Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast injecting JS

gist.github.com

Post reply on HN
Print view View original

241–250 of 288 posts

Re: Comcast injecting JS

#241

Post by ryan-allen »

philwelch wrote: post #207
STRML wrote: post #35

This code is beyond awful - it fails to display, makes endless AJAX requests, and more; here are a few fun tidbits: 1. The code is not encapsulated in an IIFE, so it clobbers any global variables (like 'image_url') in the page, breaking any scripts relying on those variables. 2. The code spends an inordinate time checking if you're running Netscape Navigator 6. 3. Strangely, they include a whole bunch of code allowin…

I love how the top comment expresses outrage, not that Comcast is injecting JS into people's sessions, but that it's poorly written JS.

Nobody is allowed to see my code. It's not allowed.

Re: Comcast injecting JS

#243

Post by brokentone »

yellowbkpk wrote: post #145

Has anyone other than OP actually seen this in the wild? None of the systems I know about on Comcast here in Chicago have had HTTP manipulated at all today. Maybe they're not doing it here because the 250GB bandwidth cap is "temporarily suspended"?

Posted this separate, but I'm seeing the following users/metros in my request logs

c-75-65-181-xxx.hsd1.la.comcast.net West Monroe, LA

c-174-52-141-xxx.hsd1.ut.comcast.net Provo, UT

c-69-137-179-xxx.hsd1.az.comcast.net Tuscon, AZ

c-76-109-127-xxx.hsd1.fl.comcast.net Miami, FL

cpe-72-225-230-xxx.nyc.res.rr.com New York, NY

c-68-48-154-xxx.hsd1.md.comcast.net Washington, DC

c-98-224-83-xxx.hsd1.ca.comcast.net Fresno, CA

c-66-41-214-xxx.hsd1.mn.comcast.net Minneapolis, MN

Re: Comcast injecting JS

#244

Post by d23 »

devgutt wrote: post #230
fubari13 wrote: post #224

Earlier quoted context omitted.

Your first example has nice trickery in it but I prefer the original version. I think it is important to keep it simple. Compressed code is often not the best way to do it; adding a few lines of verbosity can reduce the time it takes to understand the code to a fraction while sacrificing very little in terms of performance.

I disagree about the first one. I think that is easier to understand, easier to add more options and less prone to errors.

It's good that this discussion can actually be had on here civilly. Too often I see vitriol and pedantic disagreement on HN for no reason other than the swinging of the e-peen.

Re: Comcast injecting JS

#245

Post by philip1209 »

ineedtosleep wrote: post #115
buddylw wrote: post #83

Earlier quoted context omitted.

I'm considering going a step farther and just setting up an Openvpn connection to my Linode server.

I've looked into the costs of VPNs on servers I own vs. a VPN service with unlimited bandwidth limits and the latter always wins. Setup time costs aside, VPN services usually have multiple regions you can connect to and are likely to have more reliable speeds. This is, of course, if you trust these companies enough and [list of security implications].

A personal license of Umbrella by OpenDNS, which includes always-on laptop and phone VPN, is $20 a year currently. There are also features like Anycast that are not feasible to replicate on a personal server.

(disclosure - I start working with OpenDNS soon).

Re: Comcast injecting JS

#246

Post by mweinbergPK »

Non-quality of code question, and sorry I haven't been able to parse this from the comments so far. Am I reading this correctly to mean that Comcast's method of alerting customers that they are close to their cap drives them closer to their cap?

Re: Comcast injecting JS

#248

Post by fluidcruft »

rbanffy wrote: post #160
jacques_chester wrote: post #156

I'd be interested in hearing from a lawyer whether this would constitute interception of or tampering with telecommunications. In a lot of places that's highly illegal except for installation/maintenance/repair, law enforcement or where it's been invited and approved.

> where it's been invited and approved. I bet the permission to do it is part of the ToS agreement.

I wonder if there is some way to devise a website that implement a copyright protection technology that js injection circumvents.

Re: Comcast injecting JS

#249

Post by danyork »

augustl wrote: post #205
yuvadam wrote: post #194

Earlier quoted context omitted.

Comcast can just as easily MITM your SSL connections, for your safety of course. But that ridiculous, right? Since everyone verifies SSL cert signatures...

They would either need the private key of the certificate holder (which they don't have), or a certificate signed by one of the roots installed on the system, which they also won't have. I suppose the logical next step is that Comcast requires you to install a "Comcast Internet Helper" program that also installs a Comcast root certificate into the system so they can mitm anything.. But Firefox and Chrome would probab…

> They would either need the private key of the certificate holder (which they don't have), or a certificate signed by one of the roots installed on the system, which they also won't have.

Actually, this is fairly common for firewalls and other edge devices to do and is one of the problems with the "trust" in the CA system. You can get a "signing certificate" from various legitimate sources (ex. http://www.sslshopper.com/article-trusted-root-signing-certi... ) that allows your product/service to terminate SSL connections and then recreate a SSL connection. The user still sees their "lock" icon and thinks they have a secure https connection to their original site, when in fact they don't.

They do have a SSL connection to their site using a certificate - it's just NOT the certificate that the original site issued. This is why many of us are looking to protocols like DANE that uses DNSSEC to add a layer of integrity protection so that you can know that you are using the correct SSL certificate. (See http://www.internetsociety.org/deploy360/resources/dane/ )

Note that no new certificates need to be added to browsers. The signing certificates work with the existing root certificates that are already in browsers.

Re: Comcast injecting JS

#250

Post by polymatter »

h2s wrote: post #223
AndyKelley wrote: post #161

Earlier quoted context omitted.

- Regular, consistent and punctual attendance. Must be able to work nights and weekends, variable schedule(s) as necessary. WOW. - Other duties and responsibilities as assigned. No developer in their right mind would apply for this job.

> Tasks > Consistent exercise of independent judgment and > discretion in matters of significance. This one literally stipulates that you will be expected to think for yourself on a regular basis. Why on earth is this in there?

as a catch all. if they want to get rid of you, they can always cite this as a reason.
Post reply on HN