Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast is injecting 400+ lines of JavaScript into web pages

forums.xfinity.com

Post reply on HN
Print view View original

211–220 of 498 posts

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#211

Post by nerdponx »

AndyMcConachie wrote: post #143
falcolas wrote: post #131

Earlier quoted context omitted.

Not to disagree with any of the other points, but it's always worth remembering that any physical utility in the US has approximately 16x more land to cover than France. Not to mention the greater variety in climates (which do impact utilities). Some cities only have one existing fiber line even coming into them, usually owned by one of the local duopolies (typically phone, since they originally were required to offe…

Then why do Americans in large urban centers not have greater choice of ISPs? If it's all about physical distance, why is there still no competition in dense areas? I live in Washington DC, in the city, and I only really have one choice where I live, Comcast.

It's spotty. I know in DC they have RCN in some areas, which is a high-quality option.

In NYC, in one apartment I had 3 or 4 differennt ISPs to choose from, RCN included. In my current place, I only have one.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#214

Post by tzs »

sumeno wrote: post #123
jlivingood wrote: post #112

Earlier quoted context omitted.

> Although I disagree with Comcast's method and categorization, it would be interesting to learn what modem the OP was using. We start telling customers that a modem needs to be upgraded when one of two things happen: either they are about to or just had a speed upgrade that their modem cannot support or the modem has gone end-of-life (EOL) from the vendor. In the former case, if the device is leased, you are send a…

If only there were some way to notify your users that wasn't so scummy... like via email or regular mail

Regular mail, yes. Email, though, is largely just a waste of time.

Way too much non-spam disappears down overeager spam filters, which most people only check if they are specifically expecting some particular mail and it does not show up as expected--and even then many won't check their filters.

An ISP could white list their own mail in their spam filters but that would only help with the customers who use their ISP provided email. A lot of people use third party email providers instead and never use their ISP email.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#215

Post by yjftsjthsd-h »

thisacctforreal wrote: post #197
mholt wrote: post #164

Earlier quoted context omitted.

As the other comment said, HTTPS does prevent this, and this only happens on HTTP pages. > Do we, as a community, have any mechanism to detect if these sorts of attacks are occurring? Yes, Caddy can detect whether a connection is being MITM'ed: https://caddyserver.com/docs/mitm-detection

As that page describes, Caddy's detection only works on SSL-served pages, by comparing the TLS Handshake, to the expected TLS Handshake pattern of the advertised User-Agent.

Ironically, if you're using Caddy, I struggle to think why you wouldn't already be pure HTTPS.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#216

Post by yjftsjthsd-h »

shrimp_emoji wrote: post #172
singlow wrote: post #145

Earlier quoted context omitted.

HTTPS does prevent this. This can only be injected on non-secure connections.

Use HTTPSEverywhere on your browsers, and then enjoy the "You're close to your monthly limit!" pop-up on the Steam Store!

What?

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#217

Post by freen »

In my humble opinion, there is no situation that would merit javascript injection that would not rise to the importance of fully disabling someone's internet connection, if only temporarily.

Case #1: Malware. Full disconnect, redirect to explanation.

Case #2: EOL hardware causing interference. Full disconnect, redirect to explanation, method to rectify.

Case #3: Consumer not getting what they paid for: email me/snailmail.

I think the RFC makes it clear: this should not be for trivial notifications, only critical notifications, and if it is truly critical, it should disable the entirety of the connectivity until the user acknowledges/remedies/whatever.

I call shenanigans.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#218

Post by mholt »

thisacctforreal wrote: post #197
mholt wrote: post #164

Earlier quoted context omitted.

As the other comment said, HTTPS does prevent this, and this only happens on HTTP pages. > Do we, as a community, have any mechanism to detect if these sorts of attacks are occurring? Yes, Caddy can detect whether a connection is being MITM'ed: https://caddyserver.com/docs/mitm-detection

As that page describes, Caddy's detection only works on SSL-served pages, by comparing the TLS Handshake, to the expected TLS Handshake pattern of the advertised User-Agent.

Yes, and it is fair to assume that a page served over HTTP is not trustworthy in any case.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#219

Post by parenthephobia »

pmorici wrote: post #173
AndyMcConachie wrote: post #143

Earlier quoted context omitted.

Then why do Americans in large urban centers not have greater choice of ISPs? If it's all about physical distance, why is there still no competition in dense areas? I live in Washington DC, in the city, and I only really have one choice where I live, Comcast.

Cities grant franchise rights and determine rates charged for access to city poles and cable vaults.

Incumbent ISPs lobby local govermment and sue would-be competitors to ensure the competition are only offered access on less favourable terms.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#220

Post by jasonlotito »

sumeno wrote: post #123
jlivingood wrote: post #112

Earlier quoted context omitted.

> Although I disagree with Comcast's method and categorization, it would be interesting to learn what modem the OP was using. We start telling customers that a modem needs to be upgraded when one of two things happen: either they are about to or just had a speed upgrade that their modem cannot support or the modem has gone end-of-life (EOL) from the vendor. In the former case, if the device is leased, you are send a…

If only there were some way to notify your users that wasn't so scummy... like via email or regular mail

It was noted in the thread that other attempts are made first.
Post reply on HN