MySpace and GoDaddy Shut Down Security Site 344
Several readers wrote in with a CNET report that raises novel free-speech questions. MySpace asked GoDaddy to pull the plug on Seclists.org, a site run by Fyodor Vaskovich, the father of nmap. The site hosts a quarter million pages of mailing-list archives and the like. MySpace did not obtain a court order or, apparently, compose a DMCA takedown notice: it simply asked GoDaddy to remove a site that happened to archive a list of thousands of MySpace usernames and passwords, and GoDaddy complied. Fyodor says the takedown happened without prior notice. The site was unavailable for about seven hours until he found out what was happening and removed the offending posting. The CNET article concludes: "When asked if GoDaddy would remove the registration for a news site like CNET News.com, if a reader posted illegal information in a discussion forum and editors could not be immediately reached over a holiday, Jones replied: 'I don't know... It's a case-by-case basis.'"
Case-by-case basis... (Score:5, Insightful)
Re:Case-by-case basis... (Score:4, Interesting)
Re:Case-by-case basis... (Score:5, Insightful)
I'd suggest that everyone here who is disgusted with this action, especially those who have domains registered with GoDaddy, email GoDaddy public relations [mailto] and/or email their domain registration support [godaddy.com].
Just as an example, here is what I sent: Maybe if they get hit hard enough, somebody over there--maybe even ol' Bobby Parsons (does anyone know his email address?)--will figure out that companies can't pull this kind of crap anymore without repercussions.
Re:Case-by-case basis... (Score:5, Interesting)
PGA www.randomlogic.com
Re:Case-by-case basis... (Score:4, Interesting)
Re: The "Preventing Child Exploitation" Exuse (Score:3, Insightful)
When someone uses the "Won't somebody think of the children?" argument to justify his/her actions, check your freedom wallet; some of your rights may be missing.
It's time that those in power, whether governments or large corporations, stopped using this argument (along with the "If we don't curtail some of your rights, the terrorists have already won.") to just
Re: (Score:3, Informative)
Any reputable domain registrar will give you credit for all the remaining time on your current registration. You lose nothing by transferring.
Don't put it off. Do it today.
joker.com or any non-us registrar. (Score:5, Insightful)
For better searching (Score:3, Informative)
GoDaddy Response (Score:5, Interesting)
Re:GoDaddy Response (Score:4, Insightful)
Re:GoDaddy Response (Score:5, Insightful)
"Think of the children!"
Re:GoDaddy Response (Score:5, Insightful)
As we have said to our customers - Go Daddy is committed to keeping the Internet a safe place. If there is material online that is jeopardizing Internet safety, we will take necessary action. I
That's not your damn job! You are a registrar. If you take it upon yourself to police the contents of the sites in your registry, what happens when you get sud for failing to do so? Go do your job and stop trying to police things that are none of your business.
Re:GoDaddy Response (Score:4, Interesting)
2. That list of MySpace users is available at several full-disclosure lists. Taking down SecLists.org doesn't change anything.
3. Your customer has e-mail logs to prove his side of the story. Do you?
Re: (Score:3, Interesting)
in the name of child-abuse let us just simply suspend all rights and freedoms.
unless/until you get a properly legal document requesting a shutdown, JUST SAY NO.
and exactly what did you do to confirm the identity of whoever made the request?
how do you avoid denial-of-service attacks by the people making a take-down request
actually being the same ones who posted inappropriate things at a site?
eeeeesh.
there is no justifcation. period.
my own eight domains at godaddy will be tra
Re: (Score:3)
Thats godaddy.com maker of the sexist demeaning superbowl commercals? Durring the most watched game, you put on a terrible commercial every year that sends a terrable message to children. I think CBS should reject all of your commercials and Icann reject your status! You don't give a rats ass about "the children". If I had any domains there, I would move them as well. But, it appears I was too smart to use you in the first place. have a good time burning in hell.
You and Bob Parsons *work for me*, not MySpace (Score:3, Interesting)
Re:GoDaddy Response (Score:4, Insightful)
Please allow me to put this in a few words:
This is not your place.
It is the job of the police and courts to enforce the law, not you. It is the job of parents to protect their children, not you. You are a registrar. Your job is to ensure that your customers' sites are accessible. Your job is not to judge that site's content. If someone thinks the site should be shut down, that person or organization can go get a proper court order. Until that time, you and your company are out of line in even considering a request to take down a site unilaterally.
I have several domain name registrations coming up. I can assure you, those registrations will not be with your company, absent a public apology and an assurance that this will never happen again except upon a valid court order, and I will ensure that everyone I know who may register a domain is made well aware of this incident. Unless your position is quickly reversed, you stand to lose quite a bit of business.
Re: (Score:3, Insightful)
I'm assuming that this account and response were actually posted by GoDaddy. If so, I'm glad you've decided to address this matter, but unforunately, you haven't gone far enough. Your handling of the matter was irrespons
Overkill (Score:5, Insightful)
Let's see... one page out of 250,000 on a site turns out to have content that could compromise security at another site. So MySpace contacts the registrar, and gets the entire site shut down?
That's like using a hand grenade to swat a fly.
The logical way to go about this is as follows:
Myspace should not have even contacted GoDaddy until they took the first two steps. And once GoDaddy was contacted, they should have done more investigation, which would have made it clear that they were looking at one page out of a quarter million... at which point they should have either told MySpace to contact the host, or done it themselves.
Even if, after all these steps, GoDaddy still decided to suspend the registration, they should have contacted him first: remove this page or we'll have to disable your site. Failing that, they should have told him why it was being suspended (beyond the vague reference to TOS abuse) and how he could resolve it.
Disabling the entire site with (apparently) minimal investigation is overreaction, plain and simple. That quote from Jones, where they refused to rule out taking down an entire news site to block access to one story -- or even one comment -- is telling.
Re: (Score:2)
It's one of the big reasons that I don't register domain names through them.
Re: (Score:2)
Re:Overkill (Score:5, Insightful)
Re:Overkill (Score:5, Funny)
Netsol (Score:5, Funny)
Eh, they use Network Solutions as their registrar - good luck getting anything done there.
Good concept, though.
Re: (Score:2, Funny)
Re: (Score:3, Insightful)
Unless your web hosting company is willing to go to bat for you, you'll never, ever, hear from a company like MySpace before your site is taken off line.
Overkill is an understatement (Score:5, Insightful)
Besides, Myspace's effort was entirely useless. Those usernames/passwords were already compromised, Fjodor's site was just one that had it from the many places it can be found. The sensible thing would have been a forced password reset for the users involved not trying to coerce a registrar.
My position is that unless a legal, court ordered action is forced on the registrar, it should be forbidden to drop anything. And in the case there is content that shouldn't be public on the site, that is a _hosting_ issue not a domain issue. Go bugger the hosting company with legal documents.
Re: (Score:3, Interesting)
serious repecussions[sic]: I along with every other slashdotter who RTFS [S=summary] will no longer be using GoDaddy. personally, i'm going to transfer my domains to some other host as soon as i can afford to do it.
GoDaddy does hosting as well... are you sure that
Re:Overkill is an understatement (Score:5, Interesting)
Then again, i called mastercard and told them i didn't authorize that charge, so they didn't get that $200 from me.
Re: (Score:2)
Re: (Score:2)
...should have put my glasses on when proofreading this
Re: (Score:3, Insightful)
What if they were califlowers? Or Polonium 290? Or Nigerian scam letters? What's that got to do with this situation? Even if they were credit card numbers and data, they're already on the wild and phished, the person who posted them on the seclists forum has the data anyway. Nuking domains isn't the solution to that problem.
mass market effect (Score:2)
I completely agree 100% with all that you said. I also know that it would never happen.
Companies that are at the size and scale that allows them to say, in a condescending voice, "we're the world's largest X" in the span of a simple phone conversation, are completely incapable of the approach that you gave.
Personal, manual, coordinated investigation for a case involving 0.001% of your business? No frickin' way. There's probably 50 such cases every day, if not every hour. The order of the day is to
Re: (Score:2)
MySpace should have invalidated all the usernames and passwords found in the list and notified those with compromised accounts that they need to change their password and alert them that they were compromised. Or just delete the profiles entirely, as they've probably already been compromised and filled with links to V!@Gr@ websites.
MySpace could even then use the list of passwords to detect hacking attempts and use it to improve the
Re: (Score:3, Interesting)
Wow, you interpretted that quote completely different from most of us. (I assume) that most of us interpretted it as "We reserve the right to screw our customers, as long as screwing that particular customer is the most convenient course of action for us"
Re: (Score:3, Insightful)
Re: (Score:3, Funny)
I mean, yeah, it sounds unlikely, but... what if it worked?
Re:Overkill (Score:5, Informative)
Hmmm.......
Re: (Score:2)
Are you forgetting that, although the public thinks its just a MySpace account, many of those users probably have the same password for many other websites, programs, etc.
Re: (Score:2, Insightful)
Real-world analogy (Score:2)
OK. Let's take a real-world analogy. You're trying to capture a criminal suspect who lives in a town of 250,000. You know his name. You know where he lives. You know he's at home. Do you:
A. Send police to his home and arrest him?
B. Place the entire city under house arrest, saving you the trouble of sending that squad car?
Re: (Score:2)
And even if you put the city under house-arrest, as you say, you still have to send the police in. So your analogy really doesn't apply here.
Case by case basis (Score:5, Insightful)
In other words, "We have no backbone. We obey power. You have none. MySpace does. Any questions?"
Re:Case by case basis (Score:5, Funny)
So we should change the name to "YesDaddy".
HERE IS A LINK FROM GOOGLE : FULL LIST (Score:5, Interesting)
now please shut down google?
oh I see, they are corporate and fydor is the little guy, I forgot!!!
Re: (Score:3, Insightful)
Hey, it's not like a corporation in modern America has all of the rights of a citizen, is incredibly wealthy, is immortal, can't be jailed, has an infinite amount of man-hours, and can only be prosecuted monetarily. Oh, wait.
I can't believe nobody is ranting about Rupert Murdoch here yet.
Myspace is the new AOL (Score:5, Insightful)
As to what MySpace did, I'm honestly surprised how incredibly angry that makes me. I thought I was jaded by the petulance of businesses at this point. And Godaddy's response -- geez. I don't understand how a business can take your money and then refuse to talk to you.
Well, no -- I understand how they can do it. I understand it perfectly well. They do it because they figure they can get away with it, because even if they piss off one customer, how are the rest ever going to find out? Or care?
Re:Myspace is the new AOL (Score:5, Interesting)
I have a few domains registered with godaddy at the moment. In about an hour, they no longer will be, with a letter to their CEO (US Mail) saying why.
GoDaddy is now known as GoAwayDaddy in my book.
I think you're right... (Score:2)
GoDaddy probably complied... (Score:5, Interesting)
And, by the way, I hope GoDaddy's reading this. I'm moving my domains away from you because of your lackadaisical approach to our constitutional rights.
Constitutional Rights (Score:2)
That said, Godaddy acted irresponsibly and their reaction to the whole thing guarantee I'll never consider them if I want to register a domain.
Re: (Score:2)
From whom do the registrars derive their power?
IANAL(BIRGL), but I'd bet that, with big enough players involved (Google vs Fox, for example), a good lawyer could make a case that the registrar, in its capacity as an outsourced agent of the US Government, has some degree of obligation to obey the first amendment.
Re: (Score:2)
That's right, the Constitution doesn't actually say you have a right to freedom of speech, only that Congress can't make a law abridging it. Wait, why does this sound familiar [slashdot.org]?
You misunderstand... (Score:2)
A webhost is also not bound by
Re: (Score:2)
Me, too. Who are you going with?
Re: (Score:2)
Two thumbs up to both.
-nB
domain registrar neutrality (Score:4, Insightful)
Legal Implications? (Score:3, Insightful)
This seems to me to be an issue for the courts, not an IT department.
How timely (Score:4, Interesting)
Re: (Score:2)
Re: (Score:2, Informative)
Re: (Score:2)
Re: (Score:3, Interesting)
While this means you should be careful on the terms and conditions and check their track records (so far I've used gandi before and they seem ok, I don't know much about joker), it means companies in other countries will have to work a bit harder to take down your domain.
Of course, if you use Gandi and do something that annoyed the French Gov, they might be able to force Gandi to pull your domain.
Re: (Score:2)
I myself have had a lot of issues with GoDaddy, and I can't help but be surprised at the people who are acting so shocked. It's cheap webhosting. They don't give a damn about individual customers, and they don't have a great reputation.
Getting a good webhost is hard. You have to be willing to move around a lot, and to pay more than 8 bucks a month.
not an intelligent move.. (Score:5, Funny)
the next few thousand registered usernames: (Score:5, Funny)
';DROP database;select * from x where '=
';DROP database;--
\';\'\';DROP database;--
It is very strange indeed.
Impressively retarded (Score:3)
Time to remove my registrations from GoDaddy... (Score:2)
There are proper ways of fixing these things.
Big surprise. (Score:5, Interesting)
Providers, by and large, will cave to any request from a big company...Hell there was an article about it here a few days ago, that linked the BoF Experiment [www.bof.nl] where they posted a public domain work on 10 different places, and then sent DMCA takedown notices to all 10 places, and had 7 remove it immediately even though it was clearly marked as public domain.
Face it; a hosting site that will stick up for it's customers against a significant threat from a big company is hard as hell to find, and sure as hell GoDaddy isn't going to do it for 10 bucks a month.
Why where the passwords posted (Score:2, Interesting)
Why where these posted on the site? Was this part of disclosure regarding a security issue that MySpace wasn't willing to address?
New Corporate Espionage method (Score:2)
You know, GoDaddy keeps doing things that make me question whether I should keep my domains registered with them or not.
The other side is a very slippery slope as well (Score:2, Interesting)
Better domain registrars? (Score:2)
Does anyone have any experience with domain registrars that would have handled this situation better than did GoDaddy? I'd love a registrar that's demonstrated that it strikes a better balance between "anything goes" and "you so much as look at us cross-eyed and we'll shut you down".
Unconscionable (Score:5, Interesting)
2. 142: The number of domains I have registered with GoDaddy.
3. $1500: Roughly the annual amount I pay for my domains to renew them each year.
4. 48: The number of hours I have allotted myself this weekend to transfer each and every one of them AWAY from GoDaddy to someplace like NameCheap.com or DomainMonitor. Haven't decided yet.
5. True: Boolean value for whether or not I am pissed-off.
6. Very Much: The level of item 5, above's, value.
Re: (Score:3, Insightful)
7. With a Passion: The way I hate your writing style.
Re:Unconscionable (Score:4, Funny)
6. Very Much: The level of item 5, above's, value.
Where did you learn the meaning of the word boolean?
Pulling my sites (Score:4, Informative)
Probably reasonable (Score:3, Interesting)
Re: (Score:3, Insightful)
I thought it was rather obvious why GoDaddy dicked over SecList: MySpace is a big player on the internets & they get special treatement.
/.ers), such that you continue giving them your business and would trust them? I would have thought the facts speak for themselves.
Serious question: What explanation from GoDaddy would satisfy you (or other
I've said it before and I'll say it again... (Score:4, Funny)
Not a Freedom Of Speech Issue (Score:2)
The more effective approach is to build the business case against choosing godaddy in the future. Nothing hurts them more than a shot in the pocketbook.
Personally, I question the wisdom of going with a company the size of godaddy to begin with. But that's me.
Re: (Score:2)
Sorry? I certainly hope you're not implying they're small; because if that's the case you're terribly mistaken.
As of August 2006, they control 14.6 million domains and raked in over 15 million bucks in one quarter.
RTFA people, it was an archive (Score:4, Informative)
I believe MySpace and GoDaddy are both to blame here for reasons that any sensical person can see. I think I'll be looking for a new registrar now.
I see a giant drop in revenue for GoDaddy (Score:5, Insightful)
I have a few domains up for renewal, and was considering GoDaddy. Not any more. I am sure slashot readers must control the registration of several million domains.
I hope this publicity shows as a giant drop on their revenue graph.
Was looking for a registrar.... (Score:3, Interesting)
GoDaddy and the DMCA... (Score:5, Informative)
I got an email from GoDaddy saying "please take this down and respond that, under penalty of perjury, you did so."
I happened to be checking my email at this moment, 12:30 at night, so I looked into the issue and responded to the email that the issue was resolved.
The next morning, my server wasn't responding to pings. So I email again saying, "hey, I took care of the complaint before you unplugged my machine, can you, you know, plug it back in?"
Day goes by. Eventually I get a response:
"Thank you for your response to the Copyright Department. In order to reactivate the site in question we will need you to provide the following information in a single email response:
A. An electronic signature. (This can be a scanned copy of your physical signature, or as simple as typing your full name.)
B. Identification of the material in question.
C. A statement, under penalty of perjury, that the material has either been removed or will promptly be removed."
So I write back again, explaining the details. Again.
Day goes by. I call the tech support number and explain the situation. The tech support guy (who was very nice) told me he couldn't help, and I should try emailing the address I already had, twice. Sigh. I do it again.
Day goes by. I get the following response:
"Thank you for contacting the Copyright Claims Department. Unfortunately your previous email did not include a statment under penalty of perjury. Please submit a complete content removal statement at your earliest convenience to have your services reactivated. For your reference an example of a complete copyright removal statement is listed below.
I, John Doe, under penalty of perjury, will remove the offending content at http://www.mydomainname.com/myfile/page.htm [mydomainname.com] promptly after the reactivation of my services.
John Doe
(Please accept the above as an electronic signature.)"
Okay, great. I finally found the magic formula. I copy the template exactly and fill in my details, send it out.
Day goes by. I get this back:
"Thank you for your email. We appreciate your responsiveness and cooperation on this matter. We have re-activated the account and services associated with your site. As some services require some time for propagation to take full effect, please allow 1-2 hours for the changes to take effect."
Ok, progress, finally.
Day goes by.
Day goes by.
Server still isn't responding. I email tech support to see if there's a problem. They tell me to try using the automatic reboot request form on the web panel. Sure enough, the system responds within minutes.
So basically, they were really on top of that from every angle. In the week my server was unavailable, I arranged for hosting at one of their competitors, Dreamhost.com, who rocks quite a bit. Specifically because of this incident, I probably won't renew the GoDaddy contract when it expires, but I also wonder if I'm really safer at any other ISP in America.
It's partially a shame because I really was perfectly satisfied with GoDaddy's hosting before this incident, and they just flat out botched it. The server provides bandwidth offloading for my main site, so I could survive without it for a week, but I couldn't imagine someone trusting their business to GoDaddy if they can callously cut your oxygen for a week.
It's also a shame because the DMCA required GoDaddy to have a knee-jerk reaction in the first place. I was basically accused, tried, and convicted by my service provider without any evidence or chance to defend myself. They should be looking at this as bad for business in even well-handled situations, and recognize that the best thing to do is take
I worked for a large registrar (Score:3, Insightful)
Dear,
Please contact the owner of the domain for such matters. If you have any problems finding this, the information can be queried through the whois database. We do not comply with any request for take down unless signed by a judge in our LOCAL district court (the exact information for such procedures can be found in our legal notices on our website).
If you have any further questions, please contact your legal counsel or a legal counsel in our district to proceed.
Sincerely,
MyName
Usually I didn't get any further communication on this. We had a few times the police come in to 'take down' the server. We denied access to our datacenters and told them to take a hike. We also had a few times the police (detectives) to get an 'IP address' for a website (they heard you needed that somehow). We just wrote it down on a piece of paper and gave it to them, they must have thought it was like a package or device they were going to get to disable a site because they asked: What is that? An IP address. Is that it? Yes. Is the site down then? No. But we want it down! No, sorry, gotta get a court order AND a search warrant for our premises AND a search warrant for our clients premises (since the server is their premises).
Re: (Score:2, Informative)
Re: (Score:3, Insightful)
Sounds reasonable to me.
And me too, but we seem to have the minority opinion here. I love reading the justifications on why this is "evil" of GoDaddy to do this. Then again, what do you expect from Slashdot readers? Last week everyone was up in arms because the RIAA and a SWAT team arrested a guy for "making mix tapes" when in fact he was a bootlegger with over EIGHTY THOUSAND bootleg C
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
Login/password lists like these exist all over the net, just search Google a bit, but make sure you turn off the "English results only" option.
Re: (Score:3, Informative)
Ordering a takedown in pointless...I can't believe that those users weren't informed that they should change their passwords, and if they were, what's the problem?
Re: (Score:2)
Once noticed (somebody told him the problem), he pulled the post.
Now, if that list was posted on Slashdot, would they pull that registration? If someone posted it on the BBC site, would they pull that?
Hell, it's probably cached in Google and a variety of other search engines. Are they going to pull those too?
You just creeped me out... (Score:2)
Creepy.
Re: (Score:2, Informative)
The IP in the A record for seclists.org is registered to "MEER NET," who is either hosting the site or reselling the hosting, and had nothing to do with what GoDaddy did.
Re: (Score:3, Informative)
GoDaddy was the domain registrar [wikipedia.org], not the hosting provider. There is a big difference. I would never use GoDaddy or any other domain registrar that would alter a registration without a court order.
Personally, I use directNIC [directnic.com] and Domain Contender [domaincontender.com].
Re: (Score:3, Interesting)
And that's why nobody hosts with you. GoDaddy isn't the police, nor the Law.
If someone sold you a stereo, then broke into your house and took it back, you'd call them a criminal. You wouldn't say they "did the right thing to the point", so besides the fact that GoDaddy sold virtual property, then broke into your virtual house and stole virtual property, how is this so different, it requires a completely different attitude?
Re: (Score:3, Interesting)
I don't think sending a letter to Fyodor was the answer. They had 250,000 compromised accounts. It wasn't the time to fire off a letter and sit and wait to see what happens. If you had a company and 250,000 accounts were compromised, I hope you would have been as assertive. It's not just important for your customers, it's important for your business as a whole.
Rememb