Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast injecting JS

gist.github.com

Post reply on HN
Print view View original

281–288 of 288 posts

Re: Comcast injecting JS

#281

Post by Phlarp »

executive wrote: post #266
Phlarp wrote: post #259

Earlier quoted context omitted.

The database doesn't accept external connections, out of curiosity, what is the proper way to pass connection credentials?

at a minimum: - keep config variables in a separate file that is in your .gitignore and won't get pushed to github. - keep config file outside of any web accessible directory in case the file renders in plaintext for some reason. Regardless of db only accepting local connections - an attacker is one step closer to dumping the db.

Hrm, is there really a problem if the test data on my development server were to get dumped? It's not like those credentials or the accounts stored in the db carry over when this gets deployed to production, nor will the changes for production ever come close to my github.

Still very valuable things to be aware of in future situations where the above might not apply, thank you very much.

Re: Comcast injecting JS

#282

Post by esMazer »

STRML wrote: post #35

This code is beyond awful - it fails to display, makes endless AJAX requests, and more; here are a few fun tidbits: 1. The code is not encapsulated in an IIFE, so it clobbers any global variables (like 'image_url') in the page, breaking any scripts relying on those variables. 2. The code spends an inordinate time checking if you're running Netscape Navigator 6. 3. Strangely, they include a whole bunch of code allowin…

canceled my services with comcast because of this, plus FIOS has an excellent offer around my area! :)

Re: Comcast injecting JS

#283

Post by IheartApplesDix »

davorak wrote: post #272
IheartApplesDix wrote: post #140

Mobile carriers do this too. I see the exact same feature being provided on my Sprint line.

If this was happening on a 56k modem over a phone line it would clearly be wire tapping. I encouraged the op in another post, https://news.ycombinator.com/item?id=5484850 , to contact the FBI. If you see a downside to this let me know, but until I realize one, or have one pointed out I encourage you to do so.

I was just blocking 1.2.3.4, which the inserted js used to download the rest of the "features". I have no reason not to report this to the FBI accept I don't really understand whats going on here so I wouldn't be a good contact.

If you would like to see the content of the script, I can show it to you, it's bit different than the one posted here.

Re: Comcast injecting JS

#284

Post by n09n »

jlgreco wrote: post #208
n09n wrote: post #200

Earlier quoted context omitted.

That's the whole point. Code is not meant to serve the people who maintain it. Maintainability is only a concern once lack of such starts impacting your actual customers. If writing ugly code and fixing it up later is necessary in order to get shit out the door, why is that bad?

So because it satisfies the suits, he should reserve passing judgement? Try again; he is a programmer, not a suit. Hint: there exist many seperate but equally valid systems for judging worth/merit/quality. Also, even for a suit, "Maintainability is only a concern once lack of such starts impacting your actual customers." is only true if by "actual customers" you mean shareholders. If you really want to get down to it…

If you are a money-chasing robot, perhaps. Most businesses care at least a little about making a good product/satisfying their customers. That's good. Making life easy for your employees at the expense of your customers? That's bad.

Re: Comcast injecting JS

#285

Post by n09n »

marshray wrote: post #271
n09n wrote: post #200

Earlier quoted context omitted.

That's the whole point. Code is not meant to serve the people who maintain it. Maintainability is only a concern once lack of such starts impacting your actual customers. If writing ugly code and fixing it up later is necessary in order to get shit out the door, why is that bad?

Because if you want to be a software developer in the long term, you need to prefer the long term alternative in most cases. A typical example is, "If we don't get something out the door, we'll be out of business. 'Shit' is something that can be shipped quickly, therefore we must ship 'shit'." But companies that ship 'shit' generally go out of business anyway. Either their customers find it unappealing and leave, or…

How is that relevant? Comcast is not a software company. Shipping something that works and then never touching it again is exactly what they want.

Re: Comcast injecting JS

#286

Post by namuol »

Tuna-Fish wrote: post #149
namuol wrote: post #109

Earlier quoted context omitted.

Or just make it a browser extension.

Browser extension would require action from end-users, making educating them using it rather redundant. Doing detection in JS can easily be deployed on servers with minimal work needed, and can potentially reach a very wide audience.

I was suggesting a browser extension to undo the mangling once users are educated. I must have misunderstood the original idea.

Re: Comcast injecting JS

#287

Post by jakub_g »

testtata wrote: post #251
jakub_g wrote: post #211

I live in France and I'm a customer of Orange. I was really surprised to see on my mobile, on Facebook (m.facebook.com - I've noticed it only there, but perhaps there are more pages like that) they're injecting a HTML with "Return to Orange World" link in the footer directing to orange.fr. Not sure if anything more though - I have a plain old mobile with Opera Mini. I'm curious if they have some deal with FB to do it…

It could be the fact that you have a strange combination of both an old phone and (what could be a customized) Opera Mini. I have an iPhone at Orange and never saw this.

I've installed Opera Mini on my own, so it's not customized.

Re: Comcast injecting JS

#288

Post by readme »

dangrossman wrote: post #71
readme wrote: post #61

Earlier quoted context omitted.

Nope, I don't have it. Are you Canadian? Maybe it's a Canada thing? Doing it to tell you about your data allowance is a bit excessive, for sure.

You don't have what? Comcast had a data cap nationwide (250GB/mo) even if you weren't aware of it. They temporarily stopped enforcing it outside of two test markets (Nashville and Tucson) where they're working out exactly what limits people will put up with. You wouldn't see this popup unless you live there and you've used over 225GB this month.

Thanks for the explanation.
Post reply on HN