Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast injecting JS

gist.github.com

Post reply on HN
Print view View original

41–50 of 288 posts

Re: Comcast injecting JS

#41

Post by DanBC »

passionfruit wrote: post #24
mikeryan wrote: post #5

I'm torn. This seems bad, but the warning (exceeding your bandwidth quota) seems valuable. I can't think of another, better way to message this.

Here are some other ways. 1. They could email you. 2. They could send you a SMS. 3. They could let you view your bandwidth usage by logging into their site. 4. They could provide an application (desktop or mobile) to keep track of your bandwidth and alert you at certain points.

My provider (T-Mobile in the UK, using a mobile 3g dongle) send me an SMS, and the connection software has lots of graphs and numbers.

They still send interstitial content warning me that I've exceeded my fair-use limit. It's a bit annoying because I very carefully checked what the limits were before I signed up.

What's worse is that they use weird, broken, IP addresses and horrible proxies for image mangling.

EDIT: Here's a pastebin.

(http://pastebin.com/k6ddD0sJ)

EDIT: Here's a Security \\\stack Exchange question about it: (http://security.stackexchange.com/questions/9368/mobile-carr...)

Re: Comcast injecting JS

#42

Post by drdaeman »

icholy wrote: post #6
mikeryan wrote: post #5

I'm torn. This seems bad, but the warning (exceeding your bandwidth quota) seems valuable. I can't think of another, better way to message this.

They should redirect to a notification page. Injecting js is unacceptable.

This is a still intrusion in others communications.

I wonder isn't there any law in US that forbids carriers from fiddling with messages?

Re: Comcast injecting JS

#43

Post by guelo »

mikeryan wrote: post #5

I'm torn. This seems bad, but the warning (exceeding your bandwidth quota) seems valuable. I can't think of another, better way to message this.

It's extremely bad. The fact that ISP monopolies are not regulated in favor of consumers is slowly going to destroy the openness that has made the web so successful. Instead of giving us raw pipes these monopolies are injecting themselves as proxies where they can monitor, cap bandwidths, shape traffic, censor content, insert messages and even add ads, which Comcast already does when a DNS request is not resolved in a HTTP session.

If you look at what Comcast does on the TV side, things like adding ads to the guide so it's barely usable, you can see where this is going. But the federal regulators of the monopolies are asleep at the switch, we can't even get network neutrality passed. The monopolies know how to play the lobbying game as well as how to slowly turn up the heat so the users aren't all outraged at once. But we can expect more abuses, more ads, more monitoring, more restrictions, more unwanted 'value adds' as time goes on.

Re: Comcast injecting JS

#44

Post by jarek-foksa »

mschuster91 wrote: post #9

OMG LOL. Have they never heard about jQuery? Christ, they could have made the code so much more elegant.

Their jQuery code would probably look like http://enterprise-js.com/23, with aggressive caching methods used on all jQuery selectors: http://enterprise-js.com/27

Re: Comcast injecting JS

#45

Post by Bockit »

passionfruit wrote: post #24
mikeryan wrote: post #5

I'm torn. This seems bad, but the warning (exceeding your bandwidth quota) seems valuable. I can't think of another, better way to message this.

Here are some other ways. 1. They could email you. 2. They could send you a SMS. 3. They could let you view your bandwidth usage by logging into their site. 4. They could provide an application (desktop or mobile) to keep track of your bandwidth and alert you at certain points.

My ISP gives emails at 50%, 80% and of course 100%. They also do options 3 and 4 (no idea about 2) but the emails are so very easy, and knowing you've hit 50% gives you time to mitigate before you get capped.

Re: Comcast injecting JS

#46

Post by pyre »

guelo wrote: post #43
mikeryan wrote: post #5

I'm torn. This seems bad, but the warning (exceeding your bandwidth quota) seems valuable. I can't think of another, better way to message this.

It's extremely bad. The fact that ISP monopolies are not regulated in favor of consumers is slowly going to destroy the openness that has made the web so successful. Instead of giving us raw pipes these monopolies are injecting themselves as proxies where they can monitor, cap bandwidths, shape traffic, censor content, insert messages and even add ads, which Comcast already does when a DNS request is not resolved in…

  | It's extremely bad. The fact that ISP monopolies
  | are not regulated in favor of consumers is slowly
  | going to destroy the openness that has made the
  | web so successful.
This is a little over the top. Whether or not to use this to notify users of time-sensitive information could be a question posed at even a small ISP without such 'evil ambitions.'

It's probably more useful to discuss the pros/cons of this approach to notifying users than it is to decry over-arching problems with the entire industry. These (over-arching industry issuse) have been discussed ad nauseum, and action is more useful than discussion at this point (at least on technical forums such as this).

  | But the federal regulators of the monopolies
  | are asleep at the switch
Look up regulatory capture.

Re: Comcast injecting JS

#47

Post by [deleted] »

mistercow wrote: post #40
mschuster91 wrote: post #19

Earlier quoted context omitted.

They could just inject it inline. No problem there. The whole document.write block 27-51 (possibly the CSS-block too, but I'm not sure about this) could be written far more elegant in jQuery. But the real saving is that "drag and drop" code - jQuery would abstract all that isIE/isNS crap from them.

The block of code they injected here was 7.9 KB (3.7 KB gzipped). jQuery is 93 KB (33 KB gzipped). So no, I don't think that would have been more elegant. Injecting anything into users' pages without permission is insane. Injecting a huge library like jQuery would be even more insane.

[deleted]

Re: Comcast injecting JS

#48

Post by [deleted] »

jarek-foksa wrote: post #44
mschuster91 wrote: post #9

OMG LOL. Have they never heard about jQuery? Christ, they could have made the code so much more elegant.

Their jQuery code would probably look like http://enterprise-js.com/23 , with aggressive caching methods used on all jQuery selectors: http://enterprise-js.com/27

[deleted]

Re: Comcast injecting JS

#49

Post by shuzchen »

I'm pretty sure Comcast aren't the only ones doing this. I had mobipcs for a while (when I just got new house, had to wait for DLS to get installed) and they injected js that tracked your browsing and replaced certain ads it found (as well as caused various errors because it wasn't written properly). I wouldn't be surprised if other companies did the same.

Re: Comcast injecting JS

#50

Post by Total_Meltdown »

chadscira wrote: post #31
dangrossman wrote: post #26

So if you were proxying some other protocol over port 80, Comcast might just inject some JavaScript into the stream and corrupt your data? I don't even like the thought that they're running some kind of hardware that makes this possible. They're sending packets impersonating a web server you actually want to talk to, pretending to be part of a response you requested?

I'm sure they are checking content-type headers... Just because you can do this doesn't mean you should (i will stay away from comcast xfinity).

I wouldn't be so sure. They're barely even checking what browser you're running.
Post reply on HN