Hacker News Reader

Comment by gigatexal | Hacker News Reader

Happy with my namecheap domain hosted in Linode: never going to touch a godaddy domain for any of my needs.

This solution is for the 1% or the 0.1%, the vast majority who choose Linode are creating vulnerable servers because they are not going to competently keep the machine up to date on security patches or configure it properly for security.

Managed hosting is a requirement for the masses, and comparing a managed hosting service with a self-service VPS is a bit disingenuous IMO. Managed may seem more pricey, but that's only unless you don't value your own time as an administrator, or if your time isn't valuable (you're not good at it lol).

For my static website I think it’s ok.

Parent comment is referring to software vulnerabilities running on the box itself, not vulnerabilities in your website. When Apache or whatever it is that you use to serve your static website comes out with a vulnerability that allows RCE as root, it becomes a problem for you, even if your website is static.

FWIW I use Namecheap / Linode myself, and will probably never go back to shared hosting. But the flip side of that coin is you do need to manage it, regardless of the website you are hosting.

> Parent comment is referring to software vulnerabilities running on the box itself, not vulnerabilities in your website. When Apache or whatever it is that you use to serve your static website comes out with a vulnerability that allows RCE as root

Or you can opt out of this mess and run a simple server. Not as root.

The update & maintenance treadmill can be slowed down to nearly a halt if you're ok using simple software that doesn't have a billion features and just as many bugs. Which, I suppose, someone running a static site would be quite willing to do.

I'm sure we all have fond memories of that time we sat our grandparents down when they wanted to make an anniversary site and explained to them how easy it was to run a simple server, after which they spun one up in a container and secured it no problem.

Little old grandma just loves ssh'ing into her pet server every day to read her system logs.

Little old grandma ain't making sites with GoDaddy either, so why do you have to come up with such an irrelevant strawman. Please.

Grandpa is exactly the target market for GoDaddy. Look who they've got advertising the company in Australia.

http://yaffa-cdn.s3.amazonaws.com/adnews/live/images/yafNews...

My grandmother's website for her small business was purchased via GoDaddy. This was before those commercials even started airing.

It's not a strawman at all. I am speaking from real experience, except for the part where my grandmother could tell you the difference between SSH and SSL.

You can configure that machine to automatically update itself, which is what I do.

And I don't think GoDaddy or other managed hosting providers are doing a better job than this.

Also FYI static websites have a much smaller surface of attack when compared to forever-vulnerable shit like WordPress.

yes, this.

Godaddy is not doing much more than auto-updating packages with security fixes. This is easily handled with most Linux VPSs (often automatically, in the case of DigitalOcean). I am pretty sure the Amazon Linux AMIs do this too on AWS EC2. And most other distros can turn this on once with one command.

I don't think GoDaddy is going much deeper than this, so security is a moot comparison between the two. In fact most sites are hacked at the application level anyway, not the system level. So the real security hole is not something on Linux, but the actual wordpress site thats installed within it. Food for thought: 83% of hacked websites in 2017 were Wordpress sites. Source: https://sucuri.net/reports/2017-hacked-website-report

my website is run via containers that don't run as root...

Oh well in that case, you are 100% invulnerable to attack.

^ I know this statement appears absurd to you, so I'm wondering why you're posting as if it's true?

Yes, with read-only volumes. These are awesome for security.

They are useful for mitigating some kinds of attacks; I wouldn't go so far as to say they are a panacea for security in general.

A lot of people recommending NameCheap in this thread.. it's worth noting that they supposedly gave a warning to a guy running a forum with millions of visitors that they would suspend his account if he didn't remove two images within 24 hours (https://news.ycombinator.com/item?id=14139288), and that they're dumping costumers private info (https://news.ycombinator.com/item?id=18063667). I'm guessing there are other horror stories as well, but those two alone (which to me sound credible) were enough reason to take my business elsewhere.

This - after their support requested my password over live chat I've since moved every domain I own to Gandi upon renewal.

Hey, the same thing happened to me! They asked for my password during a livechat session, and i was like "what the hell".

Also, another time I was having problems with their stupid 2FA app (back when they ran their own app and it broke constantly), and their solution was to just disable the 2FA for my account. They said I can set it up again whenever I want to. So then I told the woman, that if someone wanted to hack into my account, they could just open a livechat and get my 2FA disabled and then log in, why should I even bother having 2FA at all if you're just going to disable it.

To be fair, they finally moved to a more traditional 2FA now, where you can use any 2FA app instead of their proprietary namecheap app. So they might not do this anymore. I think they were disabling 2FA back when they used their own app for it, because it was super buggy and people (like myself) would get locked out of our accounts for no reason other than their app was buggy.

I can recommend https://easydns.com/

seconded. been using this for years and works incredibly well - perfect also also as a secondary DNS.

Their UI hasn't always been the latest & greatest (but even here they came a long way in the past 2 years). their knowledgeable (and helpful) customer support really makes up for it.

I don't know the internals of the company but would assume that the people running it are still the same team who founded it and they really know networking & DNS inside-out. Refreshing in a time where financial and marketer types have taken over a lot of the decision making in tech or where you're in a customer support loop for ages and everything is handled by a bot.

Their “no upselling” policy has taken a bit of a nose dive these days with pestering about things. In an email I have with their CS they said it’s not upselling, but offering you things other customers have found useful... Yeah right... all it’s not as annoying as GoDaddy’s at least was (not used them in years) but you are still trying to upsell me; just ditch your no upsell policy :-p

I still have a few domains with them it I’ve been using namesilo lately after hearing about them here and no complaints. Well the only complaint I have of them is they don’t have the range of TLD’s as namecheap does (but it’s only a handful of TLDs such as .es)

I've had nothing but great experiences with their support staff. I guess it's a your-mileage-may-vary kind of thing.

I've been using OVH for my domains. They're cheap and pretty good to be honest.

Move your domains to Cloudflare.

I did, largely because they take security seriously, but CloudFlare domains isn't a registrar: You can't set the nameservers to whatever you want. It's a CloudFlare lock-in service.

The fact that you can't change the nameservers doesn't make them not a registrar. They absolutely are a registrar. Just one that doesn't let you change the nameservers.

But you know what? I'm okay with that. I honestly can't think of a scenario where I'd want to use any other nameservers.

> I honestly can't think of a scenario where I'd want to use any other nameservers.

What about the scenerio where you are thrown off of cloudflare service? A CDN is more inclined to ban sites to limit their own risks from litigious IP owners, etc, irregardless of who would win an actual court case.

Why would they continue allowing you to use the registrar but not the nameservers?

The registry probably has rules on what they can do to customers that curtail them; they are probably not bound (ha!) to anything wrt serving DNS requests.

I'm saying why would you let a CDN be your registrar in what sounds like an abnormal registrar agreement. (If they block you from the CDN, what happens then?)

> If they block you from the CDN, what happens then?

That could be an argument not to use their DNS service and their CDN service.

It shouldn't be an issue for the DNS service by itself.

I believe the path for Krebs when under DDOS was free CF cloud to akamai to special status (from Google?) Using CF domains with or without CF's normal services turned on would have made akamai impossible until a transfer process to a real registrar completed leading to an extra week or so of downtime.

I was a huge fan of Namecheap, and I have like 25 clients using them.

But... I haven't been a fan of them lately.

I've got a password manager and 2FA on all my accounts, and I went to sign in. I kept getting an incorrect password response. Reset, tried again. Just kept getting the same error. Freaked me out as I couldn't sign in.

Fast forward, came to find out because I was on my company VPN they were blocking me. Rather than just show a message, "We don't accept users on a VPN..." they let me think my password was wrong and go through the panic of not being able to sign in. And, even thought they thought I was some sort of spammer / hacker for using a VPN, they were more than happy to discuss my sign in details over live chat.

I sort of get "security" here, but they shouldn't be heavy handed with just saying who can and can't sign in, and if you are going to block me, tell me why -- at least send an email letting me know what's up if you don't want to display a browser message. 2FA was enabled, at that point... just leave it up to the user where they want to sign in from, don't put in secret rules around who can and can't sign in.

Anyway, I moved everyone over to Amazon Route 53 and haven't had any more issues.

Unfortunately that's what many companies do. IIRC, this includes connecting with OVH ips to mojang (minecraft) login servers. It's becoming a popular practice that is not good in UX terms at all

Sounds like a great practice. You don't let the spammer know they're found out, and if you call customer support about it they are able to tell you what's wrong after you've verified extra info. Would you rather they give hackers access to lock you out or unlimited access to keep trying?

Security by obscurity is none at all, the customer/hacker can call up and provide information/pretext no problem - plus the information is available on public sources (such as this one) on why the issue occurs - a smart enough attacker can just use other proxies until it finds one you didnt ban, whereas legit users are probably SOL.

Blocking known source of brute force attempts and attacks is not security by obscurity and it should be a mandatory practice.

Run a website of any importance and you will quickly be shocked at the amount of malicious traffic that keep coming from Tor/DigitalOcean/VPN/openproxy and a few other sources.

Just to clarify something, I was a legitimate user with a strong password (100 character) and 2FA enabled.

And they blocked me.

They didn't tell me why, I figured it out on my own inadvertently.

I wasn't on a junky free VPN, I was on a corporate VPN service.

And I was blocked, worse I was given false information about my password being incorrect... and worse still, given that they assumed someone was trying to enter a fake password, they never emailed me to let me know -- I had to contact them.

Plenty of legit reasons for someone to use a VPN. I'm relatively certain nobody from the telco in Australia who set up the VPN had been trying to hack Namecheap, looks more just like someone found a way to classify that IP as a VPN and blocked it.

And look, to put the nail in the coffin, they were more that willing to tell me the email address to check for the reset password via live chat.

Anyway I tend to be the guy harping about security, but when they start banning VPNs just for being a VPN I don't think that's secure, I think it's obnoxious. We should encourage people to use VPNs, not make it annoying for them.

Proper procedure would be to let the bad guy try, block the IP (or better yet, browser finger print), let them know why they were blocked (in case they aren't a bad guy), and (if the owner didn't have 2FA) send the owner an email saying someone was trying to get access but wasn't successful.

For users with 2FA, all you'd ever really have to do is send an email to the owner, and / or access distribution list, letting them know when a certain user signed in. I wish more people offered this service, getting access notifications when any admin signed in would be key for helping me figure out what task broke something if I have to go fix it.

I have had so many problems with 2FA and Namecheap. I use 2FA on any service that will let me. Needless to say, I am very confident in using it. All my 2FA are set up in my Authy app, and i use it many times a day without issue.

But then comes namecheap. They are literally the only service on the internet where I will get locked out with 2FA. It will keep claiming it is the wrong password, when I know its not. I don't ever have a problem with any other online service, but the 2FA on namecheap is a constant problem. I have been locked out on Namecheap for no reason now 5+ times that I have now just turned it off.

Now that I read your comment, I wonder if I have the same problem. I am sometimes logged in via VPN and I wonder now if that is why it was rejecting me. Its frustrating because i know the password is correct and the app is set up correctly, but it will keep claiming I have the wrong password. Like i said, I now just have it turned off, because I am terrified of losing access to my domains. But I am also terrified of not having 2FA protecting my domains. So its made me consider transferring elsewhere.

I also considered just using Amazon. Most of my domains are already using Route53 as a premium DNS instead of relying on Namecheap as a DNS anyway. So I am considering just having them be the registrar too.

I've been trying to move away from Network Solutions (now web dot com) for years and NameCheap was the closest to a halfway decent registrar I could find. That said, I don't like them or any of the other registrars. Most of the registrars have been bought up and their backend wrapped with some other companies junk UX. I also tried name dot com. They don't even have the capability to set apex DNS names as NS records. Black Knight closed my account with no reason at all. The only halfway decent registrar is Mark Monitor and they are too expensive for my hobby sites. I always move corporate DNS and Cert management to Mark Monitor, but for personal use, all the popular registrars are just garbage, in my strong jaded opinion. MM is just a reseller of certs and they don't even offer all the capabilities of the vendors they resell.

I am purposefully staying away from AWS. They are super popular right now and developer friendly, but I know how their business operates and that popularity will subside in a few years. I predict many of their users will feel betrayed at some point in the future after enough people have moved to their DNS.

If you're happy with namecheap you will be delighted with bookmyname imho

Reply on news.ycombinator.com