Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast is injecting 400+ lines of JavaScript into web pages

forums.xfinity.com

Post reply on HN
Print view View original

441–450 of 498 posts

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#441

Post by enzanki_ars »

cookiecaper wrote: post #432
aaomidi wrote: post #312

Earlier quoted context omitted.

TBH what kind of game doesn't use https...

HTTPS is not free. Game developers are usually very performance-sensitive. If you're not transmitting any sensitive data, it may seem appealing to forgo the seemingly-needless HTTPS overhead.

Please cite your sources on the speed comparison. See: https://istlsfastyet.com/

Also, most games I have played seem to use HTTPS. The only time it is used is when the game does not need an instant result, in which case they use HTTP or HTTPs. Most of the times, this is in the main menu or similar. Doing this makes it even harder (assuming they use certificate pinning) for users to change the values returns to gain any advantage on their client.

Any part of the game that needs speed should be using a UDP based protocol.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#442

Post by sethrin »

marklyon wrote: post #365
sethrin wrote: post #329

Earlier quoted context omitted.

As far as I am aware, it is possible to disable the public 'xfinitywifi' hotspot on all Comcast modems which provide this feature (I had a stint as a TSR relatively recently). Further, I believe this is a user-configurable setting on all CC modems. I personally have this feature disabled on my Arris 1682G, and this should be their most common model in most regions.

I was told I could not disable their hotspot, nor could I set my own DNS servers. Since I kept having connectivity issues due to Comcast’s DNS being flaky, and not wanting to manually configire every client, I bought my own modem and wireless setup.

As the other person has said, they have a FAQ for disabling the hotspot. I additionally set my modem to bridge mode in order to use a more capable router. It does look like Comcast mandates the use of their DNS whenever possible, and I'm sure that I bothered to configure an alternative because of reliability issues as well.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#443

Post by rsingel »

jachee wrote: post #428
Corrado wrote: post #422

Earlier quoted context omitted.

Well, if it weren't I would connect everything I own to that guest access point and bypass my cap completely. Or perhaps the speed of that connection is very slow. But then it wouldn't be much use to other customers either.

When you connect to an 'xfinitywifi' SSID, you have to authenticate with your comcast credentials. The usage is then tracked as yours, not whose-ever hotspot you hit.

Last I saw, this wasn't actually being counted vs. datacaps for either the roaming user or the host.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#444

Post by mr_toad »

w_t_payne wrote: post #127

I thought HTTPS was supposed to prevent this sort of man in the middle attack? (Or at least make it harder) -- and I thought that most websites used HTTPS these days... or am I misunderstanding? If they are able to do this, and are injecting JavaScript for something as low-return as online ads, then what is to prevent them from changing the news headlines on , or the stock ticker feed... How do we know that they aren…

A VPN will prevent this.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#445

Post by mr_toad »

raverbashing wrote: post #76
candiodari wrote: post #11

The thing that's so irritating about large telco's is not just that they're evil, but the casual stupidity of their actions, including their evil actions. I mean, look at the code. Look at the function of this code. Look at the business purpose of this code. Look at the security aspects of using this code. Look at the legal ramifications (why the hell is that LGPL thing up top there ?). Look at their internal communi…

> How can an organisation that executes this badly become this big ? Lots of ads, undercut your competition by something like $1 and "new customer deals" and then shaft your customers after a while The average customer just go to the store with the flashier lights (or the one which is more convenient)

https://en.wikipedia.org/wiki/Natural_monopoly

"A natural monopoly is a monopoly in an industry in which high infrastructural costs and other barriers to entry relative to the size of the market give the largest supplier in an industry, often the first supplier in a market, an overwhelming advantage over potential competitors."

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#446

Post by aptwebapps »

pvg wrote: post #417
kasey_junk wrote: post #371

Earlier quoted context omitted.

I didn’t mean to imply that the web should follow those style guides (and said as much). I was refuting his claim that no one expects that quotes imply an assertion of verbatim quote. I certainly default to assuming it does and in many contexts it is an explicit rule.

I was refuting his claim that no one expects that quotes imply an assertion of verbatim quote. I don't understand how you've refuted that while also saying they sometimes don't. Are we arguing about contexts here? My claim is almost trivial - nobody reasonably familiar with English thinks quotes imply a verbatim quote. That's just not what quotes are for.

You said no one expects that and he pointed out the style guides do. So some people do. In addition to the style guides, a couple people here have said that they do as well (which is why we're arguing). I'm another. Regardless of whether the majority think this way, we can safely say that some people do.

Getting back to the actual point, in formal writing, quotation marks are definitely considered to delimit actual quotes. That's where their name comes from and that's their purpose. If you want to paraphrase or otherwise interpret what was said you just work it in without quotes.

Personally, I relax my expectations in informal contexts if I don't know the person or their writing habits, but I'm just being pragmatic. In other words, the rule doesn't change, it's just not always followed.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#447

Post by aptwebapps »

pvg wrote: post #431
kasey_junk wrote: post #429

Earlier quoted context omitted.

I guess I’m far out of the mainstream then. If you put quotes around something and attribute it to someone or some text, I assume you are asserting a verbatim quote, either in the context of web forums, business communications or more formal writing covered by a style guide. In the context of fiction, if you put quotes around something I assume it is to declare that the character is saying exactly what is quoted. Tha…

I appreciate your good nature in taking the time to engage in this silliness but I have a hard time believing your high school teacher or anyone else taught you that. The wikipedia page on it: "In English writing, quotation marks are placed in pairs around a word or phrase to indicate: Quotation or direct speech: Carol said "Go ahead" when I asked her if the launcher was ready. Mention in another work of a title of a…

Respectfully, I think you should read the Wikipedia entry for 'direct speech'.

https://en.wikipedia.org/wiki/Direct_speech

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#448

Post by hexane360 »

eponeponepon wrote: post #110
mythrwy wrote: post #102

Earlier quoted context omitted.

"Good" as in morally upright? (in which case true). or "Good" as in technically competent? (in which case untrue).

These are not separate concerns. Morality is a necessary part of competence.

If there's one belief I think needs to be more widespread in technical circles, it's this. Good engineers recognize the impact of their engineering, and engineer for social good. We don't remember programmers because of how good their programming was, we remember them because of how good the programs they made were.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#449

Post by Bud »

brians wrote: post #166
trappist wrote: post #107

Earlier quoted context omitted.

It might be easier to convince me ISPs were a natural monopoly if they weren't also a legally protected monopoly where they are, and generally have plenty of competition where they aren't.

I’m not sure that’s evidence against their natural monopoly position. It might be that we’re in a world where in some places, it’s plausible to have two ISPs, and in many it’s not—but if two try, they’ll both fail to get enough people to be profitable. Then any sane provider wants to demand exclusivity as the cost of pulling fiber through a community, and unhappily acknowledges that they’ll have to cover all of their…

This is laughable in light of Comcast warring against net neutrality and lying about it to customers and everyone else.

Laughable.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#450

Post by [deleted] »

enzanki_ars wrote: post #441
cookiecaper wrote: post #432

Earlier quoted context omitted.

HTTPS is not free. Game developers are usually very performance-sensitive. If you're not transmitting any sensitive data, it may seem appealing to forgo the seemingly-needless HTTPS overhead.

Please cite your sources on the speed comparison. See: https://istlsfastyet.com/ Also, most games I have played seem to use HTTPS. The only time it is used is when the game does not need an instant result, in which case they use HTTP or HTTPs. Most of the times, this is in the main menu or similar. Doing this makes it even harder (assuming they use certificate pinning) for users to change the values returns to gain a…

[deleted]
Post reply on HN