Not only that but it appears people are using Comcast as a DOS proxy http://blog.ryankearney.com/2013/01/comcast-caught-intercept...
Comcast injecting JS
221–230 of 288 posts
Re: Comcast injecting JS
#222This is either a bad april fools joke, or it might be related one of the following:
* ISP - 'six strikes' of content abuse
http://www.techradar.com/us/news/internet/broadband/six-stri...
* EBS - Emergency Broadcast System
http://www.washingtonpost.com/blogs/blogpost/post/wheres-an-...
http://news.cnet.com/8301-19882_3-57321623-250/wheres-the-em...
Re: Comcast injecting JS
#223The hilarious thing about this is comcasts ridiculously buzz worded job ads for engineers. It's like they just cut and pasted everything any manager read in a blog or magazine and pasted it to dice: http://www.dice.com/jobsearch/servlet/JobSearch?op=302&d...
- Regular, consistent and punctual attendance. Must be able to work nights and weekends, variable schedule(s) as necessary. WOW. - Other duties and responsibilities as assigned. No developer in their right mind would apply for this job.
> Tasks
> Consistent exercise of independent judgment and
> discretion in matters of significance.
Re: Comcast injecting JS
#224Earlier quoted context omitted.
> This is code from someone who has no idea how to program That's a quite strong assertion. What's wrong with your first example? I can think of very few criticisms (s isn't needed for example) but there's lots of things they did well: - It follows the best practices for an OO constructor (doesn't return the object, just sets properties of `this`) - All temporary variables are local. No global pollution (besides the…
I was foaming at the mouth a bit, wasn't I? All your points are well taken, and a better analysis of the code by far than my hasty reaction. So what was bothering me about the first example? Probably the repetition of the indexOf() tests, combined with one of the indexOf() tests being >= 1 and the rest >= 0. But you're right, it's not nearly as bad as I made it out to be. Since I've put my foot in my mouth, I guess I…
Your first example has nice trickery in it but I prefer the original version. I think it is important to keep it simple.
Compressed code is often not the best way to do it; adding a few lines of verbosity can reduce the time it takes to understand the code to a fraction while sacrificing very little in terms of performance.
Re: Comcast injecting JS
#225Earlier quoted context omitted.
They would either need the private key of the certificate holder (which they don't have), or a certificate signed by one of the roots installed on the system, which they also won't have. I suppose the logical next step is that Comcast requires you to install a "Comcast Internet Helper" program that also installs a Comcast root certificate into the system so they can mitm anything.. But Firefox and Chrome would probab…
Most people are going to click through any security warning because they just want to get to the site they wanted to go to. If Comcast does this, it would make EVERY SSL site display the warning, making it utterly meaningless. Alternatively, it's not that outrageous to think that Comcast et al could get certs into the major browsers if they wanted to do so. It's not even implausible to think that at some point, brows…
IIRC, you can't open Gmail and many other websites on Chrome without genuine SSL.
Re: Comcast injecting JS
#226Wonder how the folks back at Comcast HQ would feel if the rest of the internet started adding messages to their web browsing telling them this kind of thing is unsatisfactory? Hey, this content injection game is a game that we all can play. This is the old "windows alert" nonsense. Everybody and their brother that touched the windows system thought the user would want a popup when their program did something. So the…
Don't we just all need to put an appropriate JSON payload into '/e8f6b078-0f35-11de-85c5-efc5ef23aa1f/aupm/notify.do?dispatch=checkBulletin' on every web server we control? ;-)
The URI seems to be dynamically generated. But, yeah, we can write some rewrite rules and serve the requests.
If I'm not wrong, this is implementation of JSONP to avoid cross-domain AJAX request block, right?
Re: Comcast injecting JS
#227Earlier quoted context omitted.
I believe Comcast hijacked NXDOMAIN DNS replies and replaced them with their own IP address, causing every non-existant domain name to go to their search page you had to opt-out of.
That's rediculous. Airtel in India also used to do this. Annoying as hell. Miss-type the domain and type all of it again.
Afaik, Airtel still does it and people still put up with it. I think they do the usage % notification hijacking as well without understanding even a bit that that internet is a pipe and people use applications other than web browsers and protocols other than http.
Re: Comcast injecting JS
#228It would be nice if there was an easier way to find out ISP injections for the layperson who can't really use wireshark/proxy and data comparisons, or for technical people that just don't have the time. This project had potential ( it detected torrent traffic shaping) but it seems to no longer be under dev. http://broadband.mpi-sws.org/transparency/results/ Also this is a good read and contains comcast traffic shapin…
There is validity in scrutinizing the code quality as well.
I agree that the ethical discussion is likely the paramount concern here and should be discussed, but the code they're using floods the global namespace which in theory could actually degrade service for end-users (by potentially breaking commonly visited JS-powered sites that happen to use globals of the same name).
Its worth pointing out that it would take minimal effort to make this code not suck as much (wrapping it in a closure for a start). IMO it gives more context to the initiative on Comcast's part. No time, effort, or care was put into considering the ethical implications of this practice nor its practical effect on the end-user.
Re: Comcast injecting JS
#229Earlier quoted context omitted.
> * This URL is relative, which means it will never actually reach its intended target (instead filling your web logs with this request) It likely doesn't matter that the URL is relative. It contains a GUID to be unlikely to resemble any real URL, and it's clear enough that they are capable of deep-packet-inspecting all of your web traffic from the way this is already used, so they likely hijack any request to this U…
brokentone comments below that they've seen the urls in their production logs. I don't see it in any of mine but I'd be willing to bet that a company writing JS that bad would probably screw up the rest of the process too. Surely a class action against Comcast is in order here? They're charging everyone for bandwidth they're not using.
I can confirm that I saw a large number of these urls show up in my logs as well.
Re: Comcast injecting JS
#230Earlier quoted context omitted.
I was foaming at the mouth a bit, wasn't I? All your points are well taken, and a better analysis of the code by far than my hasty reaction. So what was bothering me about the first example? Probably the repetition of the indexOf() tests, combined with one of the indexOf() tests being >= 1 and the rest >= 0. But you're right, it's not nearly as bad as I made it out to be. Since I've put my foot in my mouth, I guess I…
Your first example has nice trickery in it but I prefer the original version. I think it is important to keep it simple. Compressed code is often not the best way to do it; adding a few lines of verbosity can reduce the time it takes to understand the code to a fraction while sacrificing very little in terms of performance.
I disagree about the first one. I think that is easier to understand, easier to add more options and less prone to errors.