Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast injecting JS

gist.github.com

Post reply on HN
Print view View original

151–160 of 288 posts

Re: Comcast injecting JS

#151

Post by Phlarp »

ancarda wrote: post #106
Phlarp wrote: post #98

Earlier quoted context omitted.

>They're all over the place. People just starting out. It could've been an intern fresh out of college. It could've been someone who just never graduated beyond copy-and-paste-from-StackOverflow. It could've been written by a person who never did web development before and was just told to make it work. I'm an intern, just moving past S.O. copy-pasta jobs and generally get scared at what the hacker news crowd might s…

The code on your GitHub, for the most part, seems fine. One thing I can say is don't use exec[1] if you can avoid it: $string = 'rm /var/www/Giftest/*.gif'; exec($string); While there's nothing * technically* wrong, it's platform specific and I think it would be better to use PHP's unlink[2] function. Also, sorry if this is wrong, I haven't looked at the regex but it seems your parsing YouTube URLs? Have you looked a…

would you be willing to discuss this further? No contact in your profile.

Re: Comcast injecting JS

#152

Post by kevincennis »

STRML wrote: post #35

This code is beyond awful - it fails to display, makes endless AJAX requests, and more; here are a few fun tidbits: 1. The code is not encapsulated in an IIFE, so it clobbers any global variables (like 'image_url') in the page, breaking any scripts relying on those variables. 2. The code spends an inordinate time checking if you're running Netscape Navigator 6. 3. Strangely, they include a whole bunch of code allowin…

There are a lot of things in this code that make me think that it was written by someone for whom JavaScript is not their main language - but probably the most glaring example is the use of `new Object()`. I've never seen anyone with more than 3 days JS experience use the Object constructor over a literal.

Re: Comcast injecting JS

#153

Post by smacktoward »

brianjyee wrote: post #95

Comcast is an awful awful awful company. Yet I pay them over $100/month. I hate them with a passion. I've never experienced worse customer service. If I could pay double the price with a different company for internet/cable, I would do it in an instant but I unfortunately have no other options.

Yeah, me neither.

The worst part is that once I was griping about the horribleness of Comcast on Twitter, and a Verizon representative chimed in cheerily to tell me to check out FIOS. Only thing being, it's been ten years since they first announced FIOS was "coming soon" to my neighborhood and it still isn't here yet.

Sometimes you don't know whether to laugh or cry, you know?

Re: Comcast injecting JS

#154

Post by jsz0 »

ars wrote: post #134
tonyb wrote: post #57

This is probably part of their "Web Notifcation System". They have a published RFC talking about how it works (RFC6108). Using that system they can selectively notify customers. Like if they detect your system is infected with a virus. Or warn you your service will be discontinued if you don't pay your bill. http://tools.ietf.org/html/rfc6108

The real goal of this is for the copyright infringement notices they want to send. Which I'm sure they will deem "critical".

They are legally required to serve DMCA copyright infringement notices to maintain their safe harbor status.

Re: Comcast injecting JS

#155

Post by jacques_chester »

jmcqk6 wrote: post #110
jerf wrote: post #60

Earlier quoted context omitted.

This remains an untested field of copyright law, as far as I know. I've been waiting for literally over a decade for some test case on this matter to come up, and it never does. Perhaps by 2023.

Isn't this just a matter of 1) building a webpage where you own the copright 2) Have someone in one of the cities where this is happening browse to your page. 3) Copyright violated, and you get to be the test case!

Courts will generally refuse to take on manufactured cases. Their job is resolve real disputes.

A lower court would probably just throw the case out.

And if it didn't, the higher courts, which would set a widely binding precedent, would exercise their discretion simply not to hear the case. Yes: they get to pick and choose what appeals to hear.

Re: Comcast injecting JS

#156

Post by jacques_chester »

I'd be interested in hearing from a lawyer whether this would constitute interception of or tampering with telecommunications. In a lot of places that's highly illegal except for installation/maintenance/repair, law enforcement or where it's been invited and approved.

Re: Comcast injecting JS

#157

Post by n09n »

calinet6 wrote: post #135
bphogan wrote: post #76

Earlier quoted context omitted.

They're all over the place. People just starting out. It could've been an intern fresh out of college. It could've been someone who just never graduated beyond copy-and-paste-from-StackOverflow. It could've been written by a person who never did web development before and was just told to make it work. The little HN/Twitter/Reddit "awesome programmer" bubble is just that... a bubble. It's easy for us to forget that l…

"People just starting out." Ha, you give them too much credit. This code is from a 10-year veteran "consultant," probably charging over $200/hour, brought on by the Global Services company hired by the Consulting Agency that Comcast brought in to assist in completing the critical time-sensitive project as quickly as possible. It was also deemed a great success, and presentations were made about how effective it was,…

They understand that "good code" is code that delivers a lot of value to the person who needs it. Why hate on them for that? You just sound jealous that they make more than you do.

Re: Comcast injecting JS

#158

Post by Stratoscope »

kevincennis wrote: post #152
STRML wrote: post #35

This code is beyond awful - it fails to display, makes endless AJAX requests, and more; here are a few fun tidbits: 1. The code is not encapsulated in an IIFE, so it clobbers any global variables (like 'image_url') in the page, breaking any scripts relying on those variables. 2. The code spends an inordinate time checking if you're running Netscape Navigator 6. 3. Strangely, they include a whole bunch of code allowin…

There are a lot of things in this code that make me think that it was written by someone for whom JavaScript is not their main language - but probably the most glaring example is the use of `new Object()`. I've never seen anyone with more than 3 days JS experience use the Object constructor over a literal.

Oh, it's just awful. It's worse than just "not knowing JavaScript." This is code from someone who has no idea how to program:

    function Browser() {
        var ua, s, i;
        this.isIE = false;
        this.isNS = false;
        this.version = null;
        ua = navigator.userAgent;
        s = "MSIE";
        if ((i = ua.indexOf(s)) >= 1) {
            this.isIE = true;
            this.version = parseFloat(ua.substr(i + s.length));
            return;
        }
        s = "Netscape6/";
        if ((i = ua.indexOf(s)) >= 0) {
            this.isNS = true;
            this.version = parseFloat(ua.substr(i + s.length));
            return;
        }
        s = "Gecko";
        if ((i = ua.indexOf(s)) >= 0) {
            this.isNS = true;
            this.version = 6.1;
            return;
        }
    }
But it's not just these people. Code like this is everywhere! Here's what I ran into on www.safeco.com today (NSFL!):

    function setupAddress(frm, i, clickevent) {
        if (frm["USERESADDASMAILINGMAIN" + i].checked) {
            if (frm.NEWRESIDENCEADDRESS1.value == "" && frm.NEWRESIDENCEADDRESS2.value == "") {
                alert("Resident address must be entered for this option.");
                frm.NEWRESIDENCEADDRESS1.focus();
                frm["USERESADDASMAILINGMAIN" + i].checked = false;
            }
            if (frm.NEWRESIDENCEADDRESS1.value == "" && frm.NEWRESIDENCEADDRESS2.value != "") {
                FieldSwap(document.frmMain.NEWRESIDENCEADDRESS1, document.frmMain.NEWRESIDENCEADDRESS2);
            }
            frm["NEWMAILINGADDRESS1" + i].value = frm.NEWRESIDENCEADDRESS1.value;
            frm["NEWMAILINGADDRESS1" + i].disabled = true;
            frm["NEWMAILINGADDRESS1" + i].onfocus = frm["NEWMAILINGADDRESS1" + i].blur;
            frm["NEWMAILINGADDRESS2" + i].value = frm.NEWRESIDENCEADDRESS2.value;
            frm["NEWMAILINGADDRESS2" + i].disabled = true;
            frm["NEWMAILINGADDRESS2" + i].onfocus = frm["NEWMAILINGADDRESS2" + i].blur;
            frm["NEWMAILINGCITY" + i].value = frm.NEWRESIDENCECITY.value;
            frm["NEWMAILINGCITY" + i].disabled = true;
            frm["NEWMAILINGCITY" + i].onfocus = frm["NEWMAILINGCITY" + i].blur;
            frm["NEWMAILINGSTATE" + i].value = frm.NEWRESIDENCESTATE.value;
            frm["NEWMAILINGSTATE" + i].disabled = true;
            frm["NEWMAILINGSTATE" + i].onfocus = frm["NEWMAILINGSTATE" + i].blur;
            frm["NEWMAILINGZIPCODE" + i].value = frm.NEWRESIDENCEZIPCODE.value;
            frm["NEWMAILINGZIPCODE" + i].disabled = true;
            frm["NEWMAILINGZIPCODE" + i].onfocus = frm["NEWMAILINGZIPCODE" + i].blur;
            if (i != 0) {
                frm["EXPLANATIONVEH" + i].value = "";
                frm["EXPLANATIONVEH" + i].disabled = true;
                frm["EXPLANATIONVEH" + i].onfocus = frm["EXPLANATIONVEH" + i].blur;
            }
        } else {
            frm["NEWMAILINGADDRESS1" + i].disabled = false;
            frm["NEWMAILINGADDRESS1" + i].onfocus = null;
            frm["NEWMAILINGADDRESS2" + i].disabled = false;
            frm["NEWMAILINGADDRESS2" + i].onfocus = null;
            frm["NEWMAILINGCITY" + i].disabled = false;
            frm["NEWMAILINGCITY" + i].onfocus = null;
            frm["NEWMAILINGSTATE" + i].disabled = false;
            frm["NEWMAILINGSTATE" + i].onfocus = null;
            frm["NEWMAILINGZIPCODE" + i].disabled = false;
            frm["NEWMAILINGZIPCODE" + i].onfocus = null;
            if (i != 0) {
                frm["EXPLANATIONVEH" + i].disabled = false;
                frm["EXPLANATIONVEH" + i].onfocus = null;
            }
            if (clickevent) {
                frm["NEWMAILINGADDRESS1" + i].value = '';
                frm["NEWMAILINGADDRESS2" + i].value = '';
                frm["NEWMAILINGCITY" + i].value = '';
                frm["NEWMAILINGSTATE" + i].value = '';
                frm["NEWMAILINGZIPCODE" + i].value = '';
            }
        }
    }

Re: Comcast injecting JS

#159

Post by bigiain »

DanielBMarkham wrote: post #33

Wonder how the folks back at Comcast HQ would feel if the rest of the internet started adding messages to their web browsing telling them this kind of thing is unsatisfactory? Hey, this content injection game is a game that we all can play. This is the old "windows alert" nonsense. Everybody and their brother that touched the windows system thought the user would want a popup when their program did something. So the…

Don't we just all need to put an appropriate JSON payload into '/e8f6b078-0f35-11de-85c5-efc5ef23aa1f/aupm/notify.do?dispatch=checkBulletin' on every web server we control?

;-)

Re: Comcast injecting JS

#160

Post by rbanffy »

jacques_chester wrote: post #156

I'd be interested in hearing from a lawyer whether this would constitute interception of or tampering with telecommunications. In a lot of places that's highly illegal except for installation/maintenance/repair, law enforcement or where it's been invited and approved.

> where it's been invited and approved.

I bet the permission to do it is part of the ToS agreement.

Post reply on HN