Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast is injecting 400+ lines of JavaScript into web pages

forums.xfinity.com

Post reply on HN
Print view View original

41–50 of 498 posts

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#41

Post by Hendrikto »

Sharlin wrote: post #37
candiodari wrote: post #11

The thing that's so irritating about large telco's is not just that they're evil, but the casual stupidity of their actions, including their evil actions. I mean, look at the code. Look at the function of this code. Look at the business purpose of this code. Look at the security aspects of using this code. Look at the legal ramifications (why the hell is that LGPL thing up top there ?). Look at their internal communi…

> I mean, I know the answer is "government" and government making them a monopoly, but still. WTF. Eh, telco infrastructure is a natural monopoly. No government needed for that.

Bs. Heard about the 1996 telecommunicatins act? The government payed for their monopoly, and now it lets them keep it and not share it.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#42

Post by regularfry »

Buge wrote: post #23
ksk wrote: post #7

I wonder if a website could sue Comcast for copyright violation.

How is it copyright violation? If this is copyright violation, is it copyright violation of Comcast allowing you to download a file off the internet?

The argument is that it creates a derivative work. The right to create derivative works is separate to the right to distribute or reproduce the content, which is how Comcast is allowed to get the original website into customers' browsers.

Comcast are playing into this interpretation by adding their own license to the code they're adding.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#43

Post by garaetjjte »

mtgx wrote: post #36
lsmod wrote: post #22

Earlier quoted context omitted.

"Must Only Be Used for Critical Service Notifications." [0] https://tools.ietf.org/html/rfc6108#section-3.1

> and is instead based in open IETF standards and open source applications. Why did the IETF ever agree to standardize this? It reminds me of their standardization of Cisco's "lawful intercept" router backdoor protocol. https://tools.ietf.org/html/rfc3924 https://www.blackhat.com/presentations/bh-dc-10/Cross_Tom/Bl... I guess this is what you get when the IETF literally has NSA agents as chairs of its groups. https:/…

These are only informational RFCs, which can be published by anyone.

>This RFC is not a candidate for any level of Internet Standard. The IETF disclaims any knowledge of the fitness of this RFC for any purpose

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#46

Post by [deleted] »

candiodari wrote: post #11

The thing that's so irritating about large telco's is not just that they're evil, but the casual stupidity of their actions, including their evil actions. I mean, look at the code. Look at the function of this code. Look at the business purpose of this code. Look at the security aspects of using this code. Look at the legal ramifications (why the hell is that LGPL thing up top there ?). Look at their internal communi…

[deleted]

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#48

Post by mseebach »

izacus wrote: post #39
Xylakant wrote: post #35

Earlier quoted context omitted.

Yes. You can’t inject code in a TLS-secured connection unless you can MITM TLS and if they can do that, all is lost anyways.

There are several corporate firewall products that can do just that. Comcast can just start demanding that their customers install their root cert and that's that. Remember they are the only venue to access the internet for a lot of people, what are they going to do? Stop using the pretty much mandatory communication and information platform? I'm always surprised just how many people here on this site think you can f…

They could, but they don't. Until they do, or imply in any way that they might, let's stick to the facts and leave wild, flailing speculation to reddit.

Regardless of what an ISP might do, HTTPS everywhere is excellent advice.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#50

Post by snowpanda »

exikyut wrote: post #4

The gigantic image: https://i.imgur.com/kN2rMhK.jpg (source: http://comcastsupport.i.lithium.com/t5/image/serverpage/imag... - URL manually edited to display largest possible size) I paged through the JS curiously, and found the URL bnpsa.g.comcast.net/images/mydevicealert/browser/. I wondered what would happen if I hit that from my ISP in Australia. I was surprised: I got an NXDOMAIN back. But I discovered that goog…

Here it is in code:

https://gist.github.com/thoroc/f4d043ead762392561256e20dea81...

Post reply on HN