Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast injecting JS

gist.github.com

Post reply on HN
Print view View original

201–210 of 288 posts

Re: Comcast injecting JS

#201

Post by stephen_g »

dangrossman wrote: post #26

So if you were proxying some other protocol over port 80, Comcast might just inject some JavaScript into the stream and corrupt your data? I don't even like the thought that they're running some kind of hardware that makes this possible. They're sending packets impersonating a web server you actually want to talk to, pretending to be part of a response you requested?

"I don't even like the thought that they're running some kind of hardware that makes this possible"

It's called a proxy server. They're actually really common - many ISPs use them. Any hotspot that shows a log-in page in your browser will, and I know my University's internet goes through one.

Squid [1] is one of the most well-known, and it's open source.

1. http://www.squid-cache.org

Re: Comcast injecting JS

#202

Post by buremba »

gcr wrote: post #177
Stratoscope wrote: post #158

Earlier quoted context omitted.

Oh, it's just awful. It's worse than just "not knowing JavaScript." This is code from someone who has no idea how to program : function Browser() { var ua, s, i; this.isIE = false; this.isNS = false; this.version = null; ua = navigator.userAgent; s = "MSIE"; if ((i = ua.indexOf(s)) >= 1) { this.isIE = true; this.version = parseFloat(ua.substr(i + s.length)); return; } s = "Netscape6/"; if ((i = ua.indexOf(s)) >= 0) {…

> This is code from someone who has no idea how to program That's a quite strong assertion. What's wrong with your first example? I can think of very few criticisms (s isn't needed for example) but there's lots of things they did well: - It follows the best practices for an OO constructor (doesn't return the object, just sets properties of `this`) - All temporary variables are local. No global pollution (besides the…

actually in this code, "this" refers to the window object. it means it's same as window.version.

Re: Comcast injecting JS

#203

Post by augustl »

brokentone wrote: post #143
RKearney wrote: post #72

I thought this code looked familiar! Here's my writeup on it for whoever is interested http://blog.ryankearney.com/2013/01/comcast-caught-intercept...

Hey man, this thread really took off! Nice writeup here, if I saw that, I would have submitted that instead. I submitted this right before I left work, after noticing the requests on my server and a quick Google search (on the UUID) turned up your gist and not much else. As a web server, I was kind of trying to start some discussion to see if I was alone in seeing this and didn't expect it to get to #2.

Interesting side effect of not serving the entire blog post on the blog itself - the code in your posts won't be indexed by Google on your site, only on gist.github.hom?

Re: Comcast injecting JS

#204

Post by anonymous »

tonyb wrote: post #57

This is probably part of their "Web Notifcation System". They have a published RFC talking about how it works (RFC6108). Using that system they can selectively notify customers. Like if they detect your system is infected with a virus. Or warn you your service will be discontinued if you don't pay your bill. http://tools.ietf.org/html/rfc6108

My ISP has a similar system. Except it works like this: if your machine is detected to be sending spam, for instance, the next time you try to view a webpage you're served an information page that your PC is compromised, please fix it and click here to not see this page again next time. Your actual traffic isn't compromised, it's just redirected to let you know of a problem. I can't tell you what would happen if you got close to your data limit, since we don't have any.

Re: Comcast injecting JS

#205

Post by augustl »

yuvadam wrote: post #194
mrb wrote: post #65

This is just one more reason for using HTTPS everywhere . Doing so prevents ISPs from intercepting and rewriting HTTP traffic. Shame on you, Comcast.

Comcast can just as easily MITM your SSL connections, for your safety of course. But that ridiculous, right? Since everyone verifies SSL cert signatures...

They would either need the private key of the certificate holder (which they don't have), or a certificate signed by one of the roots installed on the system, which they also won't have.

I suppose the logical next step is that Comcast requires you to install a "Comcast Internet Helper" program that also installs a Comcast root certificate into the system so they can mitm anything.. But Firefox and Chrome would probably release updates mere hours later, blocking that cert from being used from those browsers.

Re: Comcast injecting JS

#207

Post by philwelch »

STRML wrote: post #35

This code is beyond awful - it fails to display, makes endless AJAX requests, and more; here are a few fun tidbits: 1. The code is not encapsulated in an IIFE, so it clobbers any global variables (like 'image_url') in the page, breaking any scripts relying on those variables. 2. The code spends an inordinate time checking if you're running Netscape Navigator 6. 3. Strangely, they include a whole bunch of code allowin…

I love how the top comment expresses outrage, not that Comcast is injecting JS into people's sessions, but that it's poorly written JS.

Re: Comcast injecting JS

#208

Post by jlgreco »

n09n wrote: post #200
jlgreco wrote: post #193

Earlier quoted context omitted.

Maybe he has had the pleasure of being someone that gets to maintain that "good" code. I know I have.. and at Comcast no less.

That's the whole point. Code is not meant to serve the people who maintain it. Maintainability is only a concern once lack of such starts impacting your actual customers. If writing ugly code and fixing it up later is necessary in order to get shit out the door, why is that bad?

So because it satisfies the suits, he should reserve passing judgement? Try again; he is a programmer, not a suit. Hint: there exist many seperate but equally valid systems for judging worth/merit/quality.

Also, even for a suit, "Maintainability is only a concern once lack of such starts impacting your actual customers." is only true if by "actual customers" you mean shareholders. If you really want to get down to it and make an obnoxious out of place point, you can technically fuck over the customers all you want so long as doing so does not actually hurt the business (meaning: hurt the shareholders). Bonus points for figuring out how this could be done by a consulting company.

Re: Comcast injecting JS

#209

Post by davorak »

RKearney wrote: post #121
awj wrote: post #81

Has this been confirmed to still be happening? The guys blog post[1] states that this was on Nov 20th 2012. Anyone currently using a comcast account want to put down their pitchfork for a second and help verify this? [1] http://blog.ryankearney.com/2013/01/comcast-caught-intercept...

Hi awj, I'm the author of the blog post. As dangrossman said, Comcast only enforces the limit in 2 cities. I live in the Nashville area, so I'm affected. They just doubled my 50Mbps connection to 100Mbps so I will go over my limit this month as I have 2 more grace periods left. If it happens again I'll update my blog post.

Are there down sides to contacting the FBI about this? They in part exist to document and keep track of potential crimes(potentially correlate them over long time frames that may not be worth while to keep track of for an individual but can add great benefit to society at large when the burden and information is centralized.) This seems like it would fall under their definition of internet crime found on:http://www.ic3.gov/faq/default.aspx.

If there are not major down sides please file a complaint with the FBI, I believe the url is:http://www.ic3.gov/default.aspx.

I encourage you to explain

* your evidence that when accessing various websites they appear to be tampered with between the server and your computer.

* Your worry that it impacts your bill with Comcast as it seems to be eating up you bandwidth. An estimate of the amount of money being eaten up if you have reason to suspect it is a city wide occurrence how much money is lost for everyone across the city?

* If you have packet logs of these occurrences I encourage you to include them.

* Unless you have hard evidence that points to Comcast that is doing the tampering I would not accuse any party of responsibility.

* If you have concerned friends who can independently verify similar conditions, it would probably be valuable to have them file similar complaints, referencing each other where applicable.

Re: Comcast injecting JS

#210

Post by Illotus »

iSnow wrote: post #195
Phlarp wrote: post #98

Earlier quoted context omitted.

>They're all over the place. People just starting out. It could've been an intern fresh out of college. It could've been someone who just never graduated beyond copy-and-paste-from-StackOverflow. It could've been written by a person who never did web development before and was just told to make it work. I'm an intern, just moving past S.O. copy-pasta jobs and generally get scared at what the hacker news crowd might s…

One thing I have learned over the years: It is easy to write "this is crap code" over a lot of production code I have seen. But making it better, writing consistently great code in the usual environment is much harder. Don't let the macho attitude of HN infect you too much - a lot of people here (and elsewhere) are great in criticizing others.

+1. When you have whole pile of pretty bad code to maintain, it is very difficult to make the fixes significantly better within the time you have to make the fix. Usually significant improvements would require extensive refactoring which is feasible or sensible in surprisingly few cases.

Though, I have to admit, bitching about other peoples' code is fun.

Post reply on HN