Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast is injecting 400+ lines of JavaScript into web pages

forums.xfinity.com

Post reply on HN
Print view View original

11–20 of 498 posts

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#11

Post by candiodari »

The thing that's so irritating about large telco's is not just that they're evil, but the casual stupidity of their actions, including their evil actions.

I mean, look at the code. Look at the function of this code. Look at the business purpose of this code. Look at the security aspects of using this code. Look at the legal ramifications (why the hell is that LGPL thing up top there ?). Look at their internal communication. Look at how easy it is to see exactly what they're doing ...

All of it screams "no double digit IQs anywhere near this thing".

And yes, I mean, I know that's not true. Their people are not this stupid (though some must be). But they do this anyway. The organisation does business analysis at the level of a 5 year old, codes like a 10 year old, obviously this has not passed legal review, ...

How can an organisation that executes this badly become this big ? I mean, I know the answer is "government" and government making them a monopoly, but still. WTF.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#13

Post by deusum »

exikyut wrote: post #4

The gigantic image: https://i.imgur.com/kN2rMhK.jpg (source: http://comcastsupport.i.lithium.com/t5/image/serverpage/imag... - URL manually edited to display largest possible size) I paged through the JS curiously, and found the URL bnpsa.g.comcast.net/images/mydevicealert/browser/. I wondered what would happen if I hit that from my ISP in Australia. I was surprised: I got an NXDOMAIN back. But I discovered that goog…

Server not found.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#15

Post by exikyut »

candiodari wrote: post #11

The thing that's so irritating about large telco's is not just that they're evil, but the casual stupidity of their actions, including their evil actions. I mean, look at the code. Look at the function of this code. Look at the business purpose of this code. Look at the security aspects of using this code. Look at the legal ramifications (why the hell is that LGPL thing up top there ?). Look at their internal communi…

Yep.

The random classList polyfill at the bottom was a nice touch. As I scrolled to this bit I was initially like "oh this'll be nice they encrypted some of--oh. :("

My favorite bit was the "this detects the browser type and version" snippet that was copyrighted 2001. Nice!

I think the move to open-source the code was a ham-fisted way to get the "we're modifying copyrighted documents in flight" part past the lawyers. It's admittedly a pretty decent legal move.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#16

Post by Buge »

exikyut wrote: post #10
vages wrote: post #3

Most interesting part was the reply from the Comcast employee.

Yes, indeed it was. It's a fairly standard, unsurprising response for this situation; doesn't try to be defensive, doesn't try to provoke. [Edit: I'm horribly under-perceptive, after reading other comments I see I'm a bit off.] But... this bit. > ... [JL] This is our web notification system, documented in RFC 6108 https://tools.ietf.org/html/rfc6108 , which has been in place for many years now. ... Oh, interesting, w…

>Reading through, this outlines a way to avoid using deep packet inspection by using Squid and Tomcat instead.

Huh? It sure seems to be using deep packet inspection to me. If it's looking at the data section of your packet, that's deep packet inspection. And Squid and Tomcat do that. They're not just inspecting the packets, they're altering them, creating new packets, splitting packets, etc. The "RFC" seems to be outright lying by claiming they don't do DPI.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#18

Post by exikyut »

mehrdadn wrote: post #6
exikyut wrote: post #4

The gigantic image: https://i.imgur.com/kN2rMhK.jpg (source: http://comcastsupport.i.lithium.com/t5/image/serverpage/imag... - URL manually edited to display largest possible size) I paged through the JS curiously, and found the URL bnpsa.g.comcast.net/images/mydevicealert/browser/. I wondered what would happen if I hit that from my ISP in Australia. I was surprised: I got an NXDOMAIN back. But I discovered that goog…

> Question to anyone on Comcast: does http://bnpsa.g.comcast.net/images/mydevicealert/browser/ resolve for you? Nope, it does not for me. Non-existent domain.

Thanks!

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#19

Post by exikyut »

deusum wrote: post #13
exikyut wrote: post #4

The gigantic image: https://i.imgur.com/kN2rMhK.jpg (source: http://comcastsupport.i.lithium.com/t5/image/serverpage/imag... - URL manually edited to display largest possible size) I paged through the JS curiously, and found the URL bnpsa.g.comcast.net/images/mydevicealert/browser/. I wondered what would happen if I hit that from my ISP in Australia. I was surprised: I got an NXDOMAIN back. But I discovered that goog…

Server not found.

Ah, okay then.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#20

Post by sleavey »

tylerruby wrote: post #9
throwaway613834 wrote: post #5

Earlier quoted context omitted.

Specifically the last sentence!

For those that haven't seen it: Customer: "Comcast has my phone office number, my cell for texts, my email, and my home address, yet they choose to molest my requested web pages by injecting hundreds of lines of code." Comcast Response: "The notice is typically sent after a customer ignores several emails. Perhaps some of those ended up in your spam folder?" To me this sounds like a crazy ex-lover. "You didn't respon…

And I bet that by "ignore" they mean "didn't allow remote tracking images in emails to be loaded therefore stopping us from knowing if, when and where the email was viewed".
Post reply on HN