Earlier quoted context omitted.
Per "violation". So, $70,000 times a a few million pageviews.
every 5000ms
Of course the alternative is for comcast users to get together and sue the company for running malicious code on their machines.
Comcast injecting JS
141–150 of 288 posts
Re: Comcast injecting JS
#142I'm glad I'm not on Comcast anymore. Terrible customer service combined with anti-customer practices like this, in addition to the lowest cost/service value on the planet and I'm glad to be done.
We switched to CenturyLink and we're really happy. I'm regularly getting 35-40 Mbps for half the price of 6 Mbps on Comcast. It is a little unnerving to know that 40 is literally the limit of their DSL technology though.
Re: Comcast injecting JS
#143I thought this code looked familiar! Here's my writeup on it for whoever is interested http://blog.ryankearney.com/2013/01/comcast-caught-intercept...
Hey man, this thread really took off! Nice writeup here, if I saw that, I would have submitted that instead. I submitted this right before I left work, after noticing the requests on my server and a quick Google search (on the UUID) turned up your gist and not much else. As a web server, I was kind of trying to start some discussion to see if I was alone in seeing this and didn't expect it to get to #2.
Re: Comcast injecting JS
#144To add to the old news litany: Saw this on Vodafone over in Germany a few years back.
To add to the security litany: SSL. EVERYWHERE. Firesheep ends up useful again :)
That said, this was probably only noticed as quickly as it was due to its stupidity and intrusiveness.
IMO what should be championed for is good decentralized end-to-end security, something like opportunistic IPSEC / anonymous SSL everywhere by default.
Sure, there are holes in it you can fly planes through, but it's a world better than it being cost effective for whoever to inject and MITM everything.
I'm not even going to touch on the pros/cons of over-subscription and business models which rely on it. (IMO most do, at least implicitly, and I'm not sure how to normalize analysis of that.)
Re: Comcast injecting JS
#145Has anyone other than OP actually seen this in the wild? None of the systems I know about on Comcast here in Chicago have had HTTP manipulated at all today. Maybe they're not doing it here because the 250GB bandwidth cap is "temporarily suspended"?
Re: Comcast injecting JS
#146I'm torn. This seems bad, but the warning (exceeding your bandwidth quota) seems valuable. I can't think of another, better way to message this.
[deleted]
Re: Comcast injecting JS
#147This is the js my ISP (VodafoneFJ) injects into all web pages: https://gist.github.com/mark-up/5297830
It basically optimizes images and replaces all image alt text with text saying to hit CTRL+R to load full-versions of images.
I know that VodafoneUK and VodafoneAU do the same.
On the bright side, at least they respect the no-transform cache-control header directive.
Re: Comcast injecting JS
#148I'm torn. This seems bad, but the warning (exceeding your bandwidth quota) seems valuable. I can't think of another, better way to message this.
Oh boy.
Since you're a comcast employee, maybe go ask the guys running your SMTP/POP3/IMAP servers. I have faith that you guys can come up with some way to communicate with the people using them.
Re: Comcast injecting JS
#149Earlier quoted context omitted.
Interestingly it would be easy to write some code that detected THIS code. Get web developers to add it to their sites and make it show a message that comcast are charging them for traffic they're causing. And then link to the class action. inject.ly isn't registered (yet) so let's presume some enterprising HN reader uses that. As a web dev, all I need to do is and it will detect this (and any future variant) ISP inj…
Or just make it a browser extension.
Browser extension would require action from end-users, making educating them using it rather redundant. Doing detection in JS can easily be deployed on servers with minimal work needed, and can potentially reach a very wide audience.
Re: Comcast injecting JS
#150Earlier quoted context omitted.
They're all over the place. People just starting out. It could've been an intern fresh out of college. It could've been someone who just never graduated beyond copy-and-paste-from-StackOverflow. It could've been written by a person who never did web development before and was just told to make it work. The little HN/Twitter/Reddit "awesome programmer" bubble is just that... a bubble. It's easy for us to forget that l…
>They're all over the place. People just starting out. It could've been an intern fresh out of college. It could've been someone who just never graduated beyond copy-and-paste-from-StackOverflow. It could've been written by a person who never did web development before and was just told to make it work. I'm an intern, just moving past S.O. copy-pasta jobs and generally get scared at what the hacker news crowd might s…
The type of programmer who writes code like this never wonders whether their code could be better or not. So don't worry, just by being self-aware enough to ask the question you put yourself on a higher level.