Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast injecting JS

gist.github.com

Post reply on HN
Print view View original

71–80 of 288 posts

Re: Comcast injecting JS

#71

Post by dangrossman »

readme wrote: post #61
fletchowns wrote: post #55

Earlier quoted context omitted.

It's right there near the top.... You have reached 90% of your monthly data usage allowance .

Nope, I don't have it. Are you Canadian? Maybe it's a Canada thing? Doing it to tell you about your data allowance is a bit excessive, for sure.

You don't have what? Comcast had a data cap nationwide (250GB/mo) even if you weren't aware of it. They temporarily stopped enforcing it outside of two test markets (Nashville and Tucson) where they're working out exactly what limits people will put up with. You wouldn't see this popup unless you live there and you've used over 225GB this month.

Re: Comcast injecting JS

#73

Post by ancarda »

STRML wrote: post #35

This code is beyond awful - it fails to display, makes endless AJAX requests, and more; here are a few fun tidbits: 1. The code is not encapsulated in an IIFE, so it clobbers any global variables (like 'image_url') in the page, breaking any scripts relying on those variables. 2. The code spends an inordinate time checking if you're running Netscape Navigator 6. 3. Strangely, they include a whole bunch of code allowin…

Ethical stuff aside, I can't imagine hiring someone to actually produce code THIS bad. Where the hell did they find the coder to make this?

Re: Comcast injecting JS

#74

Post by SwellJoe »

thomasvendetta wrote: post #56
TheOsiris wrote: post #36

Earlier quoted context omitted.

Best idea ever! But, they'll probably prosecute who ever does it for some BS reason and sentence them to a term of 500 years

Dont forget a $70,000 fine.

Per "violation". So, $70,000 times a a few million pageviews.

Re: Comcast injecting JS

#75

Post by chadscira »

Total_Meltdown wrote: post #50
chadscira wrote: post #31

Earlier quoted context omitted.

I'm sure they are checking content-type headers... Just because you can do this doesn't mean you should (i will stay away from comcast xfinity).

I wouldn't be so sure. They're barely even checking what browser you're running.

if they weren't then all JS and CSS files loaded through them would have their script tags in it.

i have had these types of issues a while back at coffee shops that try to inject ads, it was breaking my XML.

Re: Comcast injecting JS

#76

Post by bphogan »

ancarda wrote: post #73
STRML wrote: post #35

This code is beyond awful - it fails to display, makes endless AJAX requests, and more; here are a few fun tidbits: 1. The code is not encapsulated in an IIFE, so it clobbers any global variables (like 'image_url') in the page, breaking any scripts relying on those variables. 2. The code spends an inordinate time checking if you're running Netscape Navigator 6. 3. Strangely, they include a whole bunch of code allowin…

Ethical stuff aside, I can't imagine hiring someone to actually produce code THIS bad. Where the hell did they find the coder to make this?

They're all over the place. People just starting out. It could've been an intern fresh out of college. It could've been someone who just never graduated beyond copy-and-paste-from-StackOverflow. It could've been written by a person who never did web development before and was just told to make it work.

The little HN/Twitter/Reddit "awesome programmer" bubble is just that... a bubble. It's easy for us to forget that lots of people write lots of bad, untested code all day long. As much as it frustrates me, lots of people code who don't care about code - it's just their job.

Re: Comcast injecting JS

#77

Post by kyrias »

sbarre wrote: post #7

This is nothing new.. Rogers has been doing this for years in Canada already.. They use it to notify subscribers when they are approaching their bandwidth quota (75%) and then again when they hit 100%. You actually have to click a "I understand" button to have it not show up over and over.

Well it's checking for Netscape 6 so who knows when this was originally written...

Re: Comcast injecting JS

#78

Post by pak »

STRML wrote: post #35

This code is beyond awful - it fails to display, makes endless AJAX requests, and more; here are a few fun tidbits: 1. The code is not encapsulated in an IIFE, so it clobbers any global variables (like 'image_url') in the page, breaking any scripts relying on those variables. 2. The code spends an inordinate time checking if you're running Netscape Navigator 6. 3. Strangely, they include a whole bunch of code allowin…

> * This URL is relative, which means it will never actually reach its intended target (instead filling your web logs with this request)

It likely doesn't matter that the URL is relative. It contains a GUID to be unlikely to resemble any real URL, and it's clear enough that they are capable of deep-packet-inspecting all of your web traffic from the way this is already used, so they likely hijack any request to this URL path within their network to capture its contents, and return a 200.

I don't have Comcast so I can't verify, but it would be interesting for somebody to check whether that URL is masked for all Comcast users.

> That's right, this code causes every page served on your system to pop an AJAX request to the wrong URL every 5 seconds, as long as the tabs are open.

I can only hope that they infinitely hang requests to their special URL in the case that user is under the quota so that this is not true. But if it is true, and they are not perfect about masking the URL (edit: it seems like people below on this thread have seen requests to this URL in their server logs), this could be construed as a DDOS attack by Comcast on every owner of an HTTP server via their own customers.

Re: Comcast injecting JS

#80

Post by kyrias »

djtriptych wrote: post #32
mikeryan wrote: post #5

I'm torn. This seems bad, but the warning (exceeding your bandwidth quota) seems valuable. I can't think of another, better way to message this.

Your profile reveals you're a former Comcast employee. That's a disclaimer worth posting here. But yeah, if you have service with Comcast they have your home phone, email addresses, and physical address. They can get in touch with you every way that every company that CAN'T read all of your internet traffic already gets in touch with you. The method they've chosen is terrible for at least the following reasons: - The…

The alert will significantly increase your data usage...
Post reply on HN