News for hackers. Stuff that matters.
Re:Comcast is injecting 400+ lines of JavaScript into web pages by _jal on Sunday December 10, 2017 @11:19AM (#15892042)
First, thanks for participating.

Second, I am a Comcast customer who will never see these messages precisely because you do things like MITM unprotected traffic. Because I can't trust you to leave my traffic alone, all my traffic is tunneled.

So at the very least, if you feel this is a critical service you are offering (as implied by the RFC), you need an alternative communications channel for people like me who don't permit this one. Snailmail is fine; you try to upsell me constantly through that channel already.

Re:Comcast is injecting 400+ lines of JavaScript into web pages by pooloo1 on Sunday December 10, 2017 @12:07PM (#15892282)
I second this, in addition, the injection is not only related to EOS/EOL for modems it is also for when you are approaching your data cap. Which is rather annoying because it actually can halt your gaming or netflix experience oddly. I have had both happen, one I was playing PlayerUnknown's Battlegrounds and the game crashed. Since the game itself uses web based tools, for its menu system, upon restarting the client a Comcast injected message popped up warning me I have used 90% of my data cap.

The same thing happened on Netflix ...

Re:Comcast is injecting 400+ lines of JavaScript into web pages by tatersolid on Sunday December 10, 2017 @06:18PM (#15894038)
I think it’s funny you’re approaching your data cap and they add 400 lines to the size of each web page you visit. I hope pages they tamper with are subtracted from your cap.

This is exactly why Comcast is still the most hated company in America [1], and the only reason you have any customers is due to the monopoly deals of dubious legality you or your acquisitions bribed local officials to create back during the infancy of cable. We hate you, but we don’t have any choice.

It’s worth noting that government regulation created Comcast by allowing long-term monopoly contracts with municipalities. Remove the regulations which prevent competition in local internet and TV services; don’t add more regulations.

  [1]: http://finance.yahoo.com/news/america-most-hated-companies-110032495.html
Re:Comcast is injecting 400+ lines of JavaScript into web pages by aaomidi on Sunday December 10, 2017 @02:25PM (#15893014)
TBH what kind of game doesn't use https...
Re:Comcast is injecting 400+ lines of JavaScript into web pages by cookiecaper on Sunday December 10, 2017 @09:14PM (#15894705)
HTTPS is not free. Game developers are usually very performance-sensitive. If you're not transmitting any sensitive data, it may seem appealing to forgo the seemingly-needless HTTPS overhead.
Re:Comcast is injecting 400+ lines of JavaScript into web pages by enzanki_ars on Sunday December 10, 2017 @11:17PM (#15895130)
Please cite your sources on the speed comparison. See: https://istlsfastyet.com/

Also, most games I have played seem to use HTTPS. The only time it is used is when the game does not need an instant result, in which case they use HTTP or HTTPs. Most of the times, this is in the main menu or similar. Doing this makes it even harder (assuming they use certificate pinning) for users to change the values returns to gain any advantage on their client.

Any part of the game that needs speed should be using a UDP based protocol.

Re:Comcast is injecting 400+ lines of JavaScript into web pages by chopin on Monday December 11, 2017 @07:47AM (#15896688)
If your game is executing js (as for the example given by the GP), you are transmitting sensitive data. In that scenario not only confidentiality but even more integrity of the data is important.
Re:Comcast is injecting 400+ lines of JavaScript into web pages by zwily on Sunday December 10, 2017 @12:21PM (#15892344)
They do say they try to email you a bunch of times first... Email seems like a decent enough alternate channel.
Re:Comcast is injecting 400+ lines of JavaScript into web pages by hackmiester on Sunday December 10, 2017 @12:45PM (#15892482)
They emailed my Comcast.net address, which I didn't even know I had.
Re:Comcast is injecting 400+ lines of JavaScript into web pages by jlivingood on Sunday December 10, 2017 @01:53PM (#15892839)
> They emailed my Comcast.net address, which I didn't even know I had.

I recommend you add your primary email address. You can do this via the self-service portal.

Go to https://customer.xfinity.com/#/settings/account under Account / Settings / Contact Information. IIRC you are sent a confirmation email you have to act on before it takes effect.

Re:Comcast is injecting 400+ lines of JavaScript into web pages by cannonedhamster on Monday December 11, 2017 @04:01PM (#15900396)
You should mark this day. This is probably the most positive customer experience you're going to ever have with a Comcast employee. I had a choice between Verizon and Comcast. Comcast was cheaper and I still went with Verizon.

Edit: typo.

Re:Comcast is injecting 400+ lines of JavaScript into web pages by dhimes on Sunday December 10, 2017 @01:59PM (#15892877)
OT question: Do you roll your own tunnel or use a service?
Re:Comcast is injecting 400+ lines of JavaScript into web pages by jsmthrowaway on Sunday December 10, 2017 @12:21PM (#15892349)
> Snailmail is fine; you try to upsell me constantly through that channel already.

Implying you’d probably miss it and, if not you, the customers they’re trying to reach.

Re:Comcast is injecting 400+ lines of JavaScript into web pages by LeifCarrotson on Sunday December 10, 2017 @12:41PM (#15892464)
Then they ought to stop abusing the communication channels they have. If they send so much email and snail mail spam that the customer automatically ignores it, that's the choice they have made.
Re:Comcast is injecting 400+ lines of JavaScript into web pages by cookiecaper on Sunday December 10, 2017 @09:19PM (#15894722)
What happens when a customer who really does have a modem that is vulnerable or outmoded runs into related issues? Is that customer going to accept "Well, we included it with our junk mail" as an explanation? As for email, does anyone use their ISP-provided email address anymore? Everyone has a third party provider (mostly Gmail).

I don't think there's any fault in logic in presuming that the best way to make sure a customer receives a notification is to insert as near to their known-active stream as possible. I don't condone altering that stream, but I think it would be nice if they could send a page, potentially at the browser or OS level, exclusive for system control and status messages (no sales, marketing, billing, or collection messages allowed).

Re:Comcast is injecting 400+ lines of JavaScript into web pages by rietta on Sunday December 10, 2017 @02:11PM (#15892942)
I am so sick and tired of xfinity mailings addressed to me or my wife or former residents of the home address asking us to switch to them for a two year discount that I know they won’t give us because we’re already a customer. They even just jacked my rates yet again.
Re:Comcast is injecting 400+ lines of JavaScript into web pages by codycraven on Monday December 11, 2017 @10:24AM (#15897546)
As a Comcast customer until ~6 months ago, I brought in a cable box they forced upon me as part of a packaged rate (cheaper than internet alone) once my contract ended.

I had tried calling customer service to see if they'd give me a new bundle but they told me they were only for new customers, so I switched ISPs.

Anyways, when I went in store to return the equipment, the guy I spoke to told me to not bother with phone support but to instead come in store or call him directly (he gave me a business card) since he can get existing customers bundled rates that the phone reps can't.

While I had the choice of ISP many don't, I'd definitely recommend going to a store location where you can talk face to face with someone in your area and see if you can't get a contract at a better rate than you pay month to month.

Re:Comcast is injecting 400+ lines of JavaScript into web pages by rietta on Monday December 11, 2017 @11:16AM (#15897963)
That is worth a try! Thanks. There is an XFinity Store less than 2 miles away from me. Never thought to set foot there.
Re:Comcast is injecting 400+ lines of JavaScript into web pages by rietta on Sunday December 10, 2017 @09:20PM (#15894726)
Along the lines of this. Anyone in the industry, why do they not cross reference the street addresses of their current subscribers and reduce the promotional mailing list or mail relevant promotions? Maybe it seems cheaper to do it this way, but it's actually quite antagonistic to current customers.

Why would they not maintain a clean marketing list!?

Re:Comcast is injecting 400+ lines of JavaScript into web pages by novaleaf on Sunday December 10, 2017 @11:53AM (#15892211)
downvoting because of snarkyness. Your suggestion of alt cmu channel is good however.
Re:Comcast is injecting 400+ lines of JavaScript into web pages by bayonetz on Sunday December 10, 2017 @12:10PM (#15892297)
Downvoting because they weren't that snarky and because of your smugness. Your willingness to tell some one straight up why you downvoted them was good however.
Re:Comcast is injecting 400+ lines of JavaScript into web pages by novaleaf on Sunday December 10, 2017 @12:24PM (#15892365)
why am I smug? I totally agree with the premise and personally hate comcast, but if _jal wants to be taken seriously by jlivingood, snarkyness isn't the way to go.

I don't mind the anon downvotes though, it's par for the course anywhere.