Comcast injecting JS • Hacker News Board

Re: Comcast injecting JS

#11

Post by mikeryan » Tue, Apr 02, 2013, 9:42 PM UTC

jimktrains2 wrote: post #8

mikeryan wrote: post #5

I'm torn. This seems bad, but the warning (exceeding your bandwidth quota) seems valuable. I can't think of another, better way to message this.

Email? Text?

That could work, but I'm guessing often this might not be the account owner (kids?) racking up the bandwidth.

Re: Comcast injecting JS

#12

Post by Merrack » Tue, Apr 02, 2013, 9:43 PM UTC

Cox is doing something very similar. It's somewhat disconcerting to see JS like this ending up in pages, especially since they didn't get the URL right and a future version of this script could conceivably allow someone to serve malicious content to every Comcast subscriber, injected directly into your page.

Re: Comcast injecting JS

#13

Post by nthitz » Tue, Apr 02, 2013, 9:43 PM UTC

Better hope you aren't naming any of your javascript variables similarly..

Re: Comcast injecting JS

#14

Post by phene » Tue, Apr 02, 2013, 9:43 PM UTC

mschuster91 wrote: post #9

OMG LOL. Have they never heard about jQuery? Christ, they could have made the code so much more elegant.

I hope you are kidding.

Re: Comcast injecting JS

#15

Post by recursive » Tue, Apr 02, 2013, 9:44 PM UTC

mschuster91 wrote: post #9

OMG LOL. Have they never heard about jQuery? Christ, they could have made the code so much more elegant.

So you think they should inject a third-party dependency instead of just some inline js? And that would make it more elegant?

Re: Comcast injecting JS

#16

Post by iguana » Tue, Apr 02, 2013, 9:47 PM UTC

They're also violating this patent:

http://www.google.com/patents/US20110264729

Which I can tell you for certain that they don't own. Bastards.

Re: Comcast injecting JS

#17

Post by jimktrains2 » Tue, Apr 02, 2013, 9:48 PM UTC

mikeryan wrote: post #11

jimktrains2 wrote: post #8

Earlier quoted context omitted.

Email? Text?

That could work, but I'm guessing often this might not be the account owner (kids?) racking up the bandwidth.

Doesn't matter; it's the account owner who is responsible for it.

Injecting into a webpage is unacceptable.

Re: Comcast injecting JS

#18

Post by minimaxir » Tue, Apr 02, 2013, 9:48 PM UTC

Wait, does the Detect Browser script actually work for browsers made after 2001? I'd hope that Comcast's customers aren't using Netscape 6...

Re: Comcast injecting JS

#19

Post by mschuster91 » Tue, Apr 02, 2013, 9:49 PM UTC

recursive wrote: post #15

mschuster91 wrote: post #9

OMG LOL. Have they never heard about jQuery? Christ, they could have made the code so much more elegant.

So you think they should inject a third-party dependency instead of just some inline js? And that would make it more elegant?

They could just inject it inline. No problem there.

The whole document.write block 27-51 (possibly the CSS-block too, but I'm not sure about this) could be written far more elegant in jQuery.

But the real saving is that "drag and drop" code - jQuery would abstract all that isIE/isNS crap from them.

Re: Comcast injecting JS

#20

Post by BoyWizard » Tue, Apr 02, 2013, 9:49 PM UTC

mikeryan wrote: post #11

jimktrains2 wrote: post #8

Earlier quoted context omitted.

Email? Text?

That could work, but I'm guessing often this might not be the account owner (kids?) racking up the bandwidth.

They have a comment in the script

  // Intended use is to display browser notifications for critical and time sensitive alerts.

I imagine you can rack up a fair amount of usage before checking emails, only to find you went over your cap a few hours ago.