Live data from Hacker News

Comcast injecting JS

gist.github.com

81–90 of 288 posts

Re: Comcast injecting JS

#82
post #81

Has this been confirmed to still be happening? The guys blog post[1] states that this was on Nov 20th 2012. Anyone currently using a comcast account want to put down their pitchfork for a second and help verify this? [1] http://blog.ryankearney.com/2013/01/comcast-caught-intercept...

Comcast only enforces data caps in two cities right now, so your testing pool is much more limited than simply anyone using Comcast. Ryan (the author of the blog post) lives in one of those two cities. A potential tester would have to be in either the Nashville or Tucson area, and have used over 90% of their bandwidth cap for the month.

Re: Comcast injecting JS

#83
post #65

This is just one more reason for using HTTPS everywhere . Doing so prevents ISPs from intercepting and rewriting HTTP traffic. Shame on you, Comcast.

I'm considering going a step farther and just setting up an Openvpn connection to my Linode server.

Re: Comcast injecting JS

#84
post #58

Earlier quoted context omitted.

How about creating /e8f6b078-0f35-11de-85c5-efc5ef23aa1f/aupm/notify.do on your server to notify Comcast users about what their internet service provider is doing? If people started doing that en masse it could bring attention to the problem and with enough publicity get Comcast to reconsider JS injection. I don't really understand the point of this, either. Couldn't they starting redirecting users to a static page s…

How about putting a giant video file there? Or just embed this: https://www.youtube.com/watch?v=0ilMx7k7mso (language)

I thought I was going to be rick rolled, but that's good too.

Re: Comcast injecting JS

#85

Earlier quoted context omitted.

right tool for the right job. a 1 page script written for comcast does not demand jQuery. That's not to say it would have improved it.

It at least would remove this damn ugly browser switching code. Hey, it's 2013, no need to reinvent the wheel...

But think about the Netscape 6!

Re: Comcast injecting JS

#86
post #67
post #37

Comcast is such an incompetent company. I tried to sign up for service once and they charged me ten bucks to ship me two coax cables yet I was never able to get my service activated because I mistakenly thought my place was hooked up to cable when it wasn't and when I tried to call to correct this and schedule an installation I kept getting put on hold for a half hour before being given a message saying there was an…

after 2 weeks, 3 techs coming to my house,5 chat conversations and multiple phone calls I finally have service... I don't really like this legal monopoly for cable companies... I would switch to ATT but right now they are about twice the cost...

As a different point, my place was already pre-wired. I bought a cable modem from Best Buy, and plugged it in. It synced immediately. Then I went online and ordered service. They charged me $10 to send a self-install kit, but it wasn't needed I was actually online within minutes.

So sometimes their systems work...

I was very sad about switching from my other carrier (Sonic.net), but they ultimately couldn't deliver very much bandwidth. And Comcast was actually cheaper.

Re: Comcast injecting JS

#87
post #7

This is nothing new.. Rogers has been doing this for years in Canada already.. They use it to notify subscribers when they are approaching their bandwidth quota (75%) and then again when they hit 100%. You actually have to click a "I understand" button to have it not show up over and over.

Rogers also used to serve ads in place of an error message when a bad URL was requested. That was the final straw causing me to cancel my service with them and switch to Teksavvy.

Re: Comcast injecting JS

#88
post #78
post #35

This code is beyond awful - it fails to display, makes endless AJAX requests, and more; here are a few fun tidbits: 1. The code is not encapsulated in an IIFE, so it clobbers any global variables (like 'image_url') in the page, breaking any scripts relying on those variables. 2. The code spends an inordinate time checking if you're running Netscape Navigator 6. 3. Strangely, they include a whole bunch of code allowin…

> * This URL is relative, which means it will never actually reach its intended target (instead filling your web logs with this request) It likely doesn't matter that the URL is relative. It contains a GUID to be unlikely to resemble any real URL, and it's clear enough that they are capable of deep-packet-inspecting all of your web traffic from the way this is already used, so they likely hijack any request to this U…

brokentone comments below that they've seen the urls in their production logs. I don't see it in any of mine but I'd be willing to bet that a company writing JS that bad would probably screw up the rest of the process too.

Surely a class action against Comcast is in order here? They're charging everyone for bandwidth they're not using.

Re: Comcast injecting JS

#89
post #76
post #73

Earlier quoted context omitted.

Ethical stuff aside, I can't imagine hiring someone to actually produce code THIS bad. Where the hell did they find the coder to make this?

They're all over the place. People just starting out. It could've been an intern fresh out of college. It could've been someone who just never graduated beyond copy-and-paste-from-StackOverflow. It could've been written by a person who never did web development before and was just told to make it work. The little HN/Twitter/Reddit "awesome programmer" bubble is just that... a bubble. It's easy for us to forget that l…

I agree, they're everywhere - but it doesn't explain this well-written RFC[1] to accompany the code.

[1] http://tools.ietf.org/html/rfc6108

Post reply on HN