GoDaddy is Injecting Site-Breaking JavaScript Into Customer Websites

Web hosting service GoDaddy is injecting JavaScript into customer websites that could impact the overall performance of the website or even render it inoperable, according to Australian programmer Igor Kromin. From a report: GoDaddy's analytics system is based on W3C Navigation Timing, but the company's practice of unilaterally opting in paying customers to an analytics service -- tracking the visitors to websites hosted on GoDaddy services -- without forewarning is deserving of criticism. GoDaddy claims the technology, which it calls "Real User Metrics" (RUM), "[allows] us to identify internal bottlenecks and optimization opportunities by inserting a small snippet of javascript code into customer websites," that will "measure and track the performance of your website, and collects information such as connection time and page load time," adding that the script does not collect user information. The script name "Real User Metrics" is somewhat at odds with that claim; likewise, GoDaddy provides no definition of "user information."

GoDaddy claims "most customers won't experience issues when opted-in to RUM, but the JavaScript used may cause issues including slower site performance, or a broken/inoperable website," particularly for users of Accelerated Mobile Pages (AMP), and websites with pages containing multiple ending tags.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:

[Oh really now]

I've already done that, back on one of the other times they pulled some nonsense that was a big middle finger extended towards the customer base.

Re:

[Anonymous Coward]

I moved all of mine from GoDaddy to here... https://www.secureserver.net/?prog_id=2rosenthals&isc=wwbb1902&utm_source=plocp&utm_medium=email&utm_campaign=en-US_x_email_base_pl&utm_content=180602_1902_x_x_x_x_wwbb1902_5FPCIY2iu4ridD8S08hFBn

Nathan

Re:

[zekica]

I would suggest a great alternative I used for 8 years, but they got bought by GoDaddy :(

Re:

[demon driver]

So did HostEurope, which used to be a good address, too...

Re:

[fermion]

It was time five years ago. Godaddy has value if you need free and your time it worth nothing. I move to namecheap a long time ago, when I forgot to renew my domain name and godaddy held it hostage.

I pay these people to register my domain names, and I pay s fair amount. I know it is hard to make a profit, but really what do they actually do that costs so much? I don't need someone trying to monetize me when I am already paying them.

Re:Well then...

[bobbied]

... might be time to move all my domains to another company.

My friend who was a GoDaddy customer for over a decade did just that a month ago. Mainly because they kept black holing his domains because of THEIR code change.

He ran a business, and the website going down was a BAD thing for him. After nearly a decade of running on this hosting service, having not made any changes to his website for over 3 months all of a sudden GoDaddy TOSed him for excessive CPU usage, "No you may not access any of your data thank you". A day on the phone later, they restore him after he pleads with their customer support and appeals to his long record of service. He decides to make a backup of everything now, bad call, he gets TOSed again the next day, this time they won't restore him.

He got to looking at his backups and notices that what happened was GoDaddy CHANGED their backup processes and modified his system by applying patches. Anytime he ran backups, the CPU usage would spike. So, because he had subscribed to GoDaddy's backup service AND then dared to actually run a backup manually the bug they installed caused them to TOS him.

He's not on GoDaddy now, after decades of trouble free service. Their loss..

Re:

[greenwow]

You might can avoid them, but Comcast's Javascript that broke our web site is pretty much unavoidable.

Re:

[hcs_$reboot]

To where? register.com? </joke>

Re: Well then...

[Anonymous Coward]

Be careful if you need to update your contact info first... They will bar domain transfers for 6months after a contact update.

Re:

[geoscodin]

I used NoMonthlyFees.com (as hokey as it sounds) for years until HostingCheck.com bought them several years back, and I still happily use them today.

Not Surprising

[thechemic]

When you choose to host with a company like GoDaddy, why would expect anything less?

Re: Not Surprising

[Anonymous Coward]

The colloquial is NoDaddy
Obligatory pun
Also the company literally has nothing to offer except bad customer service

Re:

[hcs_$reboot]

The thing is, many people chose GD a long time ago, then just extend.

Yet another reason ...

[Anonymous Coward]

This is yet another reason why I block javascript in my browser.

I pretty much hit a page, check the parasites, block any new ones I've not yet blocked ... and then reload and do it again.

I consider pretty much all third party stuff, especially javsascript, as unwanted parasites ... they exist to track me and sell my data, and they can't do any of that when I block their domains from my browser.

Your domain registrar has no fucking business knowing who I am.

And eventually marketing says "hey, if we can do that, why can't we insert our own ads?".

Of course, in a sane legal environment, modifying someone's copyrighted web page in transit for your own purposes would be illegal. I view it the same as wiretapping.

Re:

[Anonymous Coward]

I'd like to inject some javascript code into my banks webpage

Still think it's a good idea?

Re:Yet another reason ...

[thechemic]

I agree with the act, though the method you're using (black-listing) seems a bit backward. It would be more secure and a lot less laborious to block all javascript, and then white-list the URLs/Domains that you trust (bank, etc.).

Re:

[thegarbz]

Sure, but I prefer to use the internet and not micromanage it.

Re:

[Anonymous Coward]

Not EULA but TOS:

You hereby grant GoDaddy a worldwide, non-exclusive, royalty-free, sublicensable (through multiple tiers), and transferable license to use, reproduce, distribute, prepare derivative works of, combine with other works, display, and perform your User Content in connection with this Site, the Services and GoDaddy’s (and GoDaddy’s affiliates’) business(es), including without limitation for promoting and redistributing all or part of this Site in any media formats and through a

Re:

[Errol backfiring]

If a someone wilfully asks an advertising company to do a cross-site scripting attack on his site, he should not complain that it has consequences. Come on, what do you expect?

I was wondering why my website on GoDaddy was slow

[ITRambo]

Damn them. No company should inject code into any website that customer actually pay for. If they want to host for free, that's another story. And yeah. My website is a lot slower than it was. I thought it was my ISP, but the speeds are in spec. Transferring a complex website is a real time consuming PITA. I'll do it anyway, if they break my site.

Re:

[mick232]

The term RUM is a pretty standard term in the application performance monitoring industry. And yes, it refers to the fact that performance data of real users is collected instead of synthetic tests.

Re:

[mick232]

RUM typically collects page URI, page load time, IP address, geo location, user agent, various other metrics of page performance, and others. RUM products I know are not designed to spy on the users but to show page performance including long term historical trends. Thus, the data is usually heavily aggregated as the amount of storage space to keep individual records would grow very quickly and is not what RUM users are interested in.

All for it

[SuperKendall]

At first I was against it, but after reading that it breaks AMP I say - Bravo, sir. Bravo.

Fuck godaddy

[damn_registrars]

Fuck them sidways, upside down, and backwards. I started managing a website for a local nonprofit a while ago that was setup through godaddy (prior to my helping them) and it's been a disaster. A few weeks ago the website suddenly became only sporadically responsive, and only for certain types of connections. A lot of users (including me from some locations) were getting nothing when trying to connect (no 404, no error, just a blank page with no source).

I then spent 2 hours in their "support chat" where I was bumped through three different support people. They tried to blame the problem on me and made me jump through a bunch of arbitrary hoops to prove them wrong. Then they said it was due to "website plugins" and left it to me to figure out what plugins needed attention (even though all the plugins run through their fucking servers).

Then after that, they disconnected me; their chat system leaving me no transcript of the support session.

This is appalling. We're ready to move our domain and site elsewhere.

New Relic?

[Configio]

I wouldn't be surprised if they were just using New Relic APM for this purpose. If so, they are probably doing this just for the purpose they stated. Perhaps they still should have made it opt-in, but there's a reasonable chance nothing nefarious was intended.

Not surprised at all...

[kurkosdr]

GoDaddy acts as if they own their customers' websites and as if their customers are mere "content providers" for the sites GoDaddy "owns". For example, they will register the domain that a customer chose to themselves, and if they think the customer breached their TOS for whatever reason they will take over the domain and fill it with ads. Avoid GoDaddy if you can. And that's a big "if", since GoDaddy aggressively hoards (parks) domains which they never relinquish even if you "register" the domain with them (I put "register" in quotes because you are not really registering any domain to your name).

I had used GoDaddy for a while...

[QuietLagoon]

... but I left them because of the types of business practices I saw.

Re:

[Pascoea]

It's like you WANT to get shafted just to save that $4 per year for your domain or whatever you're buying.

Personal experience, they are more expensive for .com addresses. I used them to register the domains (self hosted) but just moved my last one away from them at renewal time. I use porkbun, and so far no issues, and 4-5$ cheaper.

Opt-Out

[Anonymous Coward]

Just verified that the instructions in the article work. My site is now opted out. IT SHOULD NEVER HAVE BEEN OPTED IN !!!

Looking for a new hosting service.

Fuck you GoDADDY

Interesting tidbit

[Anonymous Coward]

Post as AC for reasons. None of the employees at GoDaddy host there. When they finally got around to offering employee discounts it wasn't enough to tempt anyone to move off their existing hosts. When the people who run the stuff won't use it then it's a big clue that the product isn't the best.