GoDaddy SUCKS. (and f*cks over nmap)

[DLSS]

GoDaddy SUCKS.

MySpace demanded that GoDaddy pull the plug on Seclists.org, which hosts some 250,000 pages of mailing list archives and other resources, because a list of thousands of MySpace usernames and passwords was archived on the site. GoDaddy claims its customers own about 18 million domains.

GoDaddy complied. In a move that Seclists.org owner Fyodor Vaskovich said happened with no prior notice, the company deleted his domain name–causing his site to be effectively unreachable for about seven hours on Wednesday until he found out what was happening and removed the password list.

“They didn’t tell me why they removed the site,†Vaskovich, creator of the popular Nmap security auditing utility, said in a phone interview. “At a very minimum, we should get warning.â€

Vaskovich said he spent “hours and hours†on the phone with GoDaddy on Wednesday before he finally got through to someone who was willing to listen. As a result of this experience, he said in an e-mail announcement, “I’m in the market for a new registrar. One who doesn’t immediately bend over for any large corporation who asks.â€

GoDaddy pulls security site after MySpace complaints

A popular computer security Web site was abruptly yanked offline this week by MySpace.com and GoDaddy, the world's largest domain name registrar, raising questions about free speech and Internet governance.

MySpace demanded that GoDaddy pull the plug on Seclists.org, which hosts some 250,000 pages of mailing list archives and other resources, because a list of thousands of MySpace usernames and passwords was archived on the site. GoDaddy claims its customers own about 18 million domains.

GoDaddy complied. In a move that Seclists.org owner Fyodor Vaskovich said happened with no prior notice, the company deleted his domain name--causing his site to be effectively unreachable for about seven hours on Wednesday until he found out what was happening and removed the password list.

"They didn't tell me why they removed the site," Vaskovich, creator of the popular Nmap security auditing utility, said in a phone interview. "At a very minimum, we should get warning."

Vaskovich said he spent "hours and hours" on the phone with GoDaddy on Wednesday before he finally got through to someone who was willing to listen. As a result of this experience, he said in an e-mail announcement, "I'm in the market for a new registrar. One who doesn't immediately bend over for any large corporation who asks."

For her part, GoDaddy general counsel Christine Jones defended the abrupt deletion, saying: "We tried to contact the registrant, but they were not available at the time. To protect the MySpace users from potentially having private information revealed, we removed the site."

Jones pointed out that GoDaddy's terms of service say the company "reserves the right to terminate your access to the services at any time, without notice, for any reason whatsoever."

Jones and Vaskovich, however, tell substantially different versions of exactly what happened. Jones characterized the episode as lasting only about an hour, saying her abuse department unsuccessfully "tried to contact" Vaskovich and "he actually contacted us about an hour" later after the removal occurred.

But Vaskovich provided CNET News.com with a log of correspondence from GoDaddy that corroborates his version of the story. It indicated that only 52 seconds elapsed from an initial voice mail notification to the time the domain was marked as "suspended." GoDaddy did not immediately respond to follow-up questions.

Vaskovich says MySpace did not contact him directly. MySpace declined to respond to repeated inquiries on Thursday.

Michael Froomkin, a law professor at the University of Miami who has written about domain name regulation, says this is the first time he's heard of a registrar abruptly taking a customer offline without a court order.

"Some people might feel safer with a registrar that's a little more pro-customer," Froomkin said.

Froomkin said this week's incident raises novel free speech questions--not legal ones, as long as GoDaddy's terms of service are broad enough. Rather, he said, the issue is "the quality of their review" of complaints received from firms like MySpace.

GoDaddy's Jones said that "we're not knee-jerk--we try to be responsible about verifying complaints." There's a broad spectrum of policies among domain name registrars, she acknowledged, with GoDaddy "probably the most aggressive."

But, Jones said, GoDaddy has a 24-hour abuse department that deletes domain names used for spam or child pornography on a daily basis. "We're not here to allow people to put illegal content on the Internet," she said. "We take this safety and the security of the Internet very seriously...We take our responsibility pretty seriously. We're the largest registrar in the world."

When asked if GoDaddy would remove the registration for a news site like CNET News.com, if a reader posted illegal information in a discussion forum and editors could not be immediately reached over a holiday, Jones replied: "I don't know...It's a case-by-case basis."

the response :

Nmap Hackers: Seclists.Org shut down by Myspace and GoDaddy

Seclists.Org shut down by Myspace and GoDaddy

From: Fyodor <fyodor_at_insecure.org>

Date: Thu, 25 Jan 2007 01:47:47 -0800

Hi everyone,

Many of you reported that our SecLists.Org security mailing list

archive was down most of yesterday (Wed), and all you really need to

know is that we're back up and running! But I'm going into rant mode

anyway in case you care for the details.

I woke up yesterday morning to find a voice message from my domain

registrar (GoDaddy) saying they were suspending the domain

SecLists.org. One minute later I received an email saying that

SecLists.org has "been suspended for violation of the GoDaddy.com

Abuse Policy". And also "if the domain name(s) listed above are

private, your Domains By Proxy® account has also been suspended."

WTF??! Neither the email nor voicemail gave a phone number to reach

them at, nor did they feel it was worth the effort to explain what the

supposed violation was. They changed my domain nameserver to

"NS1.SUSPENDED-FOR.SPAM-AND-ABUSE.COM". Cute, eh?

I called GoDaddy several times, and all three support people I spoke

with (Craig, Ricky, then Wael) said that the abuse department doesn't

take calls. They said I had email abuse_at_godaddy.com (which I had

already done 3 times) and that I could then expect a response "within

1 or two business days". Given that tens of thousands of people use

SecLists.Org every day, I didn't take that well. When they realized I

was going to just keep calling until they did something, they finally

persuaded the abuse department to explain why they cut me off:

Myspace.Com asked them to.

Apparently Myspace is still reeling from all the news reports more

than a week ago about a list of 56,000 myspace usernames+passwords

making the rounds. It was all over the news, and reminded people of a

completely different list of 34,000 MySpace passwords which was

floating around last year. MySpace users fall for a LOT of phishing

scams. They are basically the new AOL. Anyway, everyone has this

latest password list now, and it was even posted (several times) to

the thousands of members of the fulldisclosure mailing list more than

a week ago. So it was archived by all the sites which archive

full-disclosure, including SecLists.Org.

Instead of simply writing me (or abuse_at_seclists.org) asking to have

the password list removed, MySpace decided to contact (only) GoDaddy

and try to have the whole site of 250,000 pages removed because they

don't like one of them. And GoDaddy cowardly and lazily decided to

simply shut down the site rather than actually investigating or giving

me a chance to contest or comply with the complaint. Needless to say,

I'm in the market for a new registrar. One who doesn't immediately

bend over for any large corporation who asks. One who considers it

their job just to refer people to the SecLists.Org nameserver at

205.217.153.50, not to police the content of the services hosted at

the domains. The GoDaddy ToS forbids hosting what they call "morally

objectionable activities".

It is way too late for MySpace to put the cat back in the bag anyway.

The bad guys already have the file, and anyone else who wants it need

only Google for "myspace1.txt.bz2" or "duckqueen1". Is MySpace going

to try and shut down Google next?

For some reason, this is only one of a spate of bogus Seclists removal

requests. I do remove material that is clearly illegal or

inappropriate for SecLists.org (like the bonehead who keeps posting

furry porn to fulldisclosure). But one company sent a legal threat

demanding[1] that I remove a 7-year old Bugtraq posting which was a

complaint about previous bogus legal threats they had sent. Another

guy[2] last week sent a complaint to my ISP saying that an image was

child porn and declaring that he would notify the FBI. When asked why

he thought the picture was of a child, he tried a different tack:

sending a DMCA complaint declaring under penalty of perjury that he is

the copyright holder of the photo! Michael Crook told me on the phone

that he sent the DMCA request, but when I forwarded the info to the

EFF (who is already suing this guy for sending other bogus DMCA

complaints), he changed his mind and wrote that "after further review,

I can find no record" or mailing the complaint.

Most of the censorship attempts are for the full-disclosure list. It

would be easiest just to cease archiving that list, but I do think it

serves an important purpose in keeping the industry honest. And many

good postings do make it through if you can filter out all the junk.

So I'm keeping it, no matter how "morally objectionable" GoDaddy and

MySpace may think it to be!

In much happier Nmap news, I'm pleased to report that the Nmap project

now has a public SVN server so you can always check out the latest

version. Due to a bug in SVN, we use a username as "guest" with no

password rather than anonymous. So check it out with the command:

svn co --username guest --password "" svn://svn.insecure.org/nmap

Then do the normal:

./configure

make

And install it or set NMAPDIR to "." to run in place. Among other

goodies, this release includes the Nmap scripting language[3].

If you want to follow Nmap development on a check-in by check-in

basis, there is a new nmap-svn mailing list[4] for that. But be

prepared for some high traffic as you'll get every patch!

2007 will be a good year for Nmap!

Cheers,

Fyodor

resources :

http://edge.i-hacked.com/godaddy-sucks

http://news.com.com/GoDaddy+pulls+security..._3-6153607.html

http://seclists.org/nmap-hackers/2007/0000.html

jeesh guys we all kno u support nmap , so why does hak5 still support godaddy ?

[Forgotten]

Total suck.

MySpace has no credibility, GoDaddy should always take that into account.

[SomeoneE1se]

So much for me using godaddy anymore, too bad I was about to pick up a new Domain too...

[anyedie]

So much for me using godaddy anymore, too bad I was about to pick up a new Domain too...

mml, me2, I was about a week away from getting my domain with them... guess not.