Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast is injecting 400+ lines of JavaScript into web pages

forums.xfinity.com

Post reply on HN
Print view View original

31–40 of 498 posts

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#31

Post by glenstein »

metaphor wrote: post #25

J. Livingood (a Comcast VP) responded to the OP: > [JL] We are not trying to sell you a new one. If you own your modem we're informing you that it is either end of life (EOL) or that you are about to get a speed upgrade that the modem will be unable to deliver. Incidentally, Livingood is a co-author of IETF RFC 6108, which he has conveniently linked. From the RFC's general requirements numero uno: > R3.1.1. Must Only…

>As composed as Livingood's response was, a modem at EOL and/or incapable of supporting an incremental speed upgrade doesn't strike me as critical.

Exactly. And the response, "we're not trying to sell you a modem, we're just encouraging you to strongly consider buying a new one" is such a hair-splittingly asinine response considering the rather serious breach of trust posed by the notification system.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#34

Post by [deleted] »

metaphor wrote: post #25

J. Livingood (a Comcast VP) responded to the OP: > [JL] We are not trying to sell you a new one. If you own your modem we're informing you that it is either end of life (EOL) or that you are about to get a speed upgrade that the modem will be unable to deliver. Incidentally, Livingood is a co-author of IETF RFC 6108, which he has conveniently linked. From the RFC's general requirements numero uno: > R3.1.1. Must Only…

[deleted]

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#35

Post by Xylakant »

nkkollaw wrote: post #33
sccxy wrote: post #2

That is one reason why HTTPS is must for all sites.

Would HTTPS help at all in this case, though..?

Yes. You can’t inject code in a TLS-secured connection unless you can MITM TLS and if they can do that, all is lost anyways.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#36

Post by mtgx »

lsmod wrote: post #22
tosh wrote: post #8

"Comcast's Web Notification System Design" https://tools.ietf.org/html/rfc6108

"Must Only Be Used for Critical Service Notifications." [0] https://tools.ietf.org/html/rfc6108#section-3.1

> and is instead based in open IETF standards and open source applications.

Why did the IETF ever agree to standardize this? It reminds me of their standardization of Cisco's "lawful intercept" router backdoor protocol.

https://tools.ietf.org/html/rfc3924

https://www.blackhat.com/presentations/bh-dc-10/Cross_Tom/Bl...

I guess this is what you get when the IETF literally has NSA agents as chairs of its groups.

https://arstechnica.com/information-technology/2014/01/nsa-e...

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#37

Post by Sharlin »

candiodari wrote: post #11

The thing that's so irritating about large telco's is not just that they're evil, but the casual stupidity of their actions, including their evil actions. I mean, look at the code. Look at the function of this code. Look at the business purpose of this code. Look at the security aspects of using this code. Look at the legal ramifications (why the hell is that LGPL thing up top there ?). Look at their internal communi…

> I mean, I know the answer is "government" and government making them a monopoly, but still. WTF.

Eh, telco infrastructure is a natural monopoly. No government needed for that.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#38

Post by Crosseye_Jack »

nkkollaw wrote: post #33
sccxy wrote: post #2

That is one reason why HTTPS is must for all sites.

Would HTTPS help at all in this case, though..?

Yes, they couldn’t modify the webpage without breaking the cert signing giving the user an error, installing a ca cert on your devices and doing a mitm on your traffic (which would be hard to predict if your device has their cert installed) or getting a already trust CA to forge Certs for them which once recovered would get that trusted CA dragged though the mud by the major browsers.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#39

Post by izacus »

Xylakant wrote: post #35
nkkollaw wrote: post #33

Earlier quoted context omitted.

Would HTTPS help at all in this case, though..?

Yes. You can’t inject code in a TLS-secured connection unless you can MITM TLS and if they can do that, all is lost anyways.

There are several corporate firewall products that can do just that. Comcast can just start demanding that their customers install their root cert and that's that.

Remember they are the only venue to access the internet for a lot of people, what are they going to do? Stop using the pretty much mandatory communication and information platform?

I'm always surprised just how many people here on this site think you can fight social/political fights with technology. Especially when it comes to entities that can bribe legislation and control your communication.

Post reply on HN