Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast is injecting 400+ lines of JavaScript into web pages

forums.xfinity.com

Post reply on HN
Print view View original

451–460 of 498 posts

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#451

Post by pas »

djrogers wrote: post #180
pas wrote: post #63

Earlier quoted context omitted.

They have to share the last mile infrastructure with new entrants. And the FCC can preempt local and state level requirements to help new entrants. The current problems are that a) since Trump the FCC is shit, b) local municipalities "vowing" to not enter the market (and others have no incentive). See these for b: - https://arstechnica.com/tech-policy/2017/11/voters-reject-ca... - https://www.wired.com/2013/07/we-nee…

> The current problems are that a) since Trump the FCC is $#\¥ Oh please, he’s been in office less than a year - none of this amazing ‘sharing’ happened under the previous administration either. It’s totally understandable to have (in my case many) disagreements with the Presidents and their policies, but this knee-jerk habit of blaming whoever is currently in office for everything because he’s not on our team is cou…

> blaming ... for everything

Not for everything.

I blamed O'dog for the fucking shady counterproductive NSA practices that he allowed to continue.

The Obama DoJ took a dump regularly on whistleblowers.

And the infamous CIA kill-by-drone program.

And those are just the obvious big ticket items.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#452

Post by frik »

freneticfox wrote: post #298
w_t_payne wrote: post #127

I thought HTTPS was supposed to prevent this sort of man in the middle attack? (Or at least make it harder) -- and I thought that most websites used HTTPS these days... or am I misunderstanding? If they are able to do this, and are injecting JavaScript for something as low-return as online ads, then what is to prevent them from changing the news headlines on , or the stock ticker feed... How do we know that they aren…

The injection is currently for non-HTTPS only, but I can easily see this situation evolving for the worse as HTTPS becomes increasingly the default. What will happen is someone at Comcast will notice that their injections aren't happening often enough anymore due to HTTPS adoption. Someone at Comcast will suggest implementing a MITM TLS proxy service to get things working again. Someone else at Comcast will note that…

> The injection is currently for non-HTTPS only, but I can easily see this situation evolving for the worse as HTTPS becomes increasingly the default.

That's my fear too. This has to be handled by other means and has to stop. If everything is HTTPS you can be sure it gets very unsecure by design, as everyone will upgrade its capabilities and inject you certs, than we would need a new more secure protocol.

Why is email still unsecure and sent in plain text? Why is there hype for HTTPS but everyone is fine with sending mail in plain text yet we have SMIME, etc and no one is using or supporting it.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#453

Post by skate22 »

phil21 wrote: post #388
StudentStuff wrote: post #350

Earlier quoted context omitted.

Verizon has poor service in many places, eg Hawaii or when roaming up near the Canadian border. They still haven't figured out how to support international roaming reliably, half my family was w/o service for our few hours in Canada. Service in SoCal seems to be one of their last strongholds, but even then voice calls sound like a robot.

Verizon is far and away the market leader in international roaming and it isn't even remotely close. At least in my experience. Source: Tried to get away from VZW for a decade now - international roaming always being the ultimate decider. Curious who you've found to be better. Verizon has always been that shit-tier company ran by borderline criminals which happens to have the far superior network and hard product.

With the highest priced international sprint service i had terrible connection in Paris several months ago. I would go 30 mins to an hour with no connection frequently.

At home (Boston Ma) sprint is good enough to online game and stream at the same time. I lost my comcast connection for several hours recently, and tethering to my phone resulted in less latency...

Edit: This is on Sprint's unlimited plan (around $50 a month for 1 line, $25 per line for 4 lines)

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#454

Post by notyourday »

virtuallynathan wrote: post #437
notyourday wrote: post #357

Earlier quoted context omitted.

Comcast does not provide any speed on residential lines that DOCIS 3.x cannot accommodate. It is like requiring Formula car to drive on a gravel road in Alaska.

Different modems can use different numbers of DOCSIS channels. A 4x4 DOCSIS 3 modem is only capable of, at most, 150Mbps and on average 75-100Mbps. A new DOCSIS 3.1 model can do >1.2Gbps.

Yeah, no.

https://en.wikipedia.org/wiki/DOCSIS

3.0 spec does up to 1.2Gbit/sec, just like Comcast. You know up to 200Mbit/sec, which is more like 20 because of all the "extreme complexities of the internet service".

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#455

Post by chopin »

cookiecaper wrote: post #432
aaomidi wrote: post #312

Earlier quoted context omitted.

TBH what kind of game doesn't use https...

HTTPS is not free. Game developers are usually very performance-sensitive. If you're not transmitting any sensitive data, it may seem appealing to forgo the seemingly-needless HTTPS overhead.

If your game is executing js (as for the example given by the GP), you are transmitting sensitive data. In that scenario not only confidentiality but even more integrity of the data is important.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#456

Post by JadeNB »

Pyxl101 wrote: post #398
marklyon wrote: post #365

Earlier quoted context omitted.

I was told I could not disable their hotspot, nor could I set my own DNS servers. Since I kept having connectivity issues due to Comcast’s DNS being flaky, and not wanting to manually configire every client, I bought my own modem and wireless setup.

You can disable the hotspot and use your own DNS servers if you want. The ability to disable the hotspot is documented in the public FAQ (Google: "XFINITY WiFi Home Hotspots FAQs"). I've used my own DNS servers before. I have no problem making DNS queries to 8.8.8.8, and in fact I switched my PC to use it one time when Comcast DNS was down.

What's the point of giving Google instructions instead of just linking https://www.xfinity.com/support/articles/disable-xfinity-wif... ?

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#457

Post by TheRealDunkirk »

brandonbloom wrote: post #367
jlivingood wrote: post #112

Earlier quoted context omitted.

> Although I disagree with Comcast's method and categorization, it would be interesting to learn what modem the OP was using. We start telling customers that a modem needs to be upgraded when one of two things happen: either they are about to or just had a speed upgrade that their modem cannot support or the modem has gone end-of-life (EOL) from the vendor. In the former case, if the device is leased, you are send a…

As an (unwilling) Comcast user, I purchased my own modem because your rental rates are preposterous. However, I wish I didn't have to think about this at all. If you force me to upgrade a modem I've purchased, I'll be very annoyed by the unanticipated cost. I get that's problematic for your modernization efforts, but in that case: eliminate modem rental fees. Bake the fees in to the standard cost of the service and d…

> I get that's problematic for your modernization efforts, but in that case: eliminate modem rental fees. Bake the fees in to the standard cost of the service and don't let customers use their own equipment.

I love how it's in the interests of public companies to brag about how successful they are. When I see a comment like this, I like to checkout the most recent 10K. According to Comcast's stated figures, they made $8.7 BILLION last year. So, they're doing pretty well. Now, obviously, they can't just give the modems away, but if they would at least STOP BILLING THE CUSTOMER for a leased modem after their costs have been recouped, that would be a HUGE public-relations win.

If we all could buy the modem of our choice, over time, say, amortized over the length of your contract, and then RELIABLY stop getting billed for it, I'd LOVE to just buy it through them. I'd argue that the reduced support costs for NOT BEING RENT-A-CENTER JERKS about the modems would save them a lot of money in the long run.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#458

Post by exabrial »

Declanomous wrote: post #266

I'm annoyed by this on several levels. The biggest issue is that I'm using an Arris SB 6121 and I'm getting notifications that my modem is EOL. However, the SB6121 is listed as a supported modem for my speed level on their supported modems page. If I go to their supported modem page, I literally get a page where my current modem is shown as not supported, and the exact same modem is shown next to it as "supported." I…

Switch isps?

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#460

Post by TheRealDunkirk »

cookiecaper wrote: post #440
mcherm wrote: post #268

Earlier quoted context omitted.

> When reading about Comcast I was always wondering why they have no competition when everyone who comments is complaining. Suppose you were a major company with big dollars to spend on offering internet service... someone like Google, for example. Then suppose you wanted to provide service in Louisville, Kentucky. How many years do you think it would take to get permission to attach your lines to the existing teleph…

I think this is really a critical thing to get integrated into the American public dialogue. Pro-business and pro-competition does not mean zero governmental oversight or regulation. My opinion is that if there isn't substantial churn or upheaval in the market at least a couple of times per decade, there is something broken in the market, and we should be looking at what kind of actions would be useful to allow fresh…

You correctly call out "copyright" as a problem in the free market, then go on to blame Republicans for the status quo, when it was the entertainment industry and THEIR captured legislators -- the Democrats -- which gave us the DMCA, which has been used as one of the biggest hammers to prevent competition ever conceived. So please don't single out conservatives for giving us the monopolized internet we have now. Both sides are to blame, in their own ways. Unless we, as a country, stop making these sorts of issues tribal, we're never going to fix them.
Post reply on HN