... And that is why you open https.
Comcast is injecting 400+ lines of JavaScript into web pages
101–110 of 498 posts
Re: Comcast is injecting 400+ lines of JavaScript into web pages
#102Earlier quoted context omitted.
I have a few years of experience inside Comcast and I've concluded that Comcast's executive management are the ones at fault here. Across several divisions, their engineers have been fantastic and a pleasure to work with. This all goes to shit when the businesspeople around the engineers are making terrible, selfish decisions and optimizing their hourly employees for numbers (call center I'm looking at YOU)
Good engineers don't do evil things, even if their bosses tell them to.
"Good" as in morally upright? (in which case true).
or
"Good" as in technically competent? (in which case untrue).
Re: Comcast is injecting 400+ lines of JavaScript into web pages
#103This is the bit I find amazing: > Comcast has my phone office number, my cell for texts, my email, and my home address, yet they choose to molest my requested web pages by injecting hundreds of lines of code. [JL] The notice is typically sent after a customer ignores several emails. Perhaps some of those ended up in your spam folder? So ignoring spam entitles you to this behaviour?
What he is saying is that they exhausted all other contact methods. If they stopped after the email and let the persons modem stop working, they would have likely been livid about that as well. Look, I don’t like Comcast any more than you do. But at some point, you need to recognize your biases when evaluating your enemy. I thought this was some nefarious attack based on the headline, but it’s just a critical system…
(a) It's not critical, it's a marketing message.
(b) Pretty sure if the person's modem were to actually stop working, they would get in touch with their ISP.
Man-in-the-middle attacks by an internet provider are hacking and a breach of trust, and should be criminal in my opinion.
Re: Comcast is injecting 400+ lines of JavaScript into web pages
#104J. Livingood (a Comcast VP) responded to the OP: > [JL] We are not trying to sell you a new one. If you own your modem we're informing you that it is either end of life (EOL) or that you are about to get a speed upgrade that the modem will be unable to deliver. Incidentally, Livingood is a co-author of IETF RFC 6108, which he has conveniently linked. From the RFC's general requirements numero uno: > R3.1.1. Must Only…
>As composed as Livingood's response was, a modem at EOL and/or incapable of supporting an incremental speed upgrade doesn't strike me as critical. Exactly. And the response, "we're not trying to sell you a modem, we're just encouraging you to strongly consider buying a new one" is such a hair-splittingly asinine response considering the rather serious breach of trust posed by the notification system.
> And the response, "we're not trying to sell you a modem, we're just encouraging you to strongly consider buying a new one"
Making up quotes like this is against HN guidelines (and common decency).
Re: Comcast is injecting 400+ lines of JavaScript into web pages
#105The thing that's so irritating about large telco's is not just that they're evil, but the casual stupidity of their actions, including their evil actions. I mean, look at the code. Look at the function of this code. Look at the business purpose of this code. Look at the security aspects of using this code. Look at the legal ramifications (why the hell is that LGPL thing up top there ?). Look at their internal communi…
True evil isn't of the calculating kind. It's the incredibly stupid kind.
Re: Comcast is injecting 400+ lines of JavaScript into web pages
#106Earlier quoted context omitted.
The technical capability to MiTM TLS exists since the very moment TLS was designed. It all hinges on the ability to get a trusted certificate for the domain you want to MiTM. You can do TLS MiTM with Apache if you choose to. Acquiring the Cert has always been the problem and nothing changed in that regard. Strictly speaking, things on that front have become harder since browsers are becoming more and more strict abou…
Comcast and their telco friends just managed to lobby legislation away while completely ignoring complaints and good business. It doesn't look like Americans have any power to fight against these companies so trust into other for-profit companies which are reliant to Comcast & Co. for their profits seems a bit optimistic to me :/
That post wasn't about legislation. It was about the fact that if Comcast started trying to install root certs on the machines of customers using them for their ISP (which itself is unlikely because of the extra cost both to install, and to troublehsoot, i.e., "why can't I browse anything when I am on my new phone"), Google, Apple, and Microsoft could, and likely would, decide to reject them in their respective browsers as being untrusted. Because they have seen fit to do that in other instances where user security was compromised, and an ISP MITM every bit of your traffic is no less alarming.
Re: Comcast is injecting 400+ lines of JavaScript into web pages
#107When reading about Comcast I was always wondering why they have no competition when everyone who comments is complaining. I live in France and use Orange as my fibre provider. 1 Gbps/250 Mbps without constraints. I used to have Free which was great but did not offer fibre when fiber was installed. I switched to Orange in 5 min via a web page. I have another possibility (SFR) but they are despicable liars and for this…
In a natural monopoly regulation /increases/ competition and freedom for the consumer. The BBC had an article about this a few years ago [0]. Basically the highly regulated countries had cheaper and faster internet. > Rick Karr, who made a PBS documentary in which he travelled to the UK to find out why prices were lower, says that the critical moment came when the British regulator Ofcom forced British Telecom to all…
It might be easier to convince me ISPs were a natural monopoly if they weren't also a legally protected monopoly where they are, and generally have plenty of competition where they aren't.
Re: Comcast is injecting 400+ lines of JavaScript into web pages
#108So how exactly is this not criminal?
They are not blocking, throttling, or interfering (in any way that harms functionality) with legal applications; in a nutshell that is 2015 requirement. Now, if that Javascript happens to interact badly with some particular web page, then you could complain to the FCC as long as the 2015 rules remain in effect (which is more than a week, for what that's worth).
In a way it throttles.. lets pretend they included 4,000 lines of code in each website, or a 1gig of data. It also throttles the experience by taking up processor cycles to render the data. It harms functionality because the popup covers usable website area, and what was meant to function without closing a popup does not. It blocks screen real estate. I really hope someone makes a case.
Re: Comcast is injecting 400+ lines of JavaScript into web pages
#109This is the bit I find amazing: > Comcast has my phone office number, my cell for texts, my email, and my home address, yet they choose to molest my requested web pages by injecting hundreds of lines of code. [JL] The notice is typically sent after a customer ignores several emails. Perhaps some of those ended up in your spam folder? So ignoring spam entitles you to this behaviour?
What he is saying is that they exhausted all other contact methods. If they stopped after the email and let the persons modem stop working, they would have likely been livid about that as well. Look, I don’t like Comcast any more than you do. But at some point, you need to recognize your biases when evaluating your enemy. I thought this was some nefarious attack based on the headline, but it’s just a critical system…
I sincerely disagree, especially as per the report Comcast's own second level confirmed there was no need to replace the modem. It was an automated advertisement done in a very not good way; Comcast's own billing system notifies you of just about everything else; you can forward your billing statements and other such information to other emails, why not this?
The reason everyone is freaking out is because they feel pretty darn strongly that the ISP should not be injecting code into webpages delivered, especially not in an automated way without some oversight. If this is to be a service, the bar for what is necessary for such information must be far higher than "an automated system decides it's time." We get into really scary territory just by doing this in the first place, but to use it for advertisements or basic maintenance? That is a misuse of such technology.
And no, I don't think people would be as livid as you suggest if the modem just broke; ISP modems are fragile little things, and it's not uncommon to go through them. I don't think I've had a single ISP where I didn't have to eventually, and the natural progression for each one (Comcast included) was:
1. I called the ISP
2. We did some test with support
3. Once we did the Speedtest / reboot song and dance, a new modem was issued that day.
This is expected; if I had asked for such a service from Comcast, this would be a different discussion entirely (an Opt-In service), but as it is, it's a pretty lame reason to suggest that Comcast needs to be able to inject data into pages I load.
And I rather liked Comcast for the year I had it - I wasn't keen on being on them since I would rather have been with our Municipal, but the place I was at was not yet in a service area for the municipal. More or less, even with my support and canceling experience, I was fine with the service I received. This would have upset me considerably.
Re: Comcast is injecting 400+ lines of JavaScript into web pages
#110Earlier quoted context omitted.
Good engineers don't do evil things, even if their bosses tell them to.
"Good" as in morally upright? (in which case true). or "Good" as in technically competent? (in which case untrue).
These are not separate concerns. Morality is a necessary part of competence.