Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast is injecting 400+ lines of JavaScript into web pages

forums.xfinity.com

Post reply on HN
Print view View original

21–30 of 498 posts

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#21

Post by cm2187 »

candiodari wrote: post #11

The thing that's so irritating about large telco's is not just that they're evil, but the casual stupidity of their actions, including their evil actions. I mean, look at the code. Look at the function of this code. Look at the business purpose of this code. Look at the security aspects of using this code. Look at the legal ramifications (why the hell is that LGPL thing up top there ?). Look at their internal communi…

I don’t think it is just telcos. It is amazing how scale, inertia, lack of accountability and bureaucracy dumbs down large corporations that mostly consist of smart educated people.

A million Shakespeares typing on typewriters write no better than a monkey!

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#24

Post by exikyut »

Buge wrote: post #16
exikyut wrote: post #10

Earlier quoted context omitted.

Yes, indeed it was. It's a fairly standard, unsurprising response for this situation; doesn't try to be defensive, doesn't try to provoke. [Edit: I'm horribly under-perceptive, after reading other comments I see I'm a bit off.] But... this bit. > ... [JL] This is our web notification system, documented in RFC 6108 https://tools.ietf.org/html/rfc6108 , which has been in place for many years now. ... Oh, interesting, w…

>Reading through, this outlines a way to avoid using deep packet inspection by using Squid and Tomcat instead. Huh? It sure seems to be using deep packet inspection to me. If it's looking at the data section of your packet, that's deep packet inspection. And Squid and Tomcat do that. They're not just inspecting the packets, they're altering them, creating new packets, splitting packets, etc. The "RFC" seems to be out…

Hmmmm.

> Pre-established TCP sessions on port 80 are identified by the SMB and forwarded with no impact.

(SMB = Session Management Broker)

How does the system identify a "pre-established session"?

This seems to corroborate what you're saying

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#25

Post by metaphor »

J. Livingood (a Comcast VP) responded to the OP:

> [JL] We are not trying to sell you a new one. If you own your modem we're informing you that it is either end of life (EOL) or that you are about to get a speed upgrade that the modem will be unable to deliver.

Incidentally, Livingood is a co-author of IETF RFC 6108, which he has conveniently linked. From the RFC's general requirements numero uno:

> R3.1.1. Must Only Be Used for Critical Service Notifications. Additional Background: The system must only provide critical notifications, rather than trivial notifications. An example of a critical, non-trivial notification, which is also the primary motivation of this system, is to advise the user that their computer is infected with malware, that their security is at severe risk and/or has already been compromised, and that it is recommended that they take immediate, corrective action NOW.

As composed as Livingood's response was, a modem at EOL and/or incapable of supporting an incremental speed upgrade doesn't strike me as critical. To be sure, Comcast is scheduled to increase speeds by 12/19 (at least in my region): 10Mb->25M, 25M->60M, 75M->100M. Although I disagree with Comcast's method and categorization, it would be interesting to learn what modem the OP was using.

It would also be interesting to learn if the OP received this message on multiple instances. If yes, it would be in violation of its own requirement--in particular, R3.1.8. User Notification Acknowledgement Must Stop Further Immediate Notifications, which itself is contradictory in its use of must and should:

> Additional Background: Once a user acknowledges a critical notification, the notification should immediately stop.

EDIT: Apparently, Livingood is an executive.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#27

Post by scrollaway »

cm2187 wrote: post #21
candiodari wrote: post #11

The thing that's so irritating about large telco's is not just that they're evil, but the casual stupidity of their actions, including their evil actions. I mean, look at the code. Look at the function of this code. Look at the business purpose of this code. Look at the security aspects of using this code. Look at the legal ramifications (why the hell is that LGPL thing up top there ?). Look at their internal communi…

I don’t think it is just telcos. It is amazing how scale, inertia, lack of accountability and bureaucracy dumbs down large corporations that mostly consist of smart educated people. A million Shakespeares typing on typewriters write no better than a monkey!

> A million Shakespeares typing on typewriters write no better than a monkey!

I like it, although I think the analogy fails here. How about "An infinite amount of Shakespeares typing on the same typewriter will inevitably produce garbage"? :)

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#30

Post by lolc »

Buge wrote: post #23
ksk wrote: post #7

I wonder if a website could sue Comcast for copyright violation.

How is it copyright violation? If this is copyright violation, is it copyright violation of Comcast allowing you to download a file off the internet?

Copyright is "all rights reserved" unless otherwise stated. By publishing a website, you don't give me the right to alter and re-publish it. Whether injecting ads into a website means a derived work was created would have to be found out in court I assume.
Post reply on HN