Hacker News Reader

These days you could throw up an other wise invisible div that said "Page Tampered" please report to webmaster (or you could even do that yourself with a lookup on your hosted side to a script that would log IP/browser etc.

I've already encountered pages like that, they piss off everyone who uses adblocking/filtering so I would consider it an anti-user technique.

> There are at least three places where you can get injected, one is from the ISP

I'm not sure if they still do it, but Vodafone in my country (and many others) used to cache and compress photos on all websites, which often led to visible degradation in image quality. Luckily I discovered that their software respected the `Cache-Control: no-transform` header so include that header on all my websites now.

Vodafone did also inject custom js/html in non HTTPS pages (obviously). This was 2 years ago.

That's right. The js rewrote all image src attributes to point to the "optimised" photos they'd cached.

Are they sophisticated enough to modify CSP directives (in HTML or headers) to allow their scripts? If not that would be an easy solution.

Wouldn't it be better to just set up TLS terminated in a service you control?