Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast injecting JS

gist.github.com

Post reply on HN
Print view View original

111–120 of 288 posts

Re: Comcast injecting JS

#111

Post by [deleted] »

mistercow wrote: post #40
mschuster91 wrote: post #19

Earlier quoted context omitted.

They could just inject it inline. No problem there. The whole document.write block 27-51 (possibly the CSS-block too, but I'm not sure about this) could be written far more elegant in jQuery. But the real saving is that "drag and drop" code - jQuery would abstract all that isIE/isNS crap from them.

The block of code they injected here was 7.9 KB (3.7 KB gzipped). jQuery is 93 KB (33 KB gzipped). So no, I don't think that would have been more elegant. Injecting anything into users' pages without permission is insane. Injecting a huge library like jQuery would be even more insane.

[deleted]

Re: Comcast injecting JS

#112

Post by mbreese »

juiceandjuice wrote: post #97
mbreese wrote: post #86

Earlier quoted context omitted.

As a different point, my place was already pre-wired. I bought a cable modem from Best Buy, and plugged it in. It synced immediately. Then I went online and ordered service. They charged me $10 to send a self-install kit, but it wasn't needed I was actually online within minutes. So sometimes their systems work... I was very sad about switching from my other carrier (Sonic.net), but they ultimately couldn't deliver v…

> And Comcast was actually cheaper. At least for the first 6/12 months. Then you get to haggle and threaten disconnection for a day, then you are good for another 6/12 months.

In my case, their published (non-promotional) rates were cheaper than the bonded DSL I was using. I really didn't want to switch, but I just couldn't justify the amount I was spending for the bandwidth I got.

Re: Comcast injecting JS

#113

Post by taf2 »

pmorici wrote: post #37

Comcast is such an incompetent company. I tried to sign up for service once and they charged me ten bucks to ship me two coax cables yet I was never able to get my service activated because I mistakenly thought my place was hooked up to cable when it wasn't and when I tried to call to correct this and schedule an installation I kept getting put on hold for a half hour before being given a message saying there was an…

for companies like comcast the easy solution is chargeback as a SaaS owner i hate to promote the idea of chargeback - but seriously they sting bad and could really act as a good wake up call for companies like comcast.

Re: Comcast injecting JS

#114

Post by ben0x539 »

mrb wrote: post #65

This is just one more reason for using HTTPS everywhere . Doing so prevents ISPs from intercepting and rewriting HTTP traffic. Shame on you, Comcast.

If some interns running a corporate intranet can get a transparent htts proxy, what's stopping an ISP from rewriting your https traffic?

Re: Comcast injecting JS

#115

Post by ineedtosleep »

buddylw wrote: post #83
mrb wrote: post #65

This is just one more reason for using HTTPS everywhere . Doing so prevents ISPs from intercepting and rewriting HTTP traffic. Shame on you, Comcast.

I'm considering going a step farther and just setting up an Openvpn connection to my Linode server.

I've looked into the costs of VPNs on servers I own vs. a VPN service with unlimited bandwidth limits and the latter always wins. Setup time costs aside, VPN services usually have multiple regions you can connect to and are likely to have more reliable speeds.

This is, of course, if you trust these companies enough and [list of security implications].

Re: Comcast injecting JS

#116

Post by sjwright »

ben0x539 wrote: post #114
mrb wrote: post #65

This is just one more reason for using HTTPS everywhere . Doing so prevents ISPs from intercepting and rewriting HTTP traffic. Shame on you, Comcast.

If some interns running a corporate intranet can get a transparent htts proxy, what's stopping an ISP from rewriting your https traffic?

Your browser, for one. What you describe is the very definition of a MITM attack, regardless of proxy structure.

Your bank, for another. Indeed there are far too many parties with an interest in keeping https secure, that you needn't worry about it.

Re: Comcast injecting JS

#117

Post by makomk »

aidos wrote: post #88
pak wrote: post #78

Earlier quoted context omitted.

> * This URL is relative, which means it will never actually reach its intended target (instead filling your web logs with this request) It likely doesn't matter that the URL is relative. It contains a GUID to be unlikely to resemble any real URL, and it's clear enough that they are capable of deep-packet-inspecting all of your web traffic from the way this is already used, so they likely hijack any request to this U…

brokentone comments below that they've seen the urls in their production logs. I don't see it in any of mine but I'd be willing to bet that a company writing JS that bad would probably screw up the rest of the process too. Surely a class action against Comcast is in order here? They're charging everyone for bandwidth they're not using.

That's likely to happen even if Comcast are using DPI to intercept the requests due to users moving between Comcast and other internet connections.

Re: Comcast injecting JS

#118

Post by kbhomes »

ben0x539 wrote: post #114
mrb wrote: post #65

This is just one more reason for using HTTPS everywhere . Doing so prevents ISPs from intercepting and rewriting HTTP traffic. Shame on you, Comcast.

If some interns running a corporate intranet can get a transparent htts proxy, what's stopping an ISP from rewriting your https traffic?

Because using Comcast using an HTTPS proxy to rewrite traffic means that your browser will expect data encrypted with Google's, Facebook's, Chase's, etc. certificate when it actually receives Comcast's proxy certificate. Every HTTPS site would prompt the user about an SSL certificate error.

Re: Comcast injecting JS

#119

Post by RKearney »

desigooner wrote: post #94
rescripting wrote: post #87

Earlier quoted context omitted.

Rogers also used to serve ads in place of an error message when a bad URL was requested. That was the final straw causing me to cancel my service with them and switch to Teksavvy.

So did Comcast IIRC

I believe Comcast hijacked NXDOMAIN DNS replies and replaced them with their own IP address, causing every non-existant domain name to go to their search page you had to opt-out of.

Re: Comcast injecting JS

#120

Post by spoiler »

jlgreco wrote: post #102
mikeryan wrote: post #11

Earlier quoted context omitted.

That could work, but I'm guessing often this might not be the account owner (kids?) racking up the bandwidth.

Maybe the power company should blink account warnings in morse code through your lightbulbs. After all, it may not be the person paying the bill that is using all of the power....

Thanks, now everyone is looking at me because I am laughing with myself!
Post reply on HN