Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comcast injecting JS

gist.github.com

Post reply on HN
Print view View original

261–270 of 288 posts

Re: Comcast injecting JS

#261

Post by dspillett »

Do comcast users come from a recognisable range of addresses? If so I might have to add a warning to everything I output along the lines of:

"Your ISP (Comcast) adds terrible Javascript to the code of this page without our knowledge or permission, therefore if you have any problems with this application please contact their support line in the first instance and not us. While your ISP is modifying our code, especially while they are modifying it by adding such terrible code of their own, we simply cannot support you, sorry."

Re: Comcast injecting JS

#262

Post by brokentone »

dspillett wrote: post #261

Do comcast users come from a recognisable range of addresses? If so I might have to add a warning to everything I output along the lines of: "Your ISP (Comcast) adds terrible Javascript to the code of this page without our knowledge or permission, therefore if you have any problems with this application please contact their support line in the first instance and not us. While your ISP is modifying our code, especiall…

No but their hostnames generally call out "comcast" somewhere therein. I've called out some affected clients elsewhere.

Re: Comcast injecting JS

#263

Post by Osiris »

juiceandjuice wrote: post #97
mbreese wrote: post #86

Earlier quoted context omitted.

As a different point, my place was already pre-wired. I bought a cable modem from Best Buy, and plugged it in. It synced immediately. Then I went online and ordered service. They charged me $10 to send a self-install kit, but it wasn't needed I was actually online within minutes. So sometimes their systems work... I was very sad about switching from my other carrier (Sonic.net), but they ultimately couldn't deliver v…

> And Comcast was actually cheaper. At least for the first 6/12 months. Then you get to haggle and threaten disconnection for a day, then you are good for another 6/12 months.

That didn't work for me. I threatened to leave for CenturyLink DSL unless they could give me a better deal and the only thing the lady offered me was a triple play package for more than what I was already paying. So I had to switch over to DSL at 12/1 speeds.

The one good thing is that CenturyLink isn't part of that 6 strikes deal.

Re: Comcast injecting JS

#264

Post by anExcitedBeast »

atomicpanda wrote: post #242
anExcitedBeast wrote: post #237

Earlier quoted context omitted.

noscript.

Actually, I dont' think noscript/notscript will block this. It blocks loaded javascript, not inline stuff.

Any chance you can elaborate a bit? I'm not as familiar with how JS is loaded and exactly what noscript does as I should be.

Re: Comcast injecting JS

#265

Post by shahar2k »

I see a lot of discussion on the quality of the code, but not much about the fact that Comcast is modifying the content they are serving without informing their customers AKA the legality of the situation...

Re: Comcast injecting JS

#266

Post by executive »

Phlarp wrote: post #259
executive wrote: post #184

Earlier quoted context omitted.

You should be scared... what's with the hardcoded login info exposed on github? https://github.com/Machtap/_ctv/blob/master/_www/model/commo...

The database doesn't accept external connections, out of curiosity, what is the proper way to pass connection credentials?

at a minimum:

- keep config variables in a separate file that is in your .gitignore and won't get pushed to github.

- keep config file outside of any web accessible directory in case the file renders in plaintext for some reason.

Regardless of db only accepting local connections - an attacker is one step closer to dumping the db.

Re: Comcast injecting JS

#267

Post by bphogan »

dchichkov wrote: post #196
bphogan wrote: post #76

Earlier quoted context omitted.

They're all over the place. People just starting out. It could've been an intern fresh out of college. It could've been someone who just never graduated beyond copy-and-paste-from-StackOverflow. It could've been written by a person who never did web development before and was just told to make it work. The little HN/Twitter/Reddit "awesome programmer" bubble is just that... a bubble. It's easy for us to forget that l…

You know, there is nothing wrong in picking up code from stack overflow. If you are very efficient in picking up good, well written snippets that fit the style of the project and work without debugging and any time waste - more power to you. Personally, I consider google search (and stack overflow) as an extension of my development environment and I'd recommend using it and melding your dev env with google search as…

I agree - there's nothing wrong with picking up code from SO if you trust it and understand it. But that takes experience .

I've come across lots of situations where the accepted answer isn't the best answer.

So I'm talking about knowing vs. cargo-culting.

Re: Comcast injecting JS

#268

Post by betterunix »

brokentone wrote: post #233

edit: I'm OP, not the content author. I serve a media website, which is where I noticed and from where my concern stems. Comcast users should also be concerned about this. Just scanned my logs more fully and have serious concerns. As people have noted, this really does make requests every 5 seconds. My 404 page is currently 18KB, which means these users (who are being warned about their bandwidth) are being forced by…

"So what do we do about this?"

Use TLS, warn customers about a malicious ISP attacker their connection, set up an encrypted proxy/VPN service for people to use, etc.

Post reply on HN