Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast injecting JS

gist.github.com

Post reply on HN
Print view View original

271–280 of 288 posts

Re: Comcast injecting JS

#271

Post by marshray »

n09n wrote: post #200
jlgreco wrote: post #193

Earlier quoted context omitted.

Maybe he has had the pleasure of being someone that gets to maintain that "good" code. I know I have.. and at Comcast no less.

That's the whole point. Code is not meant to serve the people who maintain it. Maintainability is only a concern once lack of such starts impacting your actual customers. If writing ugly code and fixing it up later is necessary in order to get shit out the door, why is that bad?

Because if you want to be a software developer in the long term, you need to prefer the long term alternative in most cases.

A typical example is, "If we don't get something out the door, we'll be out of business. 'Shit' is something that can be shipped quickly, therefore we must ship 'shit'."

But companies that ship 'shit' generally go out of business anyway. Either their customers find it unappealing and leave, or ongoing maintenance quickly becomes so difficult and expensive that the product can not improve except by being rewritten under new management.

With something like a secure website (or script injected into arbitrary websites by a large ISP) the severity of the security vulnerabilities that tend to result from "shipping shit" often you only get one or two chances as a company.

Re: Comcast injecting JS

#272

Post by davorak »

IheartApplesDix wrote: post #140

Mobile carriers do this too. I see the exact same feature being provided on my Sprint line.

If this was happening on a 56k modem over a phone line it would clearly be wire tapping. I encouraged the op in another post, https://news.ycombinator.com/item?id=5484850, to contact the FBI. If you see a downside to this let me know, but until I realize one, or have one pointed out I encourage you to do so.

Re: Comcast injecting JS

#273

Post by davorak »

RKearney wrote: post #72

I thought this code looked familiar! Here's my writeup on it for whoever is interested http://blog.ryankearney.com/2013/01/comcast-caught-intercept...

Is there a downside about notifying the FBI of this? I encouraged the op to do so in another post, encouraged. If this was happening on a 56k modem over a phone line it would clearly be wire tapping.

I do not see any downsides to contact the FBI about the matter, if you think of any please let me know.

Re: Comcast injecting JS

#274

Post by [deleted] »

_conehead wrote: post #127

My ISP does something similar, but it's meant to inject ads: one ad that scrolls in from the bottom every two-three minutes (for ten seconds or so, and that can't be dismissed), as well as another ad that covers up ads that other websites serve up.[0] I've now resorted to using a remote VPN for all of my traffic. [0]: A reddit post in which I discuss it: http://www.reddit.com/r/self/comments/19zhl6/my_isp_is_injec...

[deleted]

Re: Comcast injecting JS

#275

Post by davorak »

_conehead wrote: post #127

My ISP does something similar, but it's meant to inject ads: one ad that scrolls in from the bottom every two-three minutes (for ten seconds or so, and that can't be dismissed), as well as another ad that covers up ads that other websites serve up.[0] I've now resorted to using a remote VPN for all of my traffic. [0]: A reddit post in which I discuss it: http://www.reddit.com/r/self/comments/19zhl6/my_isp_is_injec...

I will encourage you like I have in several other posts, example https://news.ycombinator.com/item?id=5484850, at this point to contact the FBI. If this was happening over a 56k modem on a phone line it would clearly be wire tapping.

I do not currently see a downside, if you see one let me know.

Re: Comcast injecting JS

#276

Post by katbyte »

sbarre wrote: post #7

This is nothing new.. Rogers has been doing this for years in Canada already.. They use it to notify subscribers when they are approaching their bandwidth quota (75%) and then again when they hit 100%. You actually have to click a "I understand" button to have it not show up over and over.

How do they do it? Inject into every page or just once you've exceeded the limits? (curious as i use rogers)

Re: Comcast injecting JS

#277

Post by trhtrsh »

iguana wrote: post #16

They're also violating this patent: http://www.google.com/patents/US20110264729 Which I can tell you for certain that they don't own. Bastards.

    Inventors	 Denis Kulgavin
    Applicant	 Kulgavin Denis
Which one are you?

Re: Comcast injecting JS

#278

Post by teeja »

I don't grok why they'd even try to inject their code into a webpage you requested. Why not simply create a separate page that you see BEFORE, that you read and acknowledge receiving, and then finish sending the requested page?

Re: Comcast injecting JS

#279

Post by augustl »

danyork wrote: post #249
augustl wrote: post #205

Earlier quoted context omitted.

They would either need the private key of the certificate holder (which they don't have), or a certificate signed by one of the roots installed on the system, which they also won't have. I suppose the logical next step is that Comcast requires you to install a "Comcast Internet Helper" program that also installs a Comcast root certificate into the system so they can mitm anything.. But Firefox and Chrome would probab…

> They would either need the private key of the certificate holder (which they don't have), or a certificate signed by one of the roots installed on the system, which they also won't have. Actually, this is fairly common for firewalls and other edge devices to do and is one of the problems with the "trust" in the CA system. You can get a "signing certificate" from various legitimate sources (ex. http://www.sslshopper…

Ouch, I wasn't aware that CAs issued this type of "root" certificates. Is this very common, or will only some CAs do it? If the latter, I'll definitely remove them from my computers list of trusted CAs..

Edit: read the DANE article, seems very sensible and simple to implement that the server specifies valid certificates.

Re: Comcast injecting JS

#280

Post by nkorth »

markdown wrote: post #147

This is the js my ISP (VodafoneFJ) injects into all web pages: https://gist.github.com/mark-up/5297830 It basically optimizes images and replaces all image alt text with text saying to hit CTRL+R to load full-versions of images. I know that VodafoneUK and VodafoneAU do the same. On the bright side, at least they respect the no-transform cache-control header directive.

Sprint does this too.
Post reply on HN