Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast is injecting 400+ lines of JavaScript into web pages

forums.xfinity.com

Post reply on HN
Print view View original

71–80 of 498 posts

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#71

Post by icebraining »

exikyut wrote: post #15
candiodari wrote: post #11

The thing that's so irritating about large telco's is not just that they're evil, but the casual stupidity of their actions, including their evil actions. I mean, look at the code. Look at the function of this code. Look at the business purpose of this code. Look at the security aspects of using this code. Look at the legal ramifications (why the hell is that LGPL thing up top there ?). Look at their internal communi…

Yep. The random classList polyfill at the bottom was a nice touch. As I scrolled to this bit I was initially like "oh this'll be nice they encrypted some of--oh. :(" My favorite bit was the "this detects the browser type and version" snippet that was copyrighted 2001. Nice! I think the move to open-source the code was a ham-fisted way to get the "we're modifying copyrighted documents in flight" part past the lawyers.…

I think the move to open-source the code was a ham-fisted way to get the "we're modifying copyrighted documents in flight" part past the lawyers. It's admittedly a pretty decent legal move.

I don't get it, how does that work?

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#72

Post by betterunix2 »

regularfry wrote: post #42
Buge wrote: post #23

Earlier quoted context omitted.

How is it copyright violation? If this is copyright violation, is it copyright violation of Comcast allowing you to download a file off the internet?

The argument is that it creates a derivative work. The right to create derivative works is separate to the right to distribute or reproduce the content, which is how Comcast is allowed to get the original website into customers' browsers. Comcast are playing into this interpretation by adding their own license to the code they're adding.

It would open a whole can of worms. What about adding MPLS headers to packets, or performing MSS clamping? Or what about the numerous physical layer protocols that add error correction? Or the consumer routers that have parental filters, ad blocking, etc.?

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#73

Post by Crosseye_Jack »

izacus wrote: post #57
Crosseye_Jack wrote: post #54

Earlier quoted context omitted.

> Comcast can just start demanding that their customers install their root cert and that's that. Comcast can demand all they want but they are going to have to hand hold a lot of people though the process. Sure Windows/Mac could offer a nice executable to install it for you but you still have to get people to install it and that’s not something there while customer base will be able to do. The process of installing C…

You're way overthinking this. Go look at how exactly the automated deployment of MITM HTTPS corporate firewall works - it's a few steps affair and gets them 90% there. All they need to do is block YouTube/Google/Facebook until you run the "Comcast internet setup wizard" (remember? those were a thing!) which makes most customer connections MITMable. Then charge extra for all non-MITMed connections ;) Declare Firefox a…

The internet setup wizard is a pain to even get to these days esp if you are trying to run it on a “dirty” device that has already been used online and is enforcing HSTS.

You can only redirect them to the wizard if they try and connect to a non https site or the non http site of a https site they have yet to visit.

Same mother. She has a 4g sim in her iPad cheapest deal for her usage level is prepaid sims. When the prepaid credit is gone it’s cheaper to use an new sim than top up the exisiting sim. Except you have to go though a activation portal to enable the sim. It’s easy. Pop in the new sim, visit telcos website or any non https valid domain press the active button and away you go.

She still can’t do it. And in a world where more and more people are using apps instead of browsers where preinstalled apps will just fail you are gonna not to cause even more issues.

BTs Smart Setup captive portal on their routers was one of the most annoying things they did. And when searching for it the top results are for turning the thing off. Why? Because it interferes with devices that can not display the portal, Smart TVs, Amazon TV sticks, Settop boxes, webcams, IoT toasters, etc.

While they haven’t removed it from their latest router they have had to make disabling it much easier than in previous versions.

With the number of end user devices on the market, I just don’t see them managing to pull it off by getting end users to install their cert.

But you touch on a point. You say that Chrome would have to just suck it up from Comcast. Now I’m not saying I disagree, but why would Comcast go though all that pain to get end users to install a root ca if they held so much power over Chrome (the largest browser my customers use) then why not just get the browser to install the cert anyway and save all that hassle with your end users. Think of the savings they would make not having to handle all those support calls.

Like I said. Possible? sure, practical today? I don’t believe so.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#74

Post by menckenjr »

actuator wrote: post #64

Unfortunately, in the US and Europe at least most people will care about this and even get a response. I think 4-5 years back when I was in one of the cities in which MTNL is there in India, ads were being served in the same way on MTNL. They were injecting an ad serving pop-up on every page served on HTTP. The worst thing was it sometimes used to show some sketchy virus ads also. I complained about it multiple times…

It strikes me that the best way to combat this might be in the browser itself - intercept and remove the offending javascript (or better, redirect its execution into a walled sandbox where it thinks it's setting cookies and downloading code) and remove it from the main page viewing stream.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#75

Post by hardlianotion »

This is the bit I find amazing:

> Comcast has my phone office number, my cell for texts, my email, and my home address, yet they choose to molest my requested web pages by injecting hundreds of lines of code.

[JL] The notice is typically sent after a customer ignores several emails. Perhaps some of those ended up in your spam folder?

So ignoring spam entitles you to this behaviour?

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#76

Post by raverbashing »

candiodari wrote: post #11

The thing that's so irritating about large telco's is not just that they're evil, but the casual stupidity of their actions, including their evil actions. I mean, look at the code. Look at the function of this code. Look at the business purpose of this code. Look at the security aspects of using this code. Look at the legal ramifications (why the hell is that LGPL thing up top there ?). Look at their internal communi…

> How can an organisation that executes this badly become this big ?

Lots of ads, undercut your competition by something like $1 and "new customer deals" and then shaft your customers after a while

The average customer just go to the store with the flashier lights (or the one which is more convenient)

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#77

Post by GlennS »

scrollaway wrote: post #27
cm2187 wrote: post #21

Earlier quoted context omitted.

I don’t think it is just telcos. It is amazing how scale, inertia, lack of accountability and bureaucracy dumbs down large corporations that mostly consist of smart educated people. A million Shakespeares typing on typewriters write no better than a monkey!

> A million Shakespeares typing on typewriters write no better than a monkey! I like it, although I think the analogy fails here. How about "An infinite amount of Shakespeares typing on the same typewriter will inevitably produce garbage"? :)

I wonder what Shakespeare would have thought of typewriters?

Would we have gotten twice as many plays out of him?

He was clearly slacking.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#78

Post by zAy0LfpBZLC8mAC »

betterunix2 wrote: post #72
regularfry wrote: post #42

Earlier quoted context omitted.

The argument is that it creates a derivative work. The right to create derivative works is separate to the right to distribute or reproduce the content, which is how Comcast is allowed to get the original website into customers' browsers. Comcast are playing into this interpretation by adding their own license to the code they're adding.

It would open a whole can of worms. What about adding MPLS headers to packets, or performing MSS clamping? Or what about the numerous physical layer protocols that add error correction? Or the consumer routers that have parental filters, ad blocking, etc.?

Putting a book into an envelope is not a copyright violation, and consumer routers don't redistribute to third parties.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#79

Post by tialaramex »

mtgx wrote: post #36
lsmod wrote: post #22

Earlier quoted context omitted.

"Must Only Be Used for Critical Service Notifications." [0] https://tools.ietf.org/html/rfc6108#section-3.1

> and is instead based in open IETF standards and open source applications. Why did the IETF ever agree to standardize this? It reminds me of their standardization of Cisco's "lawful intercept" router backdoor protocol. https://tools.ietf.org/html/rfc3924 https://www.blackhat.com/presentations/bh-dc-10/Cross_Tom/Bl... I guess this is what you get when the IETF literally has NSA agents as chairs of its groups. https:/…

You can publish any old crap. Microsoft's crappy file sharing protocol has an RFC. At least one of the ludicrous "IPv6 is crap, we should just use IPv4 but with bigger numbers" proposals has an RFC. [This can't work, the numbers in IPv4 are in defined bit-level structures, "just" having bigger numbers is nonsense without a new protocol]

From the IETF's point of view all this does is use up a few kB of storage in the RFC Editor servers, and hey, maybe someone will find it useful. It usually makes cranks or corporate types go away and stop wasting everybody's time.

If you're thinking "Wait, so how do I know if RFCs matter and I should care?" I have two answers

1. The pragmatic answer. If you're reading about an RFC because everybody does this and you need to do it too, then I guess it mattered after all. You can decide you don't care about RFC 822 and you'll use email headers starting with an exclamation mark and they'll be in the form of a list of headings and then a separate list of values. But your method won't interoperate with anybody else's, so you'll be talking to yourself.

2. The textbook answer. The IETF marks its Standards Track documents with their Standards Track status, e.g. "Internet Standard" or "Proposed Standard" (there are some legacy "Draft Standard" documents too).

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#80

Post by thinkingemote »

rplnt wrote: post #67
mseebach wrote: post #48

Earlier quoted context omitted.

They could, but they don't. Until they do, or imply in any way that they might, let's stick to the facts and leave wild, flailing speculation to reddit. Regardless of what an ISP might do, HTTPS everywhere is excellent advice.

Not HTTPS Everywhere, the extension, which has ridiculous system demands.

Perhaps you might like to suggest a replacement and or reasons for your statement?
Post reply on HN