Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast is injecting 400+ lines of JavaScript into web pages

forums.xfinity.com

Post reply on HN
Print view View original

291–300 of 498 posts

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#291

Post by throwahey »

Declanomous wrote: post #266

I'm annoyed by this on several levels. The biggest issue is that I'm using an Arris SB 6121 and I'm getting notifications that my modem is EOL. However, the SB6121 is listed as a supported modem for my speed level on their supported modems page. If I go to their supported modem page, I literally get a page where my current modem is shown as not supported, and the exact same modem is shown next to it as "supported." I…

There is a reason they are doing this. After signing up for Xfinity I noticed that the modem we were leasing was broadcasting a public access point with no way to disable it. I purchased my own modem immediately. Then some time later they rolled out their mobile services, which you guessed it, rely’s on those open access points and Sprint as a fall-back. So now customers are paying monthly to host Xfinity mobile services.

I will admit that it is clever, but this should be transparent and customers should not be subsidizing the cost.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#292

Post by pvg »

tptacek wrote: post #277
glenstein wrote: post #192

Earlier quoted context omitted.

My "quote" isn't significantly different from what was actually said, in fact hews extremely closely to it, and is designed for rhetorical purpose of making clear how small a distinction is being relied upon in order to claim the statement is something other than a request for you to buy a new modem. Moreover there's nothing in the guidelines about "making up quotes" (which again isn't a reasonable interpretation of…

If you're rewording something someone else said, even if you're keeping it very close to the original words, don't use quotation marks. Quotes say "this is literally what was said". I got bit by this a bunch when I first got on HN; it was surprising to me how seriously it was taken. But it is, and it's not hard to work around.

That's a weird HN-ism, though, not how writing or paraphrasing works anywhere else. The goal is understandable and laudable but 'redefining the meaning of quotes' is a thing only hardcore lispers can love.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#293

Post by Balgair »

When folks are getting a new modem via this process, are they signing up for a new contract? What does that contract say, in reference to the issues that going on with NN? Might this perhaps be a way to get people to sign new contracts in preparation for a change to NN being more favorable to the ISPs?

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#294

Post by jlivingood »

Declanomous wrote: post #266

I'm annoyed by this on several levels. The biggest issue is that I'm using an Arris SB 6121 and I'm getting notifications that my modem is EOL. However, the SB6121 is listed as a supported modem for my speed level on their supported modems page. If I go to their supported modem page, I literally get a page where my current modem is shown as not supported, and the exact same modem is shown next to it as "supported." I…

> edit: Proof https://imgur.com/lzKBkMs

If you look at the far right device you see a non-EOL SB6121. The one on the left that is EOL is the leased one, and the retail one is still allowed. I'm not sure if you have a leased device or retail device.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#295

Post by ksk »

regularfry wrote: post #42
Buge wrote: post #23

Earlier quoted context omitted.

How is it copyright violation? If this is copyright violation, is it copyright violation of Comcast allowing you to download a file off the internet?

The argument is that it creates a derivative work. The right to create derivative works is separate to the right to distribute or reproduce the content, which is how Comcast is allowed to get the original website into customers' browsers. Comcast are playing into this interpretation by adding their own license to the code they're adding.

Yeah, IMO this would be equivalent to a pass-through web-proxy that removed content (such as ads).

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#296

Post by jlivingood »

hackmiester wrote: post #258
zwily wrote: post #237

Earlier quoted context omitted.

They do say they try to email you a bunch of times first... Email seems like a decent enough alternate channel.

They emailed my Comcast.net address, which I didn't even know I had.

> They emailed my Comcast.net address, which I didn't even know I had.

I recommend you add your primary email address. You can do this via the self-service portal.

Go to https://customer.xfinity.com/#/settings/account under Account / Settings / Contact Information. IIRC you are sent a confirmation email you have to act on before it takes effect.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#297

Post by jakeogh »

Brybry wrote: post #231

Comcast is not alone in this. Cox Communications has been injecting code into HTTP traffic for years. I think sometime around 2008 I first saw them do it (I noticed NoScript blocking a script on a page that it wouldn't normally). If I remember correctly, following it to its source hinted that it was a test for some alert system. In 2012 I saw them injecting a script to notify people that their email servers were down…

They did that to me a few months ago. I called up and canceled my decade old ~$90/mo acct on the spot. Tethered to 4G, works fine.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#298

Post by freneticfox »

w_t_payne wrote: post #127

I thought HTTPS was supposed to prevent this sort of man in the middle attack? (Or at least make it harder) -- and I thought that most websites used HTTPS these days... or am I misunderstanding? If they are able to do this, and are injecting JavaScript for something as low-return as online ads, then what is to prevent them from changing the news headlines on , or the stock ticker feed... How do we know that they aren…

The injection is currently for non-HTTPS only, but I can easily see this situation evolving for the worse as HTTPS becomes increasingly the default.

What will happen is someone at Comcast will notice that their injections aren't happening often enough anymore due to HTTPS adoption. Someone at Comcast will suggest implementing a MITM TLS proxy service to get things working again. Someone else at Comcast will note that wouldn't actually work because they can't install fake root certs on every client device...

Then Comcast will basically switch to a model where the HTTPS interception is "optional" (requiring the client-side use the proxy explicitly), but they'll start shipping some kind of "Comcast Setup" executable (or mobile app) users are supposed to run on their client laptops/phones so that they can get these important service notices, which turns on the client-side use of the proxy and installs the fake root certs. Geeks may not install it, but the bulk of their customers will, and everyone loses. I don't think broadband consumers are aware of the fact that they shouldn't trust software provided by their ISP...

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#299

Post by legohead »

jlivingood wrote: post #112
metaphor wrote: post #25

J. Livingood (a Comcast VP) responded to the OP: > [JL] We are not trying to sell you a new one. If you own your modem we're informing you that it is either end of life (EOL) or that you are about to get a speed upgrade that the modem will be unable to deliver. Incidentally, Livingood is a co-author of IETF RFC 6108, which he has conveniently linked. From the RFC's general requirements numero uno: > R3.1.1. Must Only…

> Although I disagree with Comcast's method and categorization, it would be interesting to learn what modem the OP was using. We start telling customers that a modem needs to be upgraded when one of two things happen: either they are about to or just had a speed upgrade that their modem cannot support or the modem has gone end-of-life (EOL) from the vendor. In the former case, if the device is leased, you are send a…

You should not interfere with a customer's traffic they are paying for. If you need to contact them for a critical issue, then call, email, or snail mail. You risk disrupting their experience, and in some cases the customer may not even be able to receive your critical message. Does your JS injection work for customers who have JS disabled?

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#300

Post by lucio »

jlivingood wrote: post #294
Declanomous wrote: post #266

I'm annoyed by this on several levels. The biggest issue is that I'm using an Arris SB 6121 and I'm getting notifications that my modem is EOL. However, the SB6121 is listed as a supported modem for my speed level on their supported modems page. If I go to their supported modem page, I literally get a page where my current modem is shown as not supported, and the exact same modem is shown next to it as "supported." I…

> edit: Proof https://imgur.com/lzKBkMs If you look at the far right device you see a non-EOL SB6121. The one on the left that is EOL is the leased one, and the retail one is still allowed. I'm not sure if you have a leased device or retail device.

Is there any technical difference between the two?
Post reply on HN