Slashdot Mirror
GoDaddy is Injecting Site-Breaking JavaScript Into Customer Websites (techrepublic.com)
Web hosting service GoDaddy is injecting JavaScript into customer websites that could impact the overall performance of the website or even render it inoperable, according to Australian programmer Igor Kromin. From a report: GoDaddy's analytics system is based on W3C Navigation Timing, but the company's practice of unilaterally opting in paying customers to an analytics service -- tracking the visitors to websites hosted on GoDaddy services -- without forewarning is deserving of criticism. GoDaddy claims the technology, which it calls "Real User Metrics" (RUM), "[allows] us to identify internal bottlenecks and optimization opportunities by inserting a small snippet of javascript code into customer websites," that will "measure and track the performance of your website, and collects information such as connection time and page load time," adding that the script does not collect user information. The script name "Real User Metrics" is somewhat at odds with that claim; likewise, GoDaddy provides no definition of "user information."
GoDaddy claims "most customers won't experience issues when opted-in to RUM, but the JavaScript used may cause issues including slower site performance, or a broken/inoperable website," particularly for users of Accelerated Mobile Pages (AMP), and websites with pages containing multiple ending tags.
GoDaddy claims "most customers won't experience issues when opted-in to RUM, but the JavaScript used may cause issues including slower site performance, or a broken/inoperable website," particularly for users of Accelerated Mobile Pages (AMP), and websites with pages containing multiple ending tags.
... might be time to move all my domains to another company.
When you choose to host with a company like GoDaddy, why would expect anything less?
Let's make like a bird... and get the flock outta here.
This is yet another reason why I block javascript in my browser.
I pretty much hit a page, check the parasites, block any new ones I've not yet blocked ... and then reload and do it again.
I consider pretty much all third party stuff, especially javsascript, as unwanted parasites ... they exist to track me and sell my data, and they can't do any of that when I block their domains from my browser.
Your domain registrar has no fucking business knowing who I am.
And eventually marketing says "hey, if we can do that, why can't we insert our own ads?".
Of course, in a sane legal environment, modifying someone's copyrighted web page in transit for your own purposes would be illegal. I view it the same as wiretapping.
Their hosting is abysmal. Go anywhere else.
If breaking a customer's website without their consent or notification this is grounds for some action. What a bunch of stupid assholes.
Damn them. No company should inject code into any website that customer actually pay for. If they want to host for free, that's another story. And yeah. My website is a lot slower than it was. I thought it was my ISP, but the speeds are in spec. Transferring a complex website is a real time consuming PITA. I'll do it anyway, if they break my site.
While I don't agree with the idea. (what if they start injecting code into my scripted pages that are actually outputting JSON instead of HTML?), their "Real User Metrics" name makes sense, and I feel like it can apply even without gathering "user information". I think the part to focus on here is "real user", meaning that they're gathering information on how pages load for "real users", rather than their own internal testing.
Could this be considered a cross site scripting attack, and is there any legal recourse?
At first I was against it, but after reading that it breaks AMP I say - Bravo, sir. Bravo.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Yes there is if you want to literally pollute your day spending more time with GoDaddy, which I do not.
Fuck them sidways, upside down, and backwards. I started managing a website for a local nonprofit a while ago that was setup through godaddy (prior to my helping them) and it's been a disaster. A few weeks ago the website suddenly became only sporadically responsive, and only for certain types of connections. A lot of users (including me from some locations) were getting nothing when trying to connect (no 404, no error, just a blank page with no source).
I then spent 2 hours in their "support chat" where I was bumped through three different support people. They tried to blame the problem on me and made me jump through a bunch of arbitrary hoops to prove them wrong. Then they said it was due to "website plugins" and left it to me to figure out what plugins needed attention (even though all the plugins run through their fucking servers).
Then after that, they disconnected me; their chat system leaving me no transcript of the support session.
This is appalling. We're ready to move our domain and site elsewhere.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
I wouldn't be surprised if they were just using New Relic APM for this purpose. If so, they are probably doing this just for the purpose they stated. Perhaps they still should have made it opt-in, but there's a reasonable chance nothing nefarious was intended.
you are 10 years behind the curve. tell me it's not the low uid?
GoDaddy acts as if they own their customers' websites and as if their customers are mere "content providers" for the sites GoDaddy "owns". For example, they will register the domain that a customer chose to themselves, and if they think the customer breached their TOS for whatever reason they will take over the domain and fill it with ads. Avoid GoDaddy if you can. And that's a big "if", since GoDaddy aggressively hoards (parks) domains which they never relinquish even if you "register" the domain with them (I put "register" in quotes because you are not really registering any domain to your name).
You put up with their abuse for so long, I have no sympathy for people who get cucked by them.
... but I left them because of the types of business practices I saw.
they're like the Monsanto, or Microsoft, or today's Apple, of the Internet and cloud service providers. It's like you WANT to get shafted just to save that $4 per year for your domain or whatever you're buying.
I was going to write the same post. Thank goodness I moved to 1and1 (ha!)
First there was Flash, now we have Java Script.
Until there is serious prison time and criminal bankruptcy for CEO's and other management, personal information will continue to be gathered, sorted, sold with no regard to the consequences.
Shut up, APK. We know you're the individual responsible for stalking SuperKendall and Ray Morris.
Just verified that the instructions in the article work. My site is now opted out. IT SHOULD NEVER HAVE BEEN OPTED IN !!!
Looking for a new hosting service.
Fuck you GoDADDY
You pretend to be Ray Morris' friend, then accuse him of being a Nazi. You've been stalking SuperKendall for months. Everyone knows you're responsible, no matter how many feeble denials you post. You're also in denial about your heroin addiction, which you projected onto a different AC last night.
See subject: ONLY that I respect he applied himself for the "general good" (start of self-actualization). I don't do heroin https://science.slashdot.org/c... as I told you there also (but I BET you do - "your kind", weezils & WHIMPS have to TRY "drown your sorrows" @ being HUMAN FAILS, lol - pitiful).
For Pete's sake: I'm a FORMER NCAA 1st string athlete & decently accomplished guy - unlike you - I have ZERO REASONS to escape in HEROIN (like you, obviously, since you're FIXATED on that).
* You project your OWN FAULTS onto ME & you constantly FAIL (it's all "your kind", the not-men DEFECTIVES (per gweihir which made me LMAO as it's truth he sees about you too) "ne'er-do-well" LAZY do-NOTHINGS like you can do (you're GOOD @ 1 thing though - take heart - you are EXCELLENT @ FAILING, lol)).
HOWEVER: I'd MUCH RATHER be friends w/ a guy like raymorris than a LOSER like you, lol... weezil that HIDES behind UNIDENTIFIABLE anonymous posts STALKING me as you do.
APK
P.S.=> Hahahahahaha (I love it - I couldn't have SAID it better)... apk
Post as AC for reasons. None of the employees at GoDaddy host there. When they finally got around to offering employee discounts it wasn't enough to tempt anyone to move off their existing hosts. When the people who run the stuff won't use it then it's a big clue that the product isn't the best.
...like OVH or DigitalOcean. Then you have complete control over every aspect of the website, including what web server technology you choose to run, and no one will inject their grimy little fingers into the code on the pages of the website.
amicusNYCL you'd LIKE it to look that way but I don't bug either of them (especially raymorris whom I respect as he does things of value ala a kernelpatch which is MORE than MOST here have managed) so I'll tell you EXACTLY what I did before here https://science.slashdot.org/c... when you tried to "frame me" like the LOSER you are & I point out how BADLY I made you EAT YOUR WORDS before too, CHUMP: I DIDN'T POST THAT CRAP! In fact, I get YOU did trying to 'frame me' like the PUSSY you are playing BITCH games (which is all a BITCH knows HOW to do).
* Hahahahaha - too easy!
ESPECIALLY SEEING YOU HAVE TO EFFETELY TRY "downmod hide" THIS POST last time I posted it here https://tech.slashdot.org/comm... - "I see you" & RIGHT thru you (knowing YOU better than you know YOUR wasted life SELF), lol - your favorite color HAS to be "TRANSPARENT", right? Has to be, lol!
APK
P.S.=> amicusNYCL you're SUCH a pussy - go live in your Arizona DESERT punk - nobody wants YOU around & it's WHY you live in the wasteland (because you ARE a WASTE of LIFE, & you not only KNOW it, but your STUPIDITY proves it along w/ being nothing MORE than a CHATTERING twat you are, building nothing of VALUE (but I do w/ proof https://hardware.slashdot.org/... & WEEZILS like you? Don't - all you DO is play BITCH GAMES & try to 'start rumors' like some TWISTED weak HOMO would do, lol!))... apk
GoDaddy didn't invent "RUM" very misleading and WAY overblown. Shows the poster is clueless which makes the whole thing suspicious.
Everytime I hear that name, an image of a pimp, complete with large hat with leopard print band and a big feather always comes to mind. Sometimes the image inclides a couple of his hoes, well beaten into compliance.
"Who's your daddy? I'm your Daddy, bitch."
#GoDouchey
I deliberately let a domain lapse. They replaced the anonymized contact information with my personal details and didn't remove the domain.
I complained to them, nothing back. I complained to ICANN, got a response back within a couple of hours.
My name disappeared and GD rudely told me I had registered an invalid complaint and closed the ticket.