top | item 10592775

Comcast injects JavaScript into webpages to show copyright notices to customers

645 points| Jarred | 10 years ago |gist.github.com

392 comments

order
[+] rtl49|10 years ago|reply
What is there to say? This is an incredibly obnoxious theft of attention. Comcast has perfected the art of harassing its customers with unwelcome noise for what must be marginal profit. I know someone with a Comcast cable box whose channel menu forces the viewer to pass over a banner advertisement after every fourth channel. This combined with the horrible rubbery buttons on the remote means that to browse through twenty channel titles takes perhaps as many seconds. Add to this "actionable" banner advertisements displayed over the content and seemingly endless commercial "breaks" and I find it essentially unusable. On top of it all, I understand that people pay over a thousand dollars a year for this service. Comcast's flagrant disregard for customer satisfaction, or even their basic human dignity, is a striking testament to the failure of regulators to ensure adequate competition in this space.
[+] imgabe|10 years ago|reply
FiOS does the same thing with its cable box. I'm not sure it's every fourth channel, but doing anything with the cable guide often involves dismissing an interstitial ad on the way to whatever you were trying to do, made all the more annoying by the slow UI.

TV service just keeps getting more and more obnoxious. I only got it because it came with 2 years of free HBO and was cheaper than Internet alone at the tier I wanted. There's hardly any reason to watch cable TV any more. (I know, sports. Not really my thing, but I get that a lot of people want to watch live sports)

[+] mcv|10 years ago|reply
If this is how Comcast treats its customers, I wonder why anyone would want to pay them to be their customer. Especially a thousand dollars a years. Is this because there's no real competition in the US?
[+] jerf|10 years ago|reply
"I know someone with a Comcast cable box whose channel menu forces the viewer to pass over a banner advertisement after every fourth channel. This combined with the horrible rubbery buttons on the remote means that to browse through twenty channel titles takes perhaps as many seconds."

How weird is it that the equipment is still so slow? I mean, in 2005 I was grumpy about how slow cable TV gear is. Now it's 2015 and seems like it's exactly the same, whenever I see it.

What is so hard about using processors with clock speeds measured in megahertz and not kilohertz nowadays? I swear, Comcast is probably paying extra to some supplier holding the last supply of their specialized MegaSlowz chips with the SuperProprietaryFeature that you Can't Reimplement Anywhere Else.

[+] douche|10 years ago|reply
That's the number one reason I bought one of these HD Homerun cable tuner boxes[1]. Once I have a VLC playlist setup with the stream urls to each channel, switching channels is almost as fast as in the old days of analog cable TVs.

Maybe another 4 hours of work got me a little web application that shows the TV guide information pulled from an API, and is hooked in with the VLC web interface to switch channels with a click.

[1]http://amzn.to/1S6nHjA

[+] qudat|10 years ago|reply
> Comcast's flagrant disregard for customer satisfaction, or even their basic human dignity, is a striking testament to the failure of regulators to ensure adequate competition in this space.

I'd argue that government regulations have done nothing in this space but reinforce coercive monopolies. I think you're taking the wrong approach, we need to deregulate this space and allow real competition to thrive.

[+] johnward|10 years ago|reply
To be fair the "X1" has a much better UI/UX and digital buttons. Plus the voice search (you talk into the remote) works exceptionally well. There is no lag. I might say I actually like it. I was shocked that it came from comcast.

They actually have some comcast lab product where you can play games using your smartphone as the controller. I think it's beta but it wasn't that bad when I tried NBA Jam.

Source: comcast is my only internet option so I bundle.

[+] kdamken|10 years ago|reply
Actually using a Comcast cable box to watch things in 2015. I can't understand it. An Apple TV with a netflix and hulu account get you 95% of the way, with 100X better of a user experience.

Or if you don't have $100 to spare, you can always connect your laptop to your tv.

[+] JustTim|10 years ago|reply
Comcast is on my list today for a different reason. We have Comcast Business Class service at one of our FL locations.

Tuesday we could not access VNC nor our remote database services from that location. All port 80 traffic was fine. I had one of the staff call, wait on hold for an hours.

Just as I suspected Comcast had implemented port blocking on a high priced business account. It took the guy a second to release it. It put our company down for two to three hours.

Also the speed of Comcast service drops to 15-20% of advertised from 2:30 to 5 PM when kids arrive home from school.

Once the contract is up we are moving the service to someone who understands "business class"

[+] api_or_ipa|10 years ago|reply
HTTPS Everywhere can't happen too soon.

This is abusive. Imagine if anyone else had access to pus you notifications by intercepting your communications. Imagine Uncle Sam interrupting your calls announcing you haven't submitted your tax returns yet. Because that's basically what's happening here.

[+] Jach|10 years ago|reply
The header and people's reactions makes it seem Comcast will just do this on a whim as if it's inspecting the page you visit and deciding on the page to display the warning or not. If you read the screenshot, it's just a notice that someone filed a complaint against your IP, and Comcast is alerting you via email, maybe phone, maybe even a letter, and now your web browser. One might argue whether it's better they redirect you to a Comcast Message Page on their own domain one time. One might argue that this is a "feature" on the level of Comcast DNS servers that "helpfully" forward your bad domains to a search engine instead of giving a proper server not found response.

Don't want to receive these messages from Comcast? Don't seed your torrents.

[+] virtuallynathan|10 years ago|reply
This is correct. It is only performed after you are sent emails, letters, phone calls, etc. We do the same for when you are about to exceed your 300GB of data. Most people don't give us a good email, don't login to check it, don't login to their comcast account, etc... This type of notification is to cover those people. We are working on better ways to do this, see: https://www.caida.org/workshops/aims/1503/slides/aims1503_ba...

This system is well documented: https://tools.ietf.org/html/rfc6108

I'll bring up the idea of an opt-out for users that DO check their mail, email, phone, comcast account, etc...

[+] Sir_Cmpwn|10 years ago|reply
You're missing the point. Injecting scripts into HTML delivered through your ISP for any purpose is grossly abusive on the part of Comcast.
[+] chestervonwinch|10 years ago|reply
This comment is the only real explanation of what's going on here. I'm not sure why it's buried. It seems people are just reading the headline and breaking out the pitchforks and torches. I understand the issues of privacy here, but it also seems the context in which this is taking place is an important thing to consider, as well.
[+] ddingus|10 years ago|reply
You mean don't seed infringing torrents, right?

:)

[+] golemotron|10 years ago|reply
I think this is actually illegal. If you own the copyright for your content and they inject into it, they are creating a derived work without your permission.
[+] userbinator|10 years ago|reply
I would hope not, because by a similar argument adblockers and userscripts would also be illegal. I don't agree with what Comcast is doing, but using this argument could end up with an even worse slippery slope that leads to users not being able to consume content/customise their computing environment in the way they choose to. On the other hand, if Comcast is your ISP, all your traffic does pass through equipment owned by Comcast, which --- if you believe in being able to have control over your devices --- they should likewise also have the right to control. All the traffic on my home network goes through an adblocking proxy, and I could do things like http://www.ex-parrot.com/pete/upside-down-ternet.html if I really wanted to. I certainly do want to maintain control over the traffic within my network.
[+] wyldfire|10 years ago|reply
I don't think you understood the post (admittedly the title is unclear).

If the title were "Comcast injects ... to show notices of reported copyright infringement against their account," there would probably be less confusion in the comments here.

[+] buro9|10 years ago|reply
I wonder what the legal implication is if a site is sending the "Cache-Control: no-transform;" header with it's clear text content.
[+] motles|10 years ago|reply
doesn't all music sampling rely on the fact that creating derived works without permission is completely legal?
[+] samdroid|10 years ago|reply
The `checkBrowser` function says it is from brainjar.com and used under their terms of service. On the brainjar.com terms of service, it seems to say the code is licensed under the GPLv2+.

Doesn't this make the Comcast script now under the GPL - since GPL code can only be included in compatibly licensed products. Or is Comcast violating the GPL?

[+] jakejake|10 years ago|reply
This is a crappy move on Comcast's part, but as far as GPL they most likely are not in violation. You can use GPL code in a commercial product as long as you are not distributing it.

If they ever choose to sell or distribute their "content injection system" though, they would have to release it under the GPL or else negotiate another license from the copyright owner.

[+] btgeekboy|10 years ago|reply
The terms of service facing the public are not necessarily the terms which Comcast may have negotiated with the copyright holder.
[+] wmt|10 years ago|reply
Always using VPN has really made using Internet a lot nicer place, I can use any Wifi without any fears, don't have to care about ISPs doing funny things with my traffic, and if I get country blocked content I can just quickly route my traffic to another exit node.

Of course then the VPN provider is the single point of failure, but if it's trustworthy enough only folks with proper court orders should have access to my traffic. And it's an extra ten bucks per month or so.

[+] mbesto|10 years ago|reply
> Click the button below to confirm you received this Copyright Alert and to close it.

> <button>Close this message</button>

Ahhhh, enterprise IT and corporate counsel synergy at it's finest.

[+] reitoei|10 years ago|reply
While a web developer locks him/herself in a dark room with a bottle of whiskey and a revolver.
[+] anon4|10 years ago|reply
Hm.. if I delete the element from the DOM without clicking the button (trivial if you use the inspector), does this imply I do not confirm that I've received the Copyright Alert?

Edit: Also, I'm sure most people will just click the button without reading anything.

[+] gruez|10 years ago|reply
Serious question: what's wrong with this?
[+] guelo|10 years ago|reply
You don't have to use Comcast. I sacrificed Comcast's speed and went with a local, privacy conscious DSL provider and I couldn't be happier. I'm getting about 6mbps with dual bonded phone lines. It's kind of pricey at $80 but it's worth it knowing I'm dealing with an honest business. In most areas there are alternatives and DSL is available everywhere, it's worth it even if it's a lot slower for the peace of mind. As long as you don't trade in one evil giant corp for another like AT&T or Verizon.
[+] poizan42|10 years ago|reply
How does this go along with ISPs being classified as common carriers? Are they actually allowed to modify the data they are carrying?
[+] austerity|10 years ago|reply
I wonder what's in it for them? Sending an email should be enough to comply with DMCA. Are they paid by some copyright groups or just being a pushover?
[+] zackboe|10 years ago|reply
Cox Communications also injects js to display downtime messages and data usage alerts when nearing the upper limits of their now enforced data caps. Their response to a FCC complaint was essentially "it's convenient for our users"
[+] mavrc|10 years ago|reply
CableOne does this for lots of different stuff. If you're over your bandwidth cap, if you haven't paid your bill yet...

Come to think of it, we have had a rocky relationship, they and I.

[+] vlunkr|10 years ago|reply
Yes, I've seen CableOne banners get magically injected into web pages. Sometimes for things as trivial as advertisements.
[+] feld|10 years ago|reply
Charter injects into your browsing to force you to accept a Terms of Service update, even on a business connection.

I got a packet dump of it happening.

https://feld.me/pub/charter.pcapng

[+] closetnerd|10 years ago|reply
This shouldn't be possible with https enabled website right? Or am I missing something?
[+] KhalilK|10 years ago|reply
Same was done during the Tunisian revolution only to inject keyloggers.
[+] chippy|10 years ago|reply
Comcast was doing this, or a Tunisian ISP? Do you have a source for that?
[+] thoughtexpt|10 years ago|reply
From what domain does comcast.js originate? Does the injection still work if we block connections to the IP for that domain?
[+] jand|10 years ago|reply
It seems to me, as if they also do some magic to intercept requests to the currently visited page. They use a relative path url (SYS_URL) to poll for a state and to send the acknowledgement (functions checkBulletin() and sendAck()). From my understanding that would be a request to the current domain/visited page, right?

So they just intercept their 'own' magic url, but it bothers me somehow.

Can anybody confirm this? My uptime is far beyond reasonable.

[+] _qbjt|10 years ago|reply
Out of curiosity, I wanted to know what the maximum z-index is. The CSS 2.1 spec doesn't present this information, but it turns out to be 2147483647 (the maximum value for a 32-bit integer).

Now what does that z-index say about the JavaScript developer who chose it? "Fuck it, 999999 is enough." Man, what a tool.

[+] rym_|10 years ago|reply
Not a JS developer at all, what does a zIndex of 99999 do?