department.

Go Daddy defines spam as any communication sent to recipients, as an
advertisement or otherwise, without first obtaining prior confirmed consent
to receive these communications from your domain by the recipient. This
includes, but is not limited to, the following:

- Email Messages
- Newsgroup postings
- Windows system messages
- Pop-up messages (aka "adware" or "spyware" messages)
- Instant messages (using AOL, MSN, Yahoo or other instant messenger
programs)
- Online chat room advertisements
- Guestbook or Website Forum postings

It appears that the complaint we've received regard off-topic or
unauthorized email advertisements. A copy of one of the
offending advertisement has attached to this message.

Please keep in mind that it is not our intention to cause anyone's business
to suffer and we do appreciate your cooperating with us on this matter.
Because of your cooperation and willingness to resolve this issue thus far,
your services have not been interrupted, but this situation remains
unresolved.

At this point you have two options available to you, each is outlined below:

----- Option #1: Discontinue all future unauthorized advertising practices.

If you wish to remain a Go Daddy customer and close this matter, you must
reply to abuse@godaddy.com with the following:

1. A statement that you (or your employees, affiliates, 3rd party marketers,
etc.) will no longer advertise or promote your domain name using
unauthorized instant messenger advertisements or any other unauthorized form
of communication.

2. Authorization for GoDaddy.com to charge a $199 non-refundable
administration fee* to the credit card on file for your account.

If you reply with this statement and agree to pay this fee, Go Daddy will
accept, in good faith, your commitment as proof of your desire to correct
this problem.

Please be aware that Go Daddy will continue to monitor this situation. If
after you commit to ceasing this activity it is determined that this problem
persists, your domain name may be immediately redirected and your service
suspended. We realize additional complaints resulting from the posts you
have just committed to stop may come in and we will of course consider this,
and contact you before taking action.

----- Option #2: Transfer your domain name to another registrar.

If option #1 is not agreeable to you, or you are unable to comply with these
terms, you must transfer your domain name to another registrar. We first
require that you pay a $50 administration fee before allowing you to proceed
with your transfer. Again this fee used to offset the costs of "cleaning up"
the outstanding spam complaints against your domain name.

You will need to provide the following in your reply:

1. A statement that you will initiate the transfer of your domain name to a
new registrar within the next 24 hours.

2. Authorization for GoDaddy.com to charge a $50 administration fee* to the
credit card on file for your account.

----

* You may want to log into your Go Daddy account and confirm that the card
on file is valid and has not expired.

-----

*PLEASE NOTE: If you do not follow one of the options outlined above your
domain name may be immediately redirected and your service suspended.

-----

Please let us know what option you choose, thank you for your cooperation.

Sincerely,

Spam and Abuse Department
GoDaddy.com

When I refused both those options (since I had paid for a years worth of registration and didn't feel like paying any penalties, they told me they would change my dns info without my permission).

Re:No Surprises Here

[LostCluster]

Check the TOS. You agreed to pay the costs of investigating, and to give over your domain if you were truely spamming.

Re:No Surprises Here

[Anonymous Coward]

I don't know much about ICANN's rules, but you seem to be in the loop. Why didn't you progress this? Sitting on your hands saying "GoDaddy are evil...." is not good enough.

Re:No Surprises Here

[Anonymous Coward]

ICANN is a lot like the Better Business Bureau in terms of ability to enforce anything

Re:No Surprises Here

[neoform]

The only way to enforce these rules is with a lawsuit. I can't stand lawyers.

All I cared about at the time was godaddy not killing my business by suspending my site's domain. Once I successfully transferred my domain away, I just made it a point to never deal with godaddy again; that's all.

Re:No Surprises Here

[Anonymous Coward]

It appears that the complaint we've received regard off-topic or unauthorized email advertisements. A copy of one of the offending advertisement has attached to this message.

Where's the copy of the offending message they say was attached?

I'd have thought it was obvious, but...

[straponego]

Pro tip: never trust your domain or your business to a company who got its name from a Thrill Kill Kult song and advertises its services with soft-core porn.

Re:I'd have thought it was obvious, but...

[interkin3tic]

Pro tip: never trust your domain or your business to a company who got its name from a Thrill Kill Kult song and advertises its services with soft-core porn.

That seems like it would depend on what I used my domain for or what my business was. Soft-core porn site? Seems fitting.

Re:I'd have thought it was obvious, but...

[steelfood]

advertises its services with soft-core porn.

Their advertising screams "by geeks for geeks" to me.

Re:I'd have thought it was obvious, but...

[Anonymous Coward]

Geek like "good with computers" or geek like "never seen a woman before"?

YES SLASHDOT, THERE'S A DIFFERENCE, IT'S NOT A SETUP

Re:I'd have thought it was obvious, but...

[ClosedSource]

Yes. If they were serious they'd surely advertise with hard-core porn.

Re:I'd have thought it was obvious, but...

[Jah-Wren Ryel]

Yes. If they were serious they'd surely advertise with hard-core porn.

That's a different registrar - "Oh! Daddy!"

Re:I'd have thought it was obvious, but...

[Anonymous Coward]

Pro tip: never trust your domain or your business to a company who got its name from a Thrill Kill Kult song and advertises its services with soft-core porn.

Pro tip: never trust someone who thinks the source of a company's name or their advertising has anything to do with the level of service they offer.
Especially when that someone is ranting about "soft-core porn" while posting under the name of "Strap-On & Go", an obvious reference to Dildos & Watersports.

Re:I'd have thought it was obvious, but...

[Spazholio]

Holy hell, someone else who remembers/is a fan of TKK?

I always wondered what use GoDaddy is

[beakerMeep]

They only seem to market themselves by objectifying women and their services don't seem low priced or high quality. Frankly I think they are an embarrassment to the tech world.

Re:I always wondered what use GoDaddy is

[CorporateSuit]

They only seem to market themselves by objectifying women.

You're not one of those people who think that "The Office" is an actual documentary, are you?

Re:I always wondered what use GoDaddy is

[beakerMeep]

It's not?

Re:I always wondered what use GoDaddy is

[skuzzlebutt]

But what about the boobies^H^H^H superbowl commerci^H^H^H quality service they provide?

Re:I always wondered what use GoDaddy is

[Anonymous Coward]

Last I checked they were the lowest priced registrar. I agree their other services are not competitively priced, but I don't use them for anything but domain registration.

Should I be using a different registrar for cheap domain registration? Who is cheaper?

Re:I always wondered what use GoDaddy is

[Anonymous Coward]

try joker.com
or gandi.net

Re:I always wondered what use GoDaddy is

[bill_mcgonigle]

Should I be using a different registrar for cheap domain registration? Who is cheaper?

Are you squatting on domains? If so, stop that. If not you can afford the $15/yr that a reliable/competent outfit like DynDNS will charge.

Re:I always wondered what use GoDaddy is

[hduff]

They only seem to market themselves by objectifying women.

You're not one of those people who think that "The Office" is an actual documentary, are you?

Or "The Flintstones" is a documentary?

Re:I always wondered what use GoDaddy is

[awyeah]

I'll second gandi.net.

Thats scary....

[DJ DeFi]

Back up your data and move to a new host...don't forget to change the passwords though!

Re:Thats scary....

[sakdoctor]

They store all the passwords encrypted, and they can only be retrieved and reversed after a member of the security team opens a ticket and explains the reason for using the password (like to investigate malware)

Look at this epic fail right here. All security bets, are off.

I wonder...

[fuzzyfuzzyfungus]

My understanding is that "VPS" usually implies that you are living in a VM on somebody else's box.

How robust are the various common server operating systems against an attacker breaching the system by either reading or manipulating the VM's state? When your "hard drive" is just a file on somebody else's system, and your RAM is just a block of memory reserved for you by whatever virtualization mechanism is being employed, either could conceivably be read or written without any access to your system through the usual channels(ssh, admin passwords, etc.) If, say, you are using public key authentication, to avoid password attacks entirely, what would stop the VM host from just scribbling their own public key onto the list of approved public keys stored on your filesystem? Or doing something subtler, like scanning your block of RAM to find your SSH daemon, and flipping a few bits to make it interpret your login attempt as valid rather than failed?

Obviously, in theory, you can never win against somebody who controls the hardware(and, with VMs, they don't even need EE skills and an expensive oscilloscope to poke at the hardware, since the "hardware" is actually software). However, theoretical viability and practical doability can be very different animals. In this case, they tried a clumsy password guess, followed by a demand, obviously not uber-hacker material. Has there been any work done, though, on the strengths, weaknesses, and limits of what a VM that doesn't trust its host can do?

Re:I wonder...

[theJML]

You know, This is the first thing I thought of.

The second thing is that they REALLY didn't even need to ask. Seriously, it's a VM, they can copy and crack the vm. They can restart it single user. They can mount the vm disk to another vm, change the password to what they want, and then put the disk back. They could make themselves a nice little backdoor of some sort. Etc...

In fact, the more I think about it, the nicer it was that they just asked for it. Once you trust someone to hold your entire machine in virtual space, they really might as well just have the password.

Re:I wonder...

[mr exploiter]

Capitan Obvious answer: there is nothing the VM can do to prevent someone with physical access from having complete control.

Re:I wonder...

[FlyingBishop]

A lot of people are missing the point. Obviously your hosting provider has access to your machine, and if they detect suspicious traffic, it's quite natural for them to log in and change things.

What is not okay is asking for passwords. They own the fucking VPS, if they want access they have it. Leaving sensitive passwords where anyone can reach them is a serious security breach. GoDaddy, if they need access to the VPS, should have a special administrative account for that purpose. They should not have a database where their employees can read everyone's passwords (no matter how well they secure it.) Passwords should always be salted and hashed.

Re:I wonder...

[scdeimos]

Passwords should always be salted and hashed.

Unless they shouldn't be.

Doing that for POP3-MD5 (or any other challenge authentication scheme), for example, would open you up to replay attacks, because the challenge would have to be the same for each login attempt.

What about credit cards? Credit card numbers in a PCI-compliant credit card vault are encrypted, and only decrypted (by a master key in the billing system) when needed for bill processing. If they were salted and hashed you'd never be able to bill anybody for anything.

Re:I wonder...

[fuzzyfuzzyfungus]

I'm not sure that that is true, at least not true enough to be useful. The case of the OS in a VM that doesn't trust its VM host is, it would seem to me, quite similar to that of the program running on an OS/other programs environment that it does not trust.

Where have we seen a lot of focus on that problem? DRM(and, secondarily, antivirus/anti-rootkit work). In both the case of the program that is trying to hide crypto keys from the computer's owner and the case of the program trying to determine, from within the running OS, whether or not the OS has been rootkitted and is now lying in various subtle ways, we have the very similar situation of a program whose memory and HDD spaces are exposed to hostile powers trying to keep secrets.

Now, the punchline has always been that the defender cannot win. Anything they try is just obfuscation, which a sufficiently clever attacker can always punch through. However, in the presence of attackers of only finite cleverness(and patience), obfuscation can work. All software DRM is breakable; but some has been harder to crack than others.

I would be curious to know where on that continuum common OSes running in VMs fall. I'd assume that they fall on the "almost totally naive" side; but, given the amount of attention on address space layout randomization, and tripwire and so forth(in the service of solving quite different security problems; but still introducing complexities) it might be harder than one would suspect, although always possible in theory.

Re:I wonder...

[mr exploiter]

I can confirm that is not technically challenging to do today as virtual machines vendors don't try to prevent from this. They could do things harder (think encrypting disk files, in memory encryption of VM's memory, tricks with virtual memory to prevent easy access from other process and from kernel modules, etc). But they don't.

Re:I wonder...

[dcam]

How robust are the various common server operating systems against an attacker breaching the system by either reading or manipulating the VM's state?

They aren't. The old rule of physical access applies to VMs. You could mitigate this to some extent by moving to a encrypted file system (if they allow this).

It ain't hard to drag a vm to another machine and explore at your leasure.

Double take

[syousef]

We've got a security expert gets an email demanding his root password, and it's all good because they called and said sorry we'll change our policy? HUH? No wonder people are commenting that he's been paid off!!!

Re:Double take

[Anonymous Coward]

keep in mind this so called expert is hosting on go-daddy and probably has an iq of 80.

Christian morality

[wiredlogic]

This isn't surprising coming from a company founded on Christian* values.

*The distorted Protestant American version of the faith.

Re:Christian morality

[HikingStick]

What makes you think GoDaddy is founded on any sort of religious values? The ads don't suggest it.

Re:Christian morality

[couchslug]

"*The distorted Protestant American version of the faith."

Religions should be judged by practice, not theory.

Besides the obvious fact they are fantastic nonsense, the superstitions of the desert are only useful for facilitating oppression and violence.

Re:Christian morality

[Anonymous Coward]

They have a long standing policy of refusing business with people who promote an agenda that counteracts conservative Christianity. It's impossible to register or get hosting for a pro-choice site with them for instance. Just because they use T&A in their ads doesn't make them even handed. It just shows that they will stoop to any level to attract customers.

Re:Christian morality

[HikingStick]

That still doesn't mean that they were or are, in any way, founded on "Christian values". It just means that the current board and senior management have a conservative bias.

Color me surprised

[beefnog]

With a title this inflammatory I could have sworn I was about to read a kdawson piece.

Re:Color me surprised

[daveime]

Nah, the title would have been "GoDaddy HACKZORED my server".

Completely misleading, check.
Uses the word "hack" inappropriately, check.
Links to other articles about a different branch of the same company, check.

Re:So who's your daddy? OoooOoooh YeeaaaH!

[Anonymous Coward]

CENSORSHIP IN Slashdot!? WTF!! Otherwise how can you go from GOOD to BAD Karma WITHOUT negative mods????

That's funny... your post history shows otherwise. If you don't want to have such awful karma, stop posting stupid shit all the time... Like the post you just made.

Re:So who's your daddy? OoooOoooh YeeaaaH!

[X0563511]

I much prefer the moniker "NoDaddy"

The question is if GoDaddy is trustworthy.

[Futurepower(R)]

That's not the question. The question is if GoDaddy is trustworthy.

Judge for yourself. Here are some stories about GoDaddy on Slashdot, in order by date:
Go Daddy Usurps Network Solutions (2005-05-04)
GoDaddy Serves Blank Pages to Safari & Opera (2005-12-08)
GoDaddy.com Dumps Linux for Microsoft (2006-03-23)
GoDaddy Holds Domains Hostage (2006-06-17)
GoDaddy Caves To Irish Legal Threat (2006-09-16)
MySpace and GoDaddy Shut Down Security Site (2007-01-26) That incident prompted this web site:
Exposing the Many Reasons Not to Trust GoDaddy with Your Domain Names.
Alternative Registrars to GoDaddy? (2007-02-03)
GoDaddy Bobbles DST Changeover? (2007-03-11)
850K RegisterFly Domains Moved To GoDaddy (2007-05-29)
According to this March 11, 2008 story in Wired, GoDaddy shut down an entire web site of 250,000 pages because of one archived mailing list comment: GoDaddy Silences Police-Watchdog Site RateMyCop.com. See below for Slashdot's story about RateMyCop.com.
GoDaddy Silences RateMyCop.com (2008-03-12)
ICANN Moves Against GoDaddy Domain Lockdowns (2008-04-08)
GoDaddy VP Caught Bidding Against Customers (2008-06-29)

Those are just the stories until July of 2008.

GoDaddy's reputation is not just one of extremely negative stories. In my opinion, GoDaddy tries to confuse non-technical people by offering services they don't need and presenting them as valuable.

Here are some of the opinions of Bob Parsons, the owner of GoDaddy. He is pro-violence: Close Gitmo? No way!!

He uses women's bodies to advertise: Bob Parson's Video Blog.

Re:The question is if GoDaddy is trustworthy.

[Rob the Bold]

Here are some of the opinions of Bob Parsons, the owner of GoDaddy. He is pro-violence: Close Gitmo? No way!!

When you cite the man's blog that has absolutely nothing to do with the hosting company he is CEO of, to state that he is "pro-violence", you kind of blow your the credibility of your argument. Please keep your personal political opinions out of non-political debates. What you did there is no better than any other meritless political smear campaign.

The rest of your post was spot-on, though, and I wouldn't trust GoDaddy with my first name.

You can base your opinion of a corporation on the politics of its CEO. Unless you're afraid that ACs will criticize you . . . No, it't the Anonymous Cowards!!!!1! Oh noes!

But seriously, folks. If a CEO is naive enough to think that no one will be impressed by his politics, positively or negatively, it's hard to imagine how he got so far in the first place. More likely, a CEO figures he'll play the percentages. That's how smart managers win ball games.

Re:The question is if GoDaddy is trustworthy.

[Anonymous Coward]

"GoDaddy's reputation is not just one of extremely negative stories. In my opinion, GoDaddy tries to confuse non-technical people by offering services they don't need and presenting them as valuable. "

This is quite an understatement. I do occasional web development on the side, and I recently had my first client in a while. I told her to go ahead and sign up for the domain with GoDaddy, but she said she couldn't figure out what to do. So I helped her out in person and I couldn't *believe* the amount of crap they try to push on you. Pages full of options and "upgrades" and packages on every step ... even after you finish your purchase! It's a tremendously confusing experience for someone who doesn't know how to filter out the signal from the noise.

Re:The question is if GoDaddy is trustworthy.

[Hurricane78]

That's not the question. The question is if GoDaddy is trustworthy.

[Huge list of news, showing GoDaddy’s questionable trustworthiness]

I think you just answered that question. ;)

Also, (I know that looks are not really relevant) why does he look like a cross of Hannibal Lecter and a child molester? (I swear, looks can’t be that irrelevant, considering [statistically significantly] how often they fit. ;)

Re:The question is if GoDaddy is trustworthy.

[Runaway1956]

"GoDaddy tries to confuse non-technical people by offering services they don't need and presenting them as valuable."

I work nights. Sometimes, I'm actually in the shop to listen to the radio. It seems that every 15 minutes, one company or another is pitching some worthless product, trying to scare the dumb consumer into purchasing some "security" product.

"Hi, I'm former Police Chief Frazzle Brain. Did you know that online indentity theft is the fastest growing crime in America? Send me $100 and I'll protect you!"

Can't help wondering how many clueless people send him the money . . . .

Re:The question is if GoDaddy is trustworthy.

[Anonymous Coward]

GoDaddy's reputation is not just one of extremely negative stories. In my opinion, GoDaddy tries to confuse non-technical people by offering services they don't need and presenting them as valuable.
Here are some of the opinions of Bob Parsons, the owner of GoDaddy. He is pro-violence: Close Gitmo? No way!! [archive.org]
He uses women's bodies to advertise: Bob Parson's Video Blog [bobparsons.tv].

You almost had me up until this point.

1. That's called marketing & sales. Not saying I agree with it, but that claim can be made about just about any company out there.
2. The owner's positions on violence, gitmo, and the color of underwear (if any) which he uses are of ZERO importance. If you want to go on some moral crusade because of a companies religious beliefs feel free, but don't bring it into this discussion as it's completely irrelevant.
3. See point 1 verbatim. I also notice you aren't having any moral outrage over anybody using Men's bodies to advertise, which also makes you a hypocrite.

So which competing hosting company are you schilling for?

Re:The question is if GoDaddy is trustworthy.

[Anonymous Coward]

Wow, maybe you have had a bad experience with them? Seemed ready to go for that one. I love the "pro-violence" and advertising on women's bodies, for shame :) Personally I have never used them and will not ever because of folks I know, who had issues. Not trust related though. Sorry carry on.

Re:The question is if GoDaddy is trustworthy.

[Anonymous Coward]

You can base your opinion of a corporation on the politics of its CEO

Sure you can, and many people do.

But the statement

He is pro-violence: Close Gitmo? No way!

is inflammatory. To start with it is opinion presented as fact. Even following the link & reading it the statement the CEO's postition on violence is debatable since it isn't talking about "violence" but a specific situation, yet the poster presented it as a sweeping generalization of the CEO's entire belief system. It also is carefully phrased to imply that there is something wrong with being pro-violence, which is ALSO opinion & a debatable issue.

The poster then proceeds to switch subject tracks entirely & go off on some type of radical feminist rant. Yes, they do use women's bodies as advertising, that's not exactly a secret you know. The statement is also presented with the connotation that this is a Bad Thing, which is the poster's opinion and open for debate. The poster is obviously biased since there is no mention of using Men's bodies as advertising.

Unless you're afraid that ACs will criticize you . . . No, it't the Anonymous Cowards

First, I post both anon and under my name depending on where I am.
Second, I don't give a shit if you're posting AC or not, it doesn't make your points or opinions any more or less worthwhile.

So while the poster managed to fool a bunch of mods into giving him an interesting tag, all the post really amounts to is a series of Redundant links to former slashdot articles, followed by some crafty Flamebait.
Which, after looking over his comment history, is pretty much par for the course.

Re:The question is if GoDaddy is trustworthy.

[uvajed_ekil]

That's not the question. The question is...

...why does anyone use them? Don't they know there are other hosts that don't use such tactics or resort to ridiculous tv commercials?

Re:The question is if GoDaddy is trustworthy.

[yuhong]

GoDaddy eventually apologized for the last one on it's radio show. Go to http://www.radiogodaddy.com/ and look for the December radio show on "Virtual Weddings, Flawed Internet Filters & a Candid Discussion About Go Daddy Business Practices".

Re:The question is if GoDaddy is trustworthy.

[yuhong]

Actually, it is not for the last one, it is for the Standard Tactics disaster which I am not sure was covered on slashdot, and the 90 day domain lockdown which was.

Re:The question is if GoDaddy is trustworthy.

[Darkness404]

Don't they know there are other hosts that don't use such tactics or resort to ridiculous tv commercials?

Chances are, they don't. For a middle-aged tech-illiterate person, seeing their commercials during a Super Bowl might be enough to make them wonder if they should have a website. And I don't see eNom, or Network Solutions making any prime-time ads.

Due to the relatively low cost of GoDaddy domains and plans at least to the average person, there seems to be no need for them to search around. Mix that with plans to appeal to the average person and you have a situation where no one really wants to shop around.

Re:The question is if GoDaddy is trustworthy.

[Anonymous Coward]

That's not the question. The question is if GoDaddy is trustworthy. Judge for yourself. He uses women's bodies to advertise: Bob Parson's Video Blog.

How is that an issue of trustworthiness as long as he has paid these women for their work? Or do you just not like that kind of thing? Seem like a a big tinfoil hat warning is needed here.

Re:The question is if GoDaddy is trustworthy.

[Anonymous Coward]

I like how you added that "Dumps Linux for MS" link there as if it actually mattered. Another dumb freetard.

Re:The question is if GoDaddy is trustworthy.

[Anonymous Coward]

I was somewhat convinced by your argument until you randomly brought politics into it, and now I don't respect it anymore. The owner's opinion on politics and the fact they disagree with yours is no argument against the trustworthiness of his company, but the fact that you think it is is a sign that you may have a personal bias against him, and therefore it does diminish your credibility.

Re:The question is if GoDaddy is trustworthy.

[yuhong]

As it was not covered on slashdot, here is a list of articles from DomainNameWire.com about Standard Tactics:
http://domainnamewire.com/2009/01/12/godaddy-brings-humor-to-company-mistakes/
http://domainnamewire.com/2008/12/17/go-daddy-to-shut-down-standard-tactics-llc/
http://domainnamewire.com/2008/12/08/commentary-why-standard-tactics-is-a-problem/
http://domainnamewire.com/2008/12/03/standard-tactics-llc-how-godaddy-profits-from-expired-domains/
It has some suggestions on "How Go Daddy Can Court Domainers":
http://domainnamewire.com/2010/02/23/how-go-daddy-can-court-domainers/
For more articles do a query for GoDaddy at:
http://domainnamewire.com/index.php?s=godaddy&x=0&y=0

Re:The question is if GoDaddy is trustworthy.

[lowrydr310]

Don't get me started on "Go Daddy." Aside from a ridiculous company name that is far from even whispering professionalism, I had an incident where I lost a domain to them because of their shady squatting practices.

I used GoDaddy to search the availability of my last name as a domain, about two or three times within a week, and then when I went to register it a short while later the domain was already freakin' registered by GoDaddy. They were squatting on my last name! This is NOT a common last name, and I didn't use any other registrar to search the availability. There's no chance in hell this was coincidence, GoDaddy intentionally did this. I had to wait a year for their registration to expire before I could finally register it myself.

Re:The question is if GoDaddy is trustworthy.

[Nyder]

That's not the question. The question is if GoDaddy is trustworthy. ...

He uses women's bodies to advertise: Bob Parson's Video Blog.

OMG!!!!!

Someone is using womens bodies to advertise!!!!!!!

What, you just arrive on our planet? Almost everything uses womens bodies to advertise.

Re:The question is if GoDaddy is trustworthy.

[Syberz]

He uses women's bodies to advertise

And this is a bad thing?

Seriously though, if that was a reason to not use his service we'd have to stop drinking, using body products, going on vacation, buying motorcycles, buying magazines, tuning cars, etc.

The rest of your points seem perfectly valid though.

Re:The question is if GoDaddy is trustworthy.

[Anonymous Coward]

Thanks for the review of GoDaddy's rep. This needed to be said.

I could never trust an organization that advertises the way they do. It's too sleazey which suggests that they'll do anything to turn a profit; even exploit the privacy of their own customers.

Re:The question is if GoDaddy is trustworthy.

[Beyond_GoodandEvil]

OMG!!!!! Someone is using womens bodies to advertise!!!!!!! What, you just arrive on our planet? Almost everything uses womens bodies to advertise.
Oh, is that all? I thought perhaps the parent poster was claiming GoDaddy was rendering human female corpses into paint and then making their advertisements with said paint. But using attractive women to sell your product, that was old hat before television became popular so there's no problem there.

Re:The question is if GoDaddy is trustworthy.

[siriuskase]

The female bodies in the ads do look rather attractive, but don't do much for me. But you have me hyper curious about that competing firm which use male bodies. I can hardly type I'm so excited. Please provide URL before I ezplode......

Physical Access

[nicolas.kassis]

They have physical access which means they don't need the root password. The fact that they store the password just shows plain lack of skill or laziness to implement a better access method by their admins. Store the pass where they could potentially be accessed is the issue here. What happens if the database is hacked and the passwords stolen without their knowledge. Insider hacking is also an major issue. Having the root password could allow an attacker to log in and erase all traces easily. Of course it's doable with physical access too but in that case, it's a little more intrusive.

Re:Physical Access

[Anonymous Coward]

with physical access they could just reboot the machine and load it up on "Kon-Boot" (google it) and login as a sudo without ever changing any files or leaving any trace.

Re:Physical Access

[scdeimos]

It's a VPS. They could just fork an image off in another session and hack it to pieces if they wanted.

Yes, exactly.

[Anonymous Coward]

Care to include some proof to backup your claim?

Exactly.

And IF a company tries that BS, start making a LOT of noise and shame the SOBs ro at the very least warn the rest of us so we can put a kibosh on any business.

Re:M$ pwnage

[Anonymous Coward]

Wow, that is the cleverest, most original post I have ever seen on Slashdot. I mean whoa - a negative Microsoft post. Who would have ever though of it? Hats off to you sir!

Another story, partly about GoDaddy. Chilling.

[Futurepower(R)]

Quote from the story, Registrars Still Ignoring ICANN Rules: "Over a year ago ICANN moved to clean up misbehaving registrars like GoDaddy..." (2009-07-22)

Another quote from that Slashdot story: "GoDaddy (and their reseller arm, Wild West Domains) have a different problem: They still block transfers for 60 days after a registrant's contact update, even after the ICANN update specifically prohibited doing so."

Re:Another story, partly about GoDaddy. Chilling.

[shentino]

Sounds like a breach of contract between Godaddy and whoever gave them their "regisrar license", yes?

Or is it Verisign's job to police godaddy?

Re:Another story, partly about GoDaddy. Chilling.

[interval1066]

Sounds like business as usual to me. I've written about this on /. before; I've had personal dealings with people associated with GoDaddy and a few of their own employees. Jay Westerdahl (google the jerk) runs (ran?) a company that was very tight with GoDaddy. I never got a very warm feeling from the man and heard interesting thing from his associates about the people who run GoDaddy. All I can do is makes accusations; but if you ever find yourself looking for work or isp partnerships in Seattle don't do them with GoDaddy or Name Intelligence. Not even sure NI is still in business. What I can say about Westerdahl is he started domaintools.com in his garage or something and hit it big with a website giving its subscribers access to tools commonly available on any unix system. Can't argue with success, but then to work the kid, he makes you feel every inch of his economic superiority over you. Of course, if your a possible business partner, he will ask you if he can s*** your d***. And Ray King (aboutus.com); idiot.

Re:Another story, partly about GoDaddy. Chilling.

[Anonymous Coward]

Another quote from that Slashdot story: "GoDaddy (and their reseller arm, Wild West Domains) have a different problem: They still block transfers for 60 days after a registrant's contact update, even after the ICANN update specifically prohibited doing so."

It gets worse. GoDaddy forces an update of 'invalid' contact details (which may have been inherited from a previous transfer) when trying to change an admin address (to transfer the domain out). GoDaddy then forces you to agree to a 60 day transfer hold via a checkbox because the said details were changed. Online support refuses to change just the admin email. This isn't just against the ICANN rules, this is thuggery.

Actually a good idea

[DoofusOfDeath]

Heck, if their sysadmins are definitely like the chicks in the commercials, I'd definitely give them my "root".

Always seperate hosting, dns, and registeration

[cenc]

As someone that has been around the block with running a lot of web sites (well, a couple thousand at least) for say the last 10 years, I have learned the hard way to not put all your eggs in one basket. Registries come and go, even the big boys (at least service comes and goes, policies change), hosting providers can go bad for all kinds of reasons, and your DNS services are your keys to the castle in terms of just how much damage an outage can do to a buisness (backup DNS severs people).

Re:Always seperate hosting, dns, and registeration

[socsoc]

Not only should you have backups of DNS servers, you should have redundant ones from multiple providers. For example, slave ns1 at provider a, slave ns2 at provider b, master hidden somewhere else...

Re:Always seperate hosting, dns, and registeration

[cenc]

Totally agree. There are plenty of affordable backup dns services like dnsmadeeasy.com, that will give you global dns backup coverage for very little money and still allow you to maintain ns6.mydomain.com type servers.

I don't think a lot of people with just a couple sites realize that if you can keep dns up, even really cheap hosting going up and down will keep those outages from doing real damage such as with mail not arriving. servers will keep trying normally for a long time as long as the DNS resolves. That is aside from being able to reach your host to be able to work on it in an emergency.

A lot of cheap hosting packages provide dns servers in their reseller package, but not many people really appreciate what a bad idea it is to have your only dns server on the same machine.

Re:Always seperate hosting, dns, and registeration

[Anonymous Coward]

And Backup DNS means real backup! That means different box on a different network in a different part of the country/world. THere are too many people and hosting providers that setup their DNS on one or two servers that are next to each other. Heck, sometimes people put 2 IPs on one box and then say it is 2 servers!!

Story about GoDaddy being spammer-friendly

[Futurepower(R)]

Quote from the Slashdot story, KnujOn Updates Top 10 Spam-Friendly Registrars List: "Network Solutions and GoDaddy sister company Wild West domains - have popped up on the [spammer-friendly] list." (2009-02-06)

Quality, baby

[oldhack]

Say what you will about Godaddy, but they put out quality commercials.

So? Don't give it to them.

[Hurricane78]

Make a backup of your server, and then tell them that they won’t get it.

If they switch off your server, sue them for extortion, trespassing (in case they entered the server) and damages. [Same rules as with a (business) apartment and a landlord.]

But I personally already had hosters asking me for the root password. I refused. That was it. They did not do anything. (We still had a contract, after all.) Of course they told me that they wouldn’t give me support for the software. But I wouldn’t have wanted that anyway, since on the last managed server, they wrecked my database when one of their idiot admins did “fix” something.

I don’t see the problem. Let them bitch. Tell them to fuck off or you’ll sue. Done.

Imperva FAILS

[Anonymous Coward]

Don't they use Imperva for security. I guess it's a testament of how Imperva is a bad choice.

Virus or Malware on Securi blog link!?!?

[Anonymous Coward]

Has anyone else noticed that the Securi blog sets off a malware alarm when attempting to access the main site?!?! I'm currently using Avast!

If they want my root password

[eagl]

all they need to do is send Danica over to ask for it.

Re:If they want my root password

[Anonymous Coward]

i'd root her box.

Pfft.

[drunkennewfiemidget]

GoDaddy: We spend all our money on shitty Superbowl commercials, and our customers get screwed.

GoDaddy is a joke. Why they still have any customers is beyond me.

well..

[Anonymous Coward]

I don't know if this proves anything, but I just went to GoDaddy and searched for the domain "godaddysucksdonkeycock.com" and was told to "please select a different domain name to search on". What does that mean, exactly?

An AC's Battle Cry

[Anonymous Coward]

GoDaddy can have my root password when they pry it out of my warm, fapping hand!!

Ewww. I think I just grossed myself out.

I think you read that post wrong.

[Anonymous Coward]

He was actually saying something good about Microsoft, and that they are worth every $1 to their name for assuring that your computer will always be safe from password loss.

The FUD is strong in you, JetAye.

As trustworthy as a Bernie Madoff

[pushf popf]

This is quite an understatement. I do occasional web development on the side, and I recently had my first client in a while. I told her to go ahead and sign up for the domain with GoDaddy, but she said she couldn't figure out what to do. So I helped her out in person and I couldn't *believe* the amount of crap they try to push on you. Pages full of options and "upgrades" and packages on every step ... even after you finish your purchase! It's a tremendously confusing experience for someone who doesn't know how to filter out the signal from the noise. That's why I use ChangeIP.com for domain registrations.

You pick the name, give them a credit card, press the button and get on with your life. They won't hijack it, hold it hostage, try to sell you anything (except DDNS if you want it). You pay, they register. As it should be.

I now have three (count'em 3) clients that have lost their domains to GoDaddy. However, for only $400 or so, GoDaddy will sell you back your own domain.

I wouldn't use GoDaddy if my ass was on fire and they had free water.

Re:As trustworthy as a Bernie Madoff

[soupforare]

ChangeIP.com

I've been a user for years, even donated a few bucks here and there to make up for my use of the free services. Great company, crazy fast service, easy to use website.

Re:As trustworthy as a Bernie Madoff

[drharris]

Not so sure about that "easy to use website" part.. Your enthusiasm piqued my interest, but when I find a bug in their "Utilities" within 30 seconds of browsing their site, it doesn't speak well for their services. "Response object error 'ASP 0156 : 80004005' Header Error /inc/AccessControl.asp, line 237 The HTTP headers are already written to the client browser. Any HTTP header modifications must be made before writing page content."

Sound like a GNU/Mormon-Jew to me.

[Anonymous Coward]

Whatever they don't like, they overcompete against it.
The same moral values they disapprove, they are the sole monopolists in that practice.
The cause disputes to hurt theirselves, to justify sweeping policy changes that never were involved in the first place.

By far, they must be the greatest religion the world has ever known.

Well, seems a reasonable misunderstanding.

[mindstrm]

Godaddy already had the root password, presumably from when you set the VPS up.

- We have no way of knowing that they store these in cleartext that I can see, unless I missed something.

The abnormal (not wrong, just not what most people do) setup with the honeypot allowed their security scanner to think it had logged into your box successfully using a brute-force method.

They then found they could not *actively* log in with the password on file, because they were hitting a honeypot, not the real SSH port.

They followed up with an email to what they thought was an infected box.

So - glad they are changing policy - but even more glad they are at least pro-active about it. For every securiyt-conscious admin such as indicated here, there are tons and tons of VPS out there without even minimal security practices.

Basically, it looks like a process mismatch between the expectations of godaddy and the guy managing the server..... nothing that you can't work out, and you get what you pay for.

Security?

[trapnest]

I am glad I don't have any services with godaddy, I don't want any of my passwords stored in a easily retrievable manner, much less a company as easy to social as godaddy.

true story

[Anonymous Coward]

GoDaddy called me on my cell to sell me some unnecessary bullshit, as is their business model. Well it was a woman who called me. So after I refused their bullshit offering she asked if I had any more questions.

"Yeah, how do you feel about working for someone that objectifies women in their advertising?"

Silence, then pissiness ensued. Whatever, She knows I am right.

Don't call my cell and pitch me shit that's a waste of my time.

The truth is both funny and sad, a story of fakery

[Futurepower(R)]

"Another dumb freetard."

Another comment from someone who didn't bother to read the article or understand the issue.

Here's a quote from the Microsoft press release: "Upon completion of the migration, Go Daddy® will have moved all its parked domains from Linux to the Windows platform."

A "parked domain" is one with no real content, but just one small static web page that says something like "coming soon". The implication is that Microsoft Windows servers are fully capable of serving parked domains.

At the time, March 21, 2006, the story was that the Microsoft marketing department got GoDaddy to make the change by offering a lucrative deal. Why would Microsoft do that? This April 7, 2006 story explains: Microsoft Server gains 4.7% market share of hosted domains.

A parked domain, even though it is never visited except by accident, is a "hosted domain". Now it was possible for Microsoft sales people to talk about how Microsoft Windows server software was rapidly gaining market share. That would be entirely misleading, however.

Note that the press release misspelled GoDaddy as "Go Daddy", even though it was spelled correctly a few words earlier. That gives a picture of the level of competence involved at Microsoft's P.R. agency, Waggener Edstrom.

You may find it interesting that Pam Edstrom's daughter Jennifer and a former Microsoft manager wrote the book, Barbarians Led by Bill Gates. (August 15, 1998, eight years earlier) The Amazon.com review says the book "... presents a harsher and messier history, sharply questioning Microsoft's ethics and corporate wisdom..." The book seems authoritative; the authors certainly had inside access to the facts. It's certainly unusual that the daughter of one of the heads of Microsoft's P.R. agency would write a book discussing Microsoft's abusiveness in detail.

Give me your root password

[Anonymous Coward]

Or will Daddy have to spank you?

Horrible company

[Anonymous Coward]

GoDaddy is absolutely the worst Internet company I have ever dealt with. Before I was through with them they "fined" me $199 for alleged spamming (posting some links in a chat room of all things), they threatened to hold all of my domains hostage until I paid. I highly recommend anyone with GoDaddy leave now, before the same happens to you.

http://nodaddy.com/

Oh! So you're one of the anonymous COWARDS...

[viraltus]

That talk rubish in an anonymous cowardly fashion so that you never get moded down, you know, I'd rather freely express my opinions and be moded down than behave like a coward like you do.

Just in case it was you (Oh! Surprise) that moded me down this time with OFFTOPIC, just let you know, dear coward, that I just made a joke about GoDaddy so, it might be funny, it might be not, but funny or not is not OFFTOPIC.

Just in case you don't know, there is no mod down for "I disagree" or "I don't like you" and NO, OFFTOPIC is not a substitute.

And about the censorship and post history, obviously you didn't look a it. afther I made this post:

http://slashdot.org/comments.pl?sid=1522590&cid=30888708

my next post got moded UP 1 point and, all in a sudden, my Karma went from positive to BAD for NO reason.

So keep doing you ANONYMOUS COWARD things, you will never EVER get moded down.

Re:Oh! So you're one of the anonymous COWARDS...

[Anonymous Coward]

So you gladly participate in broken system despite having actually been bitten by its brokenness and then bash AC's for not doing so.

Re:Oh! So you're one of the anonymous COWARDS...

[viraltus]

My coward friend, I sent a non coward complain to /. about the issue but to no avail, and I bash cowards for being so.

I participate in the system, despite its possible censorship event, because I can still place a NON coward protest in my signature... Otherwise the only choice left would be doing like you; sending anonymous cowardly posts to avoid being mod down. So enjoy your great Karma, you'd do great in politics.

Re:Oh! So you're one of the anonymous COWARDS...

[Anonymous Coward]

Great karma? Funny. For some reason, your post starts at 1 while mine is at 0.

But you know, this site has certain groupthink going on and the karma thingy doesn't exactly help being independent of it. I don't post as an AC to avoid being modded down. I do it to avoid avoiding that.

Re:Oh! So you're one of the anonymous COWARDS...

[viraltus]

To avoid avoiding to be modded down!? hahaha... OK, fair enough, I was assuming you had an account and that you would only go coward to avoid the mods.

But I use an account because I don't give a fuck about people moding me down just because they don't like my opinion or they disagree with it, having an account also makes some debates/flames less confusing and I get notifications of answers, besides it forces me to either hold my words, or apologize for them, giving me a sense of reponsability on what I say that I would otherwise avoid going coward, but I have problems with:

1- when for some misterious reason my Karma goes to ZERO without negative mods; it is either a bug or censorship.
2- when you get limited post right with bad Karma; it forced me to go coward and I hate it.

But hey, if you don't have an account and AC is the way you like it, respect and peace!

Alternatives to Godaddy?

[Anonymous Coward]

Clearly Godaddy are not a company anyone should not need to deal with. I currently have several domains hosted there and wish to move them (including a paid-for email service for one of them).

What other domain registrars would be recommended? I am after one who I will be able to trust, and I'm willing to pay a bit more for this.

Marketing

[mu51c10rd]

to confuse non-technical people by offering services they don't need and presenting them as valuable.

Congratulations, you just described Marketing's purpose in life...

Newbie!

[chord.wav]

That's why if you are serious about your data you should run your own server on your own rack on your own hosting company connected with your own pipes; Use your own DNSs servers, your own CA and of course your TLD.

There are so many good reasons to stay away from G

[flycast]

Enough said...

Siteground

[Moe1975]

I have had my share of BS from godaddy, and that is why I stopped referring my web dev clients to them. I now send all my clients to siteground. They absolutely rock. Their tech support people are highly competent, quick, and polite . . . they are actual geeks, not fucktard sales dept rejects that have been put through some bs support course for mental defectives, like gocrappy.

I can't say enough good things about them, sorry if this sounds like an ad, but, they truly rock.

MOE

Put this service in perspective

[twelveinchbrain]

A GoDaddy Virtual Dedicated Server is *not* the property of the party who purchases the service, it is the property of GoDaddy. Read the product literature and the service agreement, and you will find that at no point are you granted the right to take sole control of the root account. This would be like insisting on changing the lock on an apartment so that only you have access to it. The strongest promise they make is that you will have administrative access so that you can install whatever you want.

GoDaddy did nothing wrong, but it's good that they put the best possible face on it.

Is that the same Bob Parsons who used to own...

[grikdog]

Parsons Technology, the company that peddled income tax and DIY wills a few years ago?

They want your collection

[HTH NE1]

We have been collecting some of the tools/scripts used on web attacks for our research.

You publicly stated you had malware. That either got misinterpreted along the line as being infected by or hosting malware (thus the threat of disconnection), or someone inside GodAddy was using it as an excuse to get a copy of your collection of malware, maybe to protect themselves from it or learn to develop more under cover of being proactive on security matters.

Feigned stupidity can be a cover for actual malice.

Is NFL management "radical feminist"?

[Futurepower(R)]

"... radical feminist rant."

There is a lot more to the stories of the head of GoDaddy supporting violence and being involved with models. I just didn't have the time to add to what I already wrote.

For example: GoDaddy Super Bowl Ad Pulled After One Run. Quote: "The decision was prompted by NFL officials complaining to Fox..."

The image of the NFL being radical feminist makes me laugh.

More of the GoDaddy story.

[Futurepower(R)]

See this story: Why I Don't Owe GoDaddy $6,579.51 (or $969).

VPSs and root access

[jcam2]

On a VPS, it really doesn't matter if the hosting company has your root password or not - they can directly access the filesystem to view or modify any files any time they want.

For some virtualization types (like Xen and KVM) it is more convenient for the host to know the root password so they can login to manage the VPS. Without it, filesystem access requires that the VPS be shut down, with is worse for everyone.

For other types like OpenVZ, the host can login as root any time they want, without even knowing the password.

In the case of GoDaddy, they would probably be better off setting up VPSs they sell with an additional root-equivalent account or using SSH keys - that way the customer can keep their root password secret.

Ding ding oing ding ding ping ding ding ding ding!

[Anonymous Coward]

That was *HOT*!!!

Bob Parsons just bought Cher's house

[RogueWarrior65]

Great. This from the guy who just spent several million dollars buying Cher's house in Hawaii. The guy has a private jet. How the hell does a web hosting company pull that off?