Live data from Hacker News

Comcast is injecting 400+ lines of JavaScript into web pages

forums.xfinity.com

121–130 of 498 posts

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#121

J. Livingood (a Comcast VP) responded to the OP: > [JL] We are not trying to sell you a new one. If you own your modem we're informing you that it is either end of life (EOL) or that you are about to get a speed upgrade that the modem will be unable to deliver. Incidentally, Livingood is a co-author of IETF RFC 6108, which he has conveniently linked. From the RFC's general requirements numero uno: > R3.1.1. Must Only…

>As composed as Livingood's response was, a modem at EOL and/or incapable of supporting an incremental speed upgrade doesn't strike me as critical. Exactly. And the response, "we're not trying to sell you a modem, we're just encouraging you to strongly consider buying a new one" is such a hair-splittingly asinine response considering the rather serious breach of trust posed by the notification system.

> Exactly. And the response, "we're not trying to sell you a modem, we're just encouraging you to strongly consider buying a new one" is such a hair-splittingly asinine response considering the rather serious breach of trust posed by the notification system.

Well, what I meant (within the response length constraints of Twitter) was that we're not saying you can only buy it from us. Just that the customer needs to buy it someplace. That way a customer can do as the wish - ranging from buying a used one on eBay to getting a new one from Amazon or Best Buy.

Ultimately the objective is to ensure a customer is on a device that can (1) deliver the performance for which they pay and (2) is up to date technically (i.e. supports IPv6 and channel bonding) and is supported by the vendor (i.e. software updates & bug fixes).

One of the big risks we have to help mitigate is when a device goes EOL, which means no more software updates, and a security or significant performance issue arises in the future. By proactively beginning the replacement process this helps minimize any future impact when it is a major issue like that. So taking action gradually on a proactive basis prevents a more severe impact later on. In many cases, these are DOCSIS 2.0 devices and that technology and often the software is from 2001, the same year as the 1st gen iPod and when Windows XP was released.

Eventually a modem will go into End-of-Service (EOS) status. At that point there is a definite date/time limit for the device, after which it is de-provisioned from the network and the customer must replace it to continue service. This has been the case in the past with DOCSIS 1.0 and 1.1 devices for example, after years of work to encourage customers to replace them.

See also https://www.xfinity.com/support/articles/end-of-life-devices and the start of the EOL/EOS process for DOCSIS 1.1 devices https://www.dslreports.com/forum/r27473499-Speed-Heads-Up-Ti... and https://www.dslreports.com/forum/r28497383-Speed-Upgrade-You... and https://www.dslreports.com/forum/r30524429-Equip-Reminder-Pl... and https://www.dslreports.com/forum/r30450278-Speed-Heads-Up-Ti...

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#122

Unfortunately, in the US and Europe at least most people will care about this and even get a response. I think 4-5 years back when I was in one of the cities in which MTNL is there in India, ads were being served in the same way on MTNL. They were injecting an ad serving pop-up on every page served on HTTP. The worst thing was it sometimes used to show some sketchy virus ads also. I complained about it multiple times…

You just needed to change to google DNS, which you would have to do anyway - AWS CloudFront doesn't resolve at all in some circles.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#123

J. Livingood (a Comcast VP) responded to the OP: > [JL] We are not trying to sell you a new one. If you own your modem we're informing you that it is either end of life (EOL) or that you are about to get a speed upgrade that the modem will be unable to deliver. Incidentally, Livingood is a co-author of IETF RFC 6108, which he has conveniently linked. From the RFC's general requirements numero uno: > R3.1.1. Must Only…

> Although I disagree with Comcast's method and categorization, it would be interesting to learn what modem the OP was using. We start telling customers that a modem needs to be upgraded when one of two things happen: either they are about to or just had a speed upgrade that their modem cannot support or the modem has gone end-of-life (EOL) from the vendor. In the former case, if the device is leased, you are send a…

If only there were some way to notify your users that wasn't so scummy... like via email or regular mail

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#124

When reading about Comcast I was always wondering why they have no competition when everyone who comments is complaining. I live in France and use Orange as my fibre provider. 1 Gbps/250 Mbps without constraints. I used to have Free which was great but did not offer fibre when fiber was installed. I switched to Orange in 5 min via a web page. I have another possibility (SFR) but they are despicable liars and for this…

You were able to switch in 5 minutes because nothing actually changed except who sent you the bill. In the US this isn't possible because whoever owns the physical wire/fiber into your place gets to bill you, exclusively.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#125
post #39

Earlier quoted context omitted.

There are several corporate firewall products that can do just that. Comcast can just start demanding that their customers install their root cert and that's that. Remember they are the only venue to access the internet for a lot of people, what are they going to do? Stop using the pretty much mandatory communication and information platform? I'm always surprised just how many people here on this site think you can f…

They could, but they don't. Until they do, or imply in any way that they might, let's stick to the facts and leave wild, flailing speculation to reddit. Regardless of what an ISP might do, HTTPS everywhere is excellent advice.

> HTTPS everywhere is excellent advice

I couldn't agree more! That's one of the reasons for example we have supported groups like Let's Encrypt (http://labs.comcast.com/innovation-fund-spotlight-lets-encry...) and CrypTech (https://cryptech.is/).

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#126

Ignore their spammy emails? Per their VP, they are totally going to up their game and inject their "notifications" in your everyday Web traffic. https://twitter.com/jlivingood/status/939848009386549248

What I meant in the context of that exchange was that the notifications come only after for example multiple emails have not resulted in the device being replaced.

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#127
I thought HTTPS was supposed to prevent this sort of man in the middle attack? (Or at least make it harder) -- and I thought that most websites used HTTPS these days...

or am I misunderstanding?

If they are able to do this, and are injecting JavaScript for something as low-return as online ads, then what is to prevent them from changing the news headlines on , or the stock ticker feed... How do we know that they aren't?

Do we, as a community, have any mechanism to detect if these sorts of attacks are occurring?

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#128
post #94

Earlier quoted context omitted.

Good engineers don't do evil things, even if their bosses tell them to.

A mortgage and tuition for kids is a powerful motivator.

The yuppy nuremberg defense. From the excellent movie "thank you for smoking"

Re: Comcast is injecting 400+ lines of JavaScript into web pages

#130

When reading about Comcast I was always wondering why they have no competition when everyone who comments is complaining. I live in France and use Orange as my fibre provider. 1 Gbps/250 Mbps without constraints. I used to have Free which was great but did not offer fibre when fiber was installed. I switched to Orange in 5 min via a web page. I have another possibility (SFR) but they are despicable liars and for this…

> everyone who comments is complaining

"Those who comment" are far from a random sampling of the user base. It's entirely possible that 95% of users are satisfied "enough" with the service and yet nearly 100% of comments to be strongly negative.

Post reply on HN