Comcast is injecting 400+ lines of JavaScript into web pages

Their voice quality on VoLTE is perfect.

Verizon is far and away the market leader in international roaming and it isn't even remotely close. At least in my experience.

Source: Tried to get away from VZW for a decade now - international roaming always being the ultimate decider.

Curious who you've found to be better.

Verizon has always been that shit-tier company ran by borderline criminals which happens to have the far superior network and hard product.

You can disable the hotspot and use your own DNS servers if you want. The ability to disable the hotspot is documented in the public FAQ (Google: "XFINITY WiFi Home Hotspots FAQs").

I've used my own DNS servers before. I have no problem making DNS queries to 8.8.8.8, and in fact I switched my PC to use it one time when Comcast DNS was down.

As the other person has said, they have a FAQ for disabling the hotspot. I additionally set my modem to bridge mode in order to use a more capable router. It does look like Comcast mandates the use of their DNS whenever possible, and I'm sure that I bothered to configure an alternative because of reliability issues as well.

Apologies; I never used DOS enough to retain that acronym.

Do you know the public access point data is being attributed to customers' usage totals? Or does that just seem like the sort of thing they'd do?

Funny enough, I tend to avoid these type of discussions because surprise surprise, I got downvoted and they didn't even answer the core question.

Why should a customer pay to add value to comcast? They aren't getting a discount if they enable the service.

The data used by other customers on Xfinity wifi does not count against your data cap

> Except comcast has datacaps for total transfer per month.

The extra access point doesn't count towards your data cap.

> Except comcast has datacaps for total transfer per month.

For you. Not the public wifi network that is served before it hits your LAN. This is what I meant by my original post - there are tons of misconceptions on this.

Your ratelimit is not effected either, at least not any more than your neighbors do who exist on the same headend as you.

> why should a user who is paying for the service subsidize comcast.

How is it subsidizing Comcast again? I just don't see this point - the only possible way you are subsidizing it is with increased spectrum usage (which is a valid point) and perhaps additional power usage - but we're talking pennies per year if it's even measureable.

Tower space? This sort of product wouldn't exist without it.

I think it's confusion on where customers think or feel the demarc is. The ethernet port on the modem is your demarc, not the cable entering your house. If Comcast did something to alter and/or impact traffic after

> They are not getting a discount for offering the wifi to customers.

Of course they are? You get access to everyone else running the same AP in their homes, so when I travel I don't have to worry much about broadband access. It's especially great at airbnbs with broken internet - I can simply use the neighbors xfinity AP. It's actually an incredibly consumer-friendly thing we used to speculate on in the late 90's and early 00's when wifi was just starting to become a thing.

I do agree it should be something you can toggle in a user interface, but turning it off should remove your access from the xfinity wifi pool. I also completely understand why it's not optional - due to the ignorance shown in the thread. Most consumers think that me torrenting on the Xfinititywifi AP is somehow impacting their data cap and/or throughput. It's not, and even highly technical people continue to perpetuate this myth.

I'm about as anti comcast as they come - but this is one of the better more consumer friendly things any ISP has done, much less Comcast.

If you're rewording something someone else said, even if you're keeping it very close to the original words, don't use quotation marks. Quotes say "this is literally what was said".

I got bit by this a bunch when I first got on HN; it was surprising to me how seriously it was taken. But it is, and it's not hard to work around.

Making up a weaponized quote that's close to what was originally said is actually worse, because then it's harder for passers-by to tell apart and more injurious to the original statement. By 'weaponized' I mean altering it to sharpen the point for indignation or snark purposes. It's a harmful internet practice that we've asked to users to abstain from.

You're right that it isn't explicitly mentioned in the site guidelines, but those aren't a list of proscribed behaviors but a set of values to internalize. I'd say "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize" covers this case pretty squarely.

It's true that if there's a vulnerability discovered, and you have 50000 modems with the vulnerability, you cannot wait for the modems "to be hacked" to act. It is reasonable to try to replace EOL modems ASAP.

because traffic injection is free, postal mail costs money.

As was mentioned in the original thread, other means of attempting to contact the individual occurred. This was apparently not the first attempt or method used to contact individuals.

> Why traffic injection instead of mail pieces? I mean, I open all of mine, even the 75%+ that are upsells I don't want, on the off chance one of them will tell me something I need to know.

Lots of reasons, including years of experience with response rates for particular types of messages / calls to action. Clearly one particular communications channel won't work for everyone - each person has their own preferences. One of the things we're working on is to better enable you to control just that - basically one person may ask for SMS messages, another alerts via their mobile app, another via email, another via phone call, etc. You can see the beginnings of that in MyAccount / Settings / Communication & Ad Preferences.

> But with Let's Encrypt, browser manufacturers, and friends leading the charge toward TLS everywhere or as nearly so as is practical, and with most sites that most people use already employing TLS, the attack surface is closing for even an other-than-innocuous variant of your notification methodology.

Agree. And more TLS is better IMHO. I also like the work that Let's Encrypt has been doing - they've had a really big impact on the adoption of TLS. (See also http://labs.comcast.com/innovation-fund-spotlight-lets-encry...)

> Of course, that also means that that methodology itself is reaching a natural end-of-life, as it cannot work anywhere that TLS exists, and the majority of the web where it does exist continues to grow. If this low-latency notification scheme is of unique value to your business, then now is the time to consider replacing the outdated technology that underpins it with something which will continue to work reliably over the next decade or two.

You bet - totally agree! One of the places we're engaging to try to do that is in the IETF's CAPPORT working group and I think the charter describes reiterates all the points you made: https://datatracker.ietf.org/wg/capport/about/

> All that said, I appreciate your decision to engage in this forum. That's unprecedented in my experience from someone in a position like yours, and I wouldn't mind seeing more of it.

My pleasure & thanks for being a customer that's willing to offer constructive criticism. :-)

With all the junk mail I get from my cable company about "upgrading" my service to include some crap I don't want, I would think they could find a way to slip in a "hey, your modem's busted" notice.

I don't know what's worse: the straw man attempt at arguing efficacy while focusing on the weaker of two suggested options, or the (presumably) unscalable slippery slope of dispatching personnel to a customer's front door.

In either case, the argument does not address the fact that customers recognize unsolicited packet injection as unacceptable ISP behavior. Without support metrics, we can argue all day about the efficacy of one method of delivery over another, but the fact remains that no sensible user would perceive e-mail and/or post of official notice from their ISP as overtly intrusive. With as much internal advertising as Comcast distributes amongst its existing customers, it blows my mind that official notice generated from boilerplate and delivered via snail mail would fail to achieve the intended goal.

To be sure, your pre-edited comment: > Surely showing up in-person at their door must be an even more effective "reminder" than the browser injection! Is that next?

I find the reverse is true. My USPS mailbox receives daily credit card application forms, electoral flyers, catalogues, etc. I also get frequent mail from Comcast but they are _all_ bullshit ads, trying to hoodwink me into cable TV. I don't open them anymore, they just go in the bin.

I will at least _glance_ at my email.

They could sign their messages? Also needs users to have easy to use mua that handles signing and shows "this is genuinely from your ISP unless they/you've been hacked".

For critical service info I'd want SMS personally, from a verified number with a link on the company main domain to verify the info.

I mean, the end-user who requested the page certainly has a right to voluntarily inject script into the page they requested as it is rendered in their own browser running on a machine they own connected to an upstream internet provider they pay for access? Nice try at false equivalence however.

Don't give them ideas... this comment was brought to you by by Inject-o-Matic Marketing services

Ok. You're right, that last line was not necessary.

> We all know what the culture of online shaming has led to and it's all our job not to do it on HN.

This is, in and of itself, a blaming statement. Blaming statements, such as the one contained in the comment you replied to, are a result of a) dissonance and b) inability to resolve the dissonance.

It is, in fact, unknown what the culture of online shaming has led to in our society. In fact, I'd hazard "shaming" online is actually just raw blame provided by some rationalized thought process driven by Internet interactions themselves, not the people reacting. See This Video Will Make You Angry on YouTube for context. Screwing with people's Internet in contextually what could be considered "wrong" behavior becomes highly polarizing. In as much as someone coughs because they smoke, people blaming is a result of a larger problem, perhaps related to the fitness of memes and some people's weakness in being hacked emotionally by memes with higher sophistication. Again, that problem is noted by the dissonance and inability to resolve it, but the behaviors emerging from those who are "infected" by the thoughts are not exactly theirs to bear alone. We blamed the tobacco industry for smoking. Why can we not blame the employees who are providing the rationalizations for bad behavior? One might argue that they shouldn't be blamed because they have no choice in the matter. It may be their job to argue otherwise for the company.

The irony here is that vast majority of the denizens of HN are likely responsible for creating most of the "mess" we're in today by writing software without considering the long term effects on consciousness and perception of reality. That "mess" would be defined as means, by algorithms or neural networks, to attempt to exploit weaknesses in human nature to spread other's beliefs in a unnatural way. Growth hacking. In some cases, like Comcast, those beliefs are rooted in sophisticated rationalizations which sound good when limited in scope. But! I don't care what anyone says about it, changing the content of a page which, when requested from one place returns one thing and when requested from another (which ones pay for I might add) returns another thing entirely is a violation of TRUST. At least it is to me. I like consistency in my data.

If one of the "members" of this group we call HN wants to make a blaming statement against someone who is defending this irrational logic, then I say let them blame! How else are we to uncover the dissonance and solve it? Or, perhaps, that dissonance is desired to be left in place by our complicit behaviors trying to be "nice" to each other.

I've suggested before social media sites could benefit from a "this is a blaming statement" flag on articles or comments. I stand by that assertion today. Logging back out again. Thank you for all the hard work that goes into running this place.

Downvoting because they weren't that snarky and because of your smugness. Your willingness to tell some one straight up why you downvoted them was good however.

TBH what kind of game doesn't use https...

I think it’s funny you’re approaching your data cap and they add 400 lines to the size of each web page you visit. I hope pages they tamper with are subtracted from your cap.

This is exactly why Comcast is still the most hated company in America [1], and the only reason you have any customers is due to the monopoly deals of dubious legality you or your acquisitions bribed local officials to create back during the infancy of cable. We hate you, but we don’t have any choice.

It’s worth noting that government regulation created Comcast by allowing long-term monopoly contracts with municipalities. Remove the regulations which prevent competition in local internet and TV services; don’t add more regulations.

  [1]: http://finance.yahoo.com/news/america-most-hated-companies-110032495.html

They emailed my Comcast.net address, which I didn't even know I had.

Then they ought to stop abusing the communication channels they have. If they send so much email and snail mail spam that the customer automatically ignores it, that's the choice they have made.

I am so sick and tired of xfinity mailings addressed to me or my wife or former residents of the home address asking us to switch to them for a two year discount that I know they won’t give us because we’re already a customer. They even just jacked my rates yet again.

I’ve had to patch against this in the past when it turned out my system was breaking for a set of users whose company was installing a browser extension that injected JS that broke the app. Never did find out exactly what it did, but I worked around it but fixing the progressive enhancement to work properly in the context of broken JS as well as no JS.

I wonder if your customers would be happy enough without the speed upgrade if they weren’t wasting bandwidth downloading code they never wanted to run in the first place

Comcast does not provide any speed on residential lines that DOCIS 3.x cannot accommodate. It is like requiring Formula car to drive on a gravel road in Alaska.

This is laughable in light of Comcast warring against net neutrality and lying about it to customers and everyone else.

Laughable.

Incumbent ISPs lobby local govermment and sue would-be competitors to ensure the competition are only offered access on less favourable terms.

Let's not sugar coat the language by referring to them as franchise rights, they're state-sanctioned monopolies.

I'm not trying to blame anyone specifically. This is just a major rhetorical exploit that works on Republican-leaning voters. I know because I and many of my associates are Republican-leaning and very conservative, at least by HN standards. We need to call out these divisive rhetorical exploits because they're used by nefarious groups to subvert actual dialogue and keep people at the extremes.

By no means do I believe that Democrats or liberals have clean hands on this. All sides deliberately ignore and subvert intellectual property matters because it is so dang profitable, and this affects "liberal" industries much more deeply than "conservative" ones. Copyright is fundamentally "big government", which more conservatives would recognize if the narrative around this issue wasn't so tightly controlled. And that's not to say that copyright doesn't serve a useful purpose at all, just that we should be cautious and wary about it.

Since bad political actors and profiteers actively and successfully cultivate tribal dynamics for their benefit, the tribal context and instinct can't be ignored. It must be worked within. Approaching a tribe as an outsider just causes them to raise their shields and ignore anything you say.

Good principles and values drive most actors on both sides of the aisle. Political alignment basically seems to just come down to which principles we prefer to favor/bias. Under that context, the need for balanced, inclusive dialogue is clear, and we should all be grateful for the diversity of opinion that keeps everything in balance.

Maintaining that diversity means working within the structures of human association to create authentic, grateful alliances built on that recognized need, instead of allowing others to abuse those same structures to provoke destructive animosities.

I think the intent was to comment that extensions don't protect programs with embedded web views, like the steam store. I'd hope the steam store is using https though...

That is precisely the problem. If the notification were rendered as part of the page by the web server, no one would have issue with it (though it would likely be blocked by adblockers anyway).

It's the fact that the ISP is modifying traffic in-route, to inject something that was never intended to be part of the page, that is the problem.

I expect my ISP to be a neutral carrier of messages, not meddling and altering my mail to add whatever they happen to feel like adding today.

Yup, but "these attacks" in your first post was specifically HTTP modification, which is the only thing Comcast is capable of doing.

Yes, if the index.html is not HTTPS or otherwise compromised.

> The current problems are that a) since Trump the FCC is $#\¥

Oh please, he’s been in office less than a year - none of this amazing ‘sharing’ happened under the previous administration either. It’s totally understandable to have (in my case many) disagreements with the Presidents and their policies, but this knee-jerk habit of blaming whoever is currently in office for everything because he’s not on our team is counterproductive.

I don't really think it's perfect - it lets BT milk OpenReach rather than reinvest more. But it's decent.

It's worth noting, though, that this is the EU's doing, through the Telecoms Directive, not something the UK government did of its own accord.

To be fair, I'd say "good engineers" especially where Comcast is, probably choose their employer not the other way around. Not to say whether they are right or wrong for working there, but we shouldn't pretend "good engineers" are otherwise destitute.

A good person doesnt blindly follow orders period. You dont get to call yourself a good person just because you signed a mortgauge or had a kid. If your actions are bad, then you are bad.

The yuppy nuremberg defense. From the excellent movie "thank you for smoking"

These are not separate concerns. Morality is a necessary part of competence.

it's the engineer part that suggests the moral uprightness. without that, it's more "developer"

"good" as in having the qualities required for a particular role, as per Google.

They could, but they don't. Until they do, or imply in any way that they might, let's stick to the facts and leave wild, flailing speculation to reddit.

Regardless of what an ISP might do, HTTPS everywhere is excellent advice.

> Comcast can just start demanding that their customers install their root cert and that's that.

Comcast can demand all they want but they are going to have to hand hold a lot of people though the process. Sure Windows/Mac could offer a nice executable to install it for you but you still have to get people to install it and that’s not something there while customer base will be able to do.

The process of installing CA’s on iOS devices involves even more steps. And this is a process that will have to be completed every time an new device is put on their network.

What about even more “locked down” systems? Your IoT doorbell? Your networked cctv camera? Your Smart TV?

Is it possible? Sure. Is it practical? If kazakhstan couldn’t do it I’m going to struggle to see Comcast pull it off (though if anyone can, it’s prob them). See in a Corp environment where they own all the devices it’s fairly easy to do as most of your deployed hardware if going to be able to remote install what IT asks of them, your mobile devices are going to be enrolled into MDM’s and you will have IT staff on hand to help staff enroll their devices. None of which Comcast have.

We are not talking about your avg hacker news reader configuring their devices to get online, we are talking about people like my mother who can just about browse the web and play games on her iPad and struggles to set the alarm on it. How you going to get her to install the rootca without having some do it for her? Sure get the installer to do it? But what about all your existing customers? You going to schedule a call out for each of them? And what about when she gets a new device? You going to make her take the device to the local Comcast store to get it installed?

Oh and Chrome and or Firefox could throw a massive spanner into the works by refusing to accept their root cert half way though deployment meaning all those “updated devices’ need to be updated again before they even had a chance to use it at any major scale.

Sure it’s possible, I just don’t see it as practical as of today.

All of these products require that a corporate root certificate is installed on the devices initiating the connection. This would require that all users install the cert on all devices, some of which do not allow such an install. I don’t think you can install certs of your choice on a PlayStation, an Amazon Echo, an Apple TV or any of the home automation systems. This would break all of those devices. It would also break any app that uses cert pinning. All of this is manageable in a corporate setting where you can remotely configure all devices and have a suitable IT support operation, but it would be an absolute support nightmare for comcast if random stuff just breaks when on their network. Think about what happens when Apple TVs or tivio boxes come with a sticker explaining that they don’t work on Comcast networks because Comcast does not allow secure communication. Banks would require their customers not to do internet banking while on Comcast networks since secure connections cannot be established.

> I'm always surprised just how many people here on this site think you have fight social/political fights with technology. Especially when it comes to entities that can bribe legislation and control your communication.

I don't understand. Your second sentence seems to contradict your first; Comcast bribing legislators is a social/political attack. What did you mean?

I currently see more hope in tech solutions than political solutions to the problems of privacy, net neutrality, and script injection. We have the option to use content and routing encryption technology that looks something like TOR or I2P. Instead, we're asking politicians who don't understand the tech to protect us from ISPs who will never stop trying to leverage anything they can find in our traffic. Allowing Comcast to see the traffic at all is the problem, and politics will never prevent that.

If it's apparent to you that the political fight is more winnable, or that technical approaches to privacy are doomed, then what is the social/political solution to internet privacy? Because we don't have any right now, and it looks like we're losing the political war.

> It was not an ad - it was a request

As a Comcast customer, I request you discontinue this injecting of javascript into webpages for ANY reason, unreasonably limiting an INFINITE RESOURCE and monopolizing localities so you are the only viable choice. This should not be the behavior of the largest telecom provider in the continental US. We deserve better.

Well, thank you for the response, but I am not very satisfied with the answers.

The crux of disagreement is the method of delivery and the importance of the upgrade requiring this sort of injection. You write:

> Available alternatives are not great, such as using DPI everywhere, DNS modification (we use DNSSEC), or a walled garden (all service disrupted while in walled garden). These methods tend to be more costly and cause more disruption for customers.

I'm still not convinced as to why a phone call or an email would not suffice. What information is specifically being cited by customers as "information overload"? Why can this not simply be a notification as a part of the Xfinity main page? Why isn't an email that only has information on the EOL of a modem is less obstructive than yet another pop-up for users who are trained to ignore pop-ups?

The case for an injection isn't really made simply because other intrusive methods are more intrusive; the presentation of the message itself is just more information in a sea of information, and the criticality of the issue isn't sufficiently justified either. This is not the appropriate way of communicating information that has no such urgency. It's a very nice thing to phase out modems that are EOL, sure, I will grant that. But the information is not so urgent that it needs to be delivered right now or injected into the webpage. That is not something the ISP should be doing, which I suspect is another point of contention that will be had.

> Available alternatives are not great

You admit alternatives exist, but decided to modify webpages anyway? Adding your own modifications to a copyright protected work (e.g. any web page) creates a derivative work. Generally only the copyright holder of the original work can create or authorize derivative works. Unless you have a license the copyright holder for each webpage you are modifying, this is copyright infringement. Why did your legal department approve a plant that might make the company liable for up to $150,000 per work infringed?

The arrogance is unreal. Your difficulty communicating with your customers is not my problem. Keep it out of my website.

This is a perfect example of the culture problem at Comcast. You seem to have worked yourselves into believing that you're something other than a dumb pipeline. Now you feel entitled to stick your fingers into the content.

I suspect this mass-psychosis is coming from the top, and the need to move into higher-margin businesses. Keep your messages on xfinity.com.

Just a small note that as a customer I would prefer to be redirected to a notice hosted on your website so there is no confusion about the source of the notification. If I saw this pop up on a website I visited daily I would probably think it was spam and ignore it.

RFC stands for "Request For Comments". Some of them get turned into standards, but most are just the IETF equivalent of a forum thread. They're a way to start a discussion about a network engineering design.

That part just requires looking at the TCP header. So I guess the answer is "no deep packet inspection until it picks a connection to inject, and then it inspects everything in that connection". Which simplifies to "yes deep packet inspection".

Putting a book into an envelope is not a copyright violation, and consumer routers don't redistribute to third parties.