Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast is injecting 400+ lines of JavaScript into web pages

forums.xfinity.com

Post reply on HN
Print view View original

171–180 of 498 posts

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#171

Post by csydas »

jlivingood wrote: post #144
csydas wrote: post #109

Earlier quoted context omitted.

I sincerely disagree, especially as per the report Comcast's own second level confirmed there was no need to replace the modem. It was an automated advertisement done in a very not good way; Comcast's own billing system notifies you of just about everything else; you can forward your billing statements and other such information to other emails, why not this? The reason everyone is freaking out is because they feel p…

> I sincerely disagree, especially as per the report Comcast's own second level confirmed there was no need to replace the modem. I am skeptical of this - maybe we made a mistake in telling the customer that. The people that are sent notifications are carefully checked to match the EOL/EOS modem criteria or speed mismatch criteria and would not be sent otherwise. It is sometimes the case that a customer has recently…

Well, thank you for the response, but I am not very satisfied with the answers.

The crux of disagreement is the method of delivery and the importance of the upgrade requiring this sort of injection. You write:

> Available alternatives are not great, such as using DPI everywhere, DNS modification (we use DNSSEC), or a walled garden (all service disrupted while in walled garden). These methods tend to be more costly and cause more disruption for customers.

I'm still not convinced as to why a phone call or an email would not suffice. What information is specifically being cited by customers as "information overload"? Why can this not simply be a notification as a part of the Xfinity main page? Why isn't an email that only has information on the EOL of a modem is less obstructive than yet another pop-up for users who are trained to ignore pop-ups?

The case for an injection isn't really made simply because other intrusive methods are more intrusive; the presentation of the message itself is just more information in a sea of information, and the criticality of the issue isn't sufficiently justified either. This is not the appropriate way of communicating information that has no such urgency. It's a very nice thing to phase out modems that are EOL, sure, I will grant that. But the information is not so urgent that it needs to be delivered right now or injected into the webpage. That is not something the ISP should be doing, which I suspect is another point of contention that will be had.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#172

Post by shrimp_emoji »

singlow wrote: post #145
w_t_payne wrote: post #127

I thought HTTPS was supposed to prevent this sort of man in the middle attack? (Or at least make it harder) -- and I thought that most websites used HTTPS these days... or am I misunderstanding? If they are able to do this, and are injecting JavaScript for something as low-return as online ads, then what is to prevent them from changing the news headlines on , or the stock ticker feed... How do we know that they aren…

HTTPS does prevent this. This can only be injected on non-secure connections.

Use HTTPSEverywhere on your browsers, and then enjoy the "You're close to your monthly limit!" pop-up on the Steam Store!

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#173

Post by pmorici »

AndyMcConachie wrote: post #143
falcolas wrote: post #131

Earlier quoted context omitted.

Not to disagree with any of the other points, but it's always worth remembering that any physical utility in the US has approximately 16x more land to cover than France. Not to mention the greater variety in climates (which do impact utilities). Some cities only have one existing fiber line even coming into them, usually owned by one of the local duopolies (typically phone, since they originally were required to offe…

Then why do Americans in large urban centers not have greater choice of ISPs? If it's all about physical distance, why is there still no competition in dense areas? I live in Washington DC, in the city, and I only really have one choice where I live, Comcast.

Cities grant franchise rights and determine rates charged for access to city poles and cable vaults.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#175

Post by benbenolson »

Sharlin wrote: post #37
candiodari wrote: post #11

The thing that's so irritating about large telco's is not just that they're evil, but the casual stupidity of their actions, including their evil actions. I mean, look at the code. Look at the function of this code. Look at the business purpose of this code. Look at the security aspects of using this code. Look at the legal ramifications (why the hell is that LGPL thing up top there ?). Look at their internal communi…

> I mean, I know the answer is "government" and government making them a monopoly, but still. WTF. Eh, telco infrastructure is a natural monopoly. No government needed for that.

No, it's not a "natural monopoly." The primary issue right now is getting the legal right to use this infrastructure, which is protected by local city and county governments. Most of these local governments simply choose to not allow other companies to move in.

https://www.wired.com/2013/07/we-need-to-stop-focusing-on-ju...

https://tech.slashdot.org/story/17/04/12/0345217/tennessee-c...

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#176

Post by revelation »

jlivingood wrote: post #162
exikyut wrote: post #10

Earlier quoted context omitted.

Yes, indeed it was. It's a fairly standard, unsurprising response for this situation; doesn't try to be defensive, doesn't try to provoke. [Edit: I'm horribly under-perceptive, after reading other comments I see I'm a bit off.] But... this bit. > ... [JL] This is our web notification system, documented in RFC 6108 https://tools.ietf.org/html/rfc6108 , which has been in place for many years now. ... Oh, interesting, w…

An RFC is not always a standard - often they are simply 'informational'. For us, when we wrote the document, it was a way to document as transparently as possible how the system worked so that folks would not need to speculate about it and for us to explain the rationale and alternatives considered. This seemed to me at the time far better than being evasive about it. And a request for comment is often a way to solic…

    In contrast to DPI, this document describes a system
   that does not rely upon DPI
You decided to document your ignorance through an RFC? You can't be serious.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#177

Post by throwanem »

candiodari wrote: post #11

The thing that's so irritating about large telco's is not just that they're evil, but the casual stupidity of their actions, including their evil actions. I mean, look at the code. Look at the function of this code. Look at the business purpose of this code. Look at the security aspects of using this code. Look at the legal ramifications (why the hell is that LGPL thing up top there ?). Look at their internal communi…

You're assuming it was written any time in the last, oh, decade or more? That's surprising. Perhaps you've never spent time in a cost center far outside the profit centers of a large enterprise, where things that work are left alone to do so, because you're not going to get investment in replacing them or bringing them up to date with modern best practices, because they work.

I mean, there are weekend hacks of similar age and quality, with my name on them, that I know are still in active service. Because, for all their myriad other faults, they mostly work, and everyone who works with them is used to using them and to dealing with the occasional cases in which they misbehave. These are not things which anyone rebuilds just for the sake of it. So they go on being used until they stop working entirely, and the the business replaces them with something else.

Whether or not that's a sensible way to go about things is an open question, if you like. I don't think it is, because these aren't the sorts of things which cripple a business if they misfire - or make much impact even if they don't. So investing heavily in them would seem like a waste of money, though perhaps you disagree. But the world need not be mad for this to be the way of things.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#178

Post by Aloha »

throwanem wrote: post #165
jlivingood wrote: post #121

Earlier quoted context omitted.

> Exactly. And the response, "we're not trying to sell you a modem, we're just encouraging you to strongly consider buying a new one" is such a hair-splittingly asinine response considering the rather serious breach of trust posed by the notification system. Well, what I meant (within the response length constraints of Twitter) was that we're not saying you can only buy it from us. Just that the customer needs to buy…

Why traffic injection instead of mail pieces? I mean, I open all of mine, even the 75%+ that are upsells I don't want, on the off chance one of them will tell me something I need to know. And if Comcast can afford to send that much junk mail, I should tend to think Comcast can afford to send one or two, or five, mail pieces that carry a warning like ACTION REQUIRED TO MAINTAIN SERVICE on the envelope, to those of who…

because traffic injection is free, postal mail costs money.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#180

Post by djrogers »

pas wrote: post #63
Hendrikto wrote: post #41

Earlier quoted context omitted.

Bs. Heard about the 1996 telecommunicatins act? The government payed for their monopoly, and now it lets them keep it and not share it.

They have to share the last mile infrastructure with new entrants. And the FCC can preempt local and state level requirements to help new entrants. The current problems are that a) since Trump the FCC is shit, b) local municipalities "vowing" to not enter the market (and others have no incentive). See these for b: - https://arstechnica.com/tech-policy/2017/11/voters-reject-ca... - https://www.wired.com/2013/07/we-nee…

> The current problems are that a) since Trump the FCC is $#\¥

Oh please, he’s been in office less than a year - none of this amazing ‘sharing’ happened under the previous administration either. It’s totally understandable to have (in my case many) disagreements with the Presidents and their policies, but this knee-jerk habit of blaming whoever is currently in office for everything because he’s not on our team is counterproductive.

Post reply on HN