43 ms·

J. Livingood (a Comcast VP) responded to the OP: > [JL] We are not trying to sell you a new one. If you own your modem we're informing you that it is either en

J. Livingood (a Comcast VP) responded to the OP: > [JL] We are not trying to sell you a new one. If you own your modem we're informing you that it is either end of life (EOL) or that you are about to get a speed upgrade that the modem will be unable to deliver. Incidentally, Livingood is a co-author of IETF RFC 6108, which he has conveniently linked. From the RFC's general requirements numero uno: > R3.1.1. Must Only Be Used for Critical Service Notifications. Additional Background: The system must only provide critical notifications, rather than trivial notifications. An example of a critical, non-trivial notification, which is also the primary motivation of this system, is to advise the user that their computer is infected with malware, that their security is at severe risk and/or has already been compromised, and that it is recommended that they take immediate, corrective action NOW. As composed as Livingood's response was, a modem at EOL and/or incapable of supporting an incremental speed upgrade doesn't strike me as critical. To be sure, Comcast is scheduled to increase speeds by 12/19 (at least in my region): 10Mb->25M, 25M->60M, 75M->100M. Although I disagree with Comcast's method and categorization, it would be interesting to learn what modem the OP was using. It would also be interesting to learn if the OP received this message on multiple instances. If yes, it would be in violation of its own requirement--in particular, R3.1.8. User Notification Acknowledgement Must Stop Further Immediate Notifications, which itself is contradictory in its use of must and should: > Additional Background: Once a user acknowledges a critical notification, the notification should immediately stop. EDIT: Apparently, Livingood is an executive.

glenstein 9y ago
>As composed as Livingood's response was, a modem at EOL and/or incapable of supporting an incremental speed upgrade doesn't strike me as critical. Exactly. And the response, "we're not trying to sell you a modem, we're just encouraging you to strongly consider buying a new one" is such a hair-splittingly asinine response considering the rather serious breach of trust posed by the notification system.
- thaumaturgy 9y ago
  This is just about the worst possible way to notify a customer of any issue anyway, because it legitimizes those stupid ad-based malware popups that have become so prevalent. As more Comcast customers receive JS-based notices like these injected into their normal web traffic, any enterprising jerk can clone the message, change the links to point to their own phishing site, change or omit the phone number, and snag a whole bunch of unsuspecting Comcast customers.
  - userbinator 9y ago
    As more Comcast customers receive JS-based notices like these injected into their normal web traffic, any enterprising jerk can clone the message, change the links to point to their own phishing site, change or omit the phone number, and snag a whole bunch of unsuspecting Comcast customers. To be a devil's advocate, Comcast customers have been phished before via email too: http://technology.pitt.edu/news-and-alerts/phishing-alert-email-notice-mimics-comcast-xfinity-support http://technology.pitt.edu/news-and-alerts/phishing-alert-em... ...and then there's the various phone and even door-to-door scams, but I'd consider the latter to be much harder to do.
- carussell 9y ago
  > And the response, "we're not trying to sell you a modem, we're just encouraging you to strongly consider buying a new one" Making up quotes like this is against HN guidelines (and common decency).
  - glenstein 9y ago
    My "quote" isn't significantly different from what was actually said, in fact hews extremely closely to it, and is designed for rhetorical purpose of making clear how small a distinction is being relied upon in order to claim the statement is something other than a request for you to buy a new modem. Moreover there's nothing in the guidelines about "making up quotes" (which again isn't a reasonable interpretation of what that is), whereas there are actual, explicit guidelines against addressing yourself to unreasonably interpreted versions of other people's comments.
    - tptacek 9y ago
      If you're rewording something someone else said, even if you're keeping it very close to the original words, don't use quotation marks. Quotes say "this is literally what was said". I got bit by this a bunch when I first got on HN; it was surprising to me how seriously it was taken. But it is, and it's not hard to work around.
      - pvg 9y ago
        That's a weird HN-ism, though, not how writing or paraphrasing works anywhere else. The goal is understandable and laudable but 'redefining the meaning of quotes' is a thing only hardcore lispers can love.
        tptacek 9y ago
        Yeah, they should probably put it in the guidelines. I just remember getting sniped by PG for using quotes that way.
        9y ago
- jlivingood 9y ago
  > Exactly. And the response, "we're not trying to sell you a modem, we're just encouraging you to strongly consider buying a new one" is such a hair-splittingly asinine response considering the rather serious breach of trust posed by the notification system. Well, what I meant (within the response length constraints of Twitter) was that we're not saying you can only buy it from us. Just that the customer needs to buy it someplace. That way a customer can do as the wish - ranging from buying a used one on eBay to getting a new one from Amazon or Best Buy. Ultimately the objective is to ensure a customer is on a device that can (1) deliver the performance for which they pay and (2) is up to date technically (i.e. supports IPv6 and channel bonding) and is supported by the vendor (i.e. software updates & bug fixes). One of the big risks we have to help mitigate is when a device goes EOL, which means no more software updates, and a security or significant performance issue arises in the future. By proactively beginning the replacement process this helps minimize any future impact when it is a major issue like that. So taking action gradually on a proactive basis prevents a more severe impact later on. In many cases, these are DOCSIS 2.0 devices and that technology and often the software is from 2001, the same year as the 1st gen iPod and when Windows XP was released. Eventually a modem will go into End-of-Service (EOS) status. At that point there is a definite date/time limit for the device, after which it is de-provisioned from the network and the customer must replace it to continue service. This has been the case in the past with DOCSIS 1.0 and 1.1 devices for example, after years of work to encourage customers to replace them. See also https://www.xfinity.com/support/articles/end-of-life-devices https://www.xfinity.com/support/articles/end-of-life-devices and the start of the EOL/EOS process for DOCSIS 1.1 devices https://www.dslreports.com/forum/r27473499-Speed-Heads-Up-Time-to-Replace-Your-DOCSIS-1-1-Modem https://www.dslreports.com/forum/r27473499-Speed-Heads-Up-Ti... and https://www.dslreports.com/forum/r28497383-Speed-Upgrade-Your-DOCSIS-1-1-Modem-ASAP https://www.dslreports.com/forum/r28497383-Speed-Upgrade-You... and https://www.dslreports.com/forum/r30524429-Equip-Reminder-Please-replace-your-DOCSIS-2-0-modem https://www.dslreports.com/forum/r30524429-Equip-Reminder-Pl... and https://www.dslreports.com/forum/r30450278-Speed-Heads-Up-Time-to-Replace-Your-DOCSIS-3-0-4x4-Modem https://www.dslreports.com/forum/r30450278-Speed-Heads-Up-Ti...
  - sulam 9y ago
    If his modem is actively interfering with your network I could see that this is critical. If he has been hacked and is actively DDOSing sites, that’s critical. We can debate the correct response in those cases (getting on the phone and calling seems to work really well when you want people to pay you, as does turning off service). Unless I’m misunderstanding, this was not causing such a problem. Casting it as a customer good is rhetorically amusing, and probably holds water with people who are predisposed to agree with you, but I can make any number of morally bankrupt decisions using exactly the same logic. You have simpler ways to deliver this message, that do not cause nearly as much harm to your customer and do not require you to intercept and modify their traffic.
- userbinator 9y ago
  ...unless the upgrade actually means loss of service due to incompatibility, in which case I would agree that is critical, but nonetheless "go buy a new modem" is something no customer wants to hear, especially if they're already paying $$$ every month for the service.
deleted 9y ago
[deleted]
jlivingood 9y ago
> Although I disagree with Comcast's method and categorization, it would be interesting to learn what modem the OP was using. We start telling customers that a modem needs to be upgraded when one of two things happen: either they are about to or just had a speed upgrade that their modem cannot support or the modem has gone end-of-life (EOL) from the vendor. In the former case, if the device is leased, you are send a new one to replace the device and just have to basically say ok. In the latter case, it is a customer-owned device so the customer is asked to go buy a new one someplace (e.g. Amazon, BestBuy). And in the EOL case, the vendor may have gone out of business or shut their cable modem business down, or otherwise decided to no longer support the device due to its age. That of course means that if a security issue came up, as they do, that the vendor would not be able or willing to provide a software fix for the device. So it's best to get the ball rolling to get those devices replaced when that occurs. Most of our EOL devices today are DOCSIS 2.0 devices (10+ years old), which can only do a single upstream and downstream channel (no channel bonding) and 1st generation DOCSIS 3.0 devices (5 - 8 years old).
- davidcbc 9y ago
  If only there were some way to notify your users that wasn't so scummy... like via email or regular mail
  - alexpetralia 9y ago
    In the spirit of efficacy, browser injection may have a better response rate than email. Taking this to its next logical step, surely showing up in-person at your door is even more effective. Is that the idea here? Or does this efficacy come at some cost (namely, the sentiment behind this thread)?
    - epicide 9y ago
      With all the junk mail I get from my cable company about "upgrading" my service to include some crap I don't want, I would think they could find a way to slip in a "hey, your modem's busted" notice.
NelsonMinar 9y ago
I think it's amazing Comcast documented their MITM attack as an RFC. Are those still literally Requests for Comments? Are the comments collected anywhere?
- pbhjpbhj 9y ago
  You're wildly OT, I suggest Wikipedia.
  - markbnj 9y ago
    Huh? Not even close to wildly OT. The RFC was mentioned above.
    - pbhjpbhj 9y ago
      "What is a RFC?", "What happens to the comments?", OK a specific RFC is the topic but it's like asking "What is the internet?". https://en.wikipedia.org/wiki/Request_for_Comments https://en.wikipedia.org/wiki/Request_for_Comments is much more appropriate resource for that level of question IMO.
      - markbnj 9y ago
        Right, ok so we're in a discussion about what "wildly" means :). Imo the rfc was mentioned, so a simple link to the wiki article would have been a polite reply.
- convolvatron 9y ago
  unfortunately the word 'RFC' has been corrupted from meaning exactly that, a publishing forum for ideas, into a pretty asinine form of technical marketing whereby you can publish an informational outside any normal consensus process and assume the sheen of standardization. that started happening 2 decades ago.
- rdiddly 9y ago
  RFC 6108 is from 2011, last revised 2015, and marked as informational, which I think means there's no review & comment... But I'm not sure about that.
daveheq 9y ago
I don't care of it's critical or not, I don't care what the issue is, a carrier should not inject code into a webpage it serves, PERIOD. I didn't knowingly opt into this, and I don't have a feasible alternative where I live. This should NOT be allowed, it's a security and privacy risk, and who knows what that JavaScript is actually doing or what vulnerabilities it opens up for malicious advertisers whose scripts are also on the page. This should be ILLEGAL, I don't give a crap about "getting the government out of our lives", well guess what, they need to step in and prevent these slimy "business" practices from happening or punish the corporations trying to exploit their captive audience.
paultopia 9y ago
Wait wait WHAT? This standard seems like a terrible mistake. Isn't this exactly what malware creators want? To condition users to click the browser pop up that says "YOUR COMPUTER IS INFECTED WITH MALWARE, CALL THIS NUMBER/INSTALL THIS HORRIBLE THING TO FIX IT?" Why on Earth would anyone issue a standard that says that ISPs should deliver that kind of notification, thus training consumers to believe them?
- Centime 9y ago
  They're the ones who issued the standard. https://tools.ietf.org/html/rfc6108 https://tools.ietf.org/html/rfc6108
  - deleted 9y ago
    [deleted]
  - jis 9y ago
    Just to be clear. This is not an IETF Standard that has gone through the standards process. It is an "individual submission" published as an informational document. The IETF does not endorse documents classified as "informational."
- ajross 9y ago
  IETF RFCs are not "standards" in the sense that you are thinking. The RFC process is deliberately designed to be open to submission from anyone, and there is no particular vetting or consensus forming that happens. When used by practicing engineers as a low-overhead way to document interoperability requirements for working software, it's been fantastically successful. But it also lends itself to this kind of pseudo-fraud "standardization" by less ethical players. Bottom line: an "RFC" means nothing per se. What matters is whether the community wants to support it. So RFC7540 is an important standard everyone agrees to support. RFC6108 is garbage.

glenstein 9y ago

>As composed as Livingood's response was, a modem at EOL and/or incapable of supporting an incremental speed upgrade doesn't strike me as critical. Exactly. And the response, "we're not trying to sell you a modem, we're just encouraging you to strongly consider buying a new one" is such a hair-splittingly asinine response considering the rather serious breach of trust posed by the notification system.

thaumaturgy 9y ago
This is just about the worst possible way to notify a customer of any issue anyway, because it legitimizes those stupid ad-based malware popups that have become so prevalent. As more Comcast customers receive JS-based notices like these injected into their normal web traffic, any enterprising jerk can clone the message, change the links to point to their own phishing site, change or omit the phone number, and snag a whole bunch of unsuspecting Comcast customers.
- userbinator 9y ago
  As more Comcast customers receive JS-based notices like these injected into their normal web traffic, any enterprising jerk can clone the message, change the links to point to their own phishing site, change or omit the phone number, and snag a whole bunch of unsuspecting Comcast customers. To be a devil's advocate, Comcast customers have been phished before via email too: http://technology.pitt.edu/news-and-alerts/phishing-alert-email-notice-mimics-comcast-xfinity-support http://technology.pitt.edu/news-and-alerts/phishing-alert-em... ...and then there's the various phone and even door-to-door scams, but I'd consider the latter to be much harder to do.
carussell 9y ago
> And the response, "we're not trying to sell you a modem, we're just encouraging you to strongly consider buying a new one" Making up quotes like this is against HN guidelines (and common decency).
- glenstein 9y ago
  My "quote" isn't significantly different from what was actually said, in fact hews extremely closely to it, and is designed for rhetorical purpose of making clear how small a distinction is being relied upon in order to claim the statement is something other than a request for you to buy a new modem. Moreover there's nothing in the guidelines about "making up quotes" (which again isn't a reasonable interpretation of what that is), whereas there are actual, explicit guidelines against addressing yourself to unreasonably interpreted versions of other people's comments.
  - tptacek 9y ago
    If you're rewording something someone else said, even if you're keeping it very close to the original words, don't use quotation marks. Quotes say "this is literally what was said". I got bit by this a bunch when I first got on HN; it was surprising to me how seriously it was taken. But it is, and it's not hard to work around.
    - pvg 9y ago
      That's a weird HN-ism, though, not how writing or paraphrasing works anywhere else. The goal is understandable and laudable but 'redefining the meaning of quotes' is a thing only hardcore lispers can love.
      - tptacek 9y ago
        Yeah, they should probably put it in the guidelines. I just remember getting sniped by PG for using quotes that way.
        9y ago
jlivingood 9y ago
> Exactly. And the response, "we're not trying to sell you a modem, we're just encouraging you to strongly consider buying a new one" is such a hair-splittingly asinine response considering the rather serious breach of trust posed by the notification system. Well, what I meant (within the response length constraints of Twitter) was that we're not saying you can only buy it from us. Just that the customer needs to buy it someplace. That way a customer can do as the wish - ranging from buying a used one on eBay to getting a new one from Amazon or Best Buy. Ultimately the objective is to ensure a customer is on a device that can (1) deliver the performance for which they pay and (2) is up to date technically (i.e. supports IPv6 and channel bonding) and is supported by the vendor (i.e. software updates & bug fixes). One of the big risks we have to help mitigate is when a device goes EOL, which means no more software updates, and a security or significant performance issue arises in the future. By proactively beginning the replacement process this helps minimize any future impact when it is a major issue like that. So taking action gradually on a proactive basis prevents a more severe impact later on. In many cases, these are DOCSIS 2.0 devices and that technology and often the software is from 2001, the same year as the 1st gen iPod and when Windows XP was released. Eventually a modem will go into End-of-Service (EOS) status. At that point there is a definite date/time limit for the device, after which it is de-provisioned from the network and the customer must replace it to continue service. This has been the case in the past with DOCSIS 1.0 and 1.1 devices for example, after years of work to encourage customers to replace them. See also https://www.xfinity.com/support/articles/end-of-life-devices https://www.xfinity.com/support/articles/end-of-life-devices and the start of the EOL/EOS process for DOCSIS 1.1 devices https://www.dslreports.com/forum/r27473499-Speed-Heads-Up-Time-to-Replace-Your-DOCSIS-1-1-Modem https://www.dslreports.com/forum/r27473499-Speed-Heads-Up-Ti... and https://www.dslreports.com/forum/r28497383-Speed-Upgrade-Your-DOCSIS-1-1-Modem-ASAP https://www.dslreports.com/forum/r28497383-Speed-Upgrade-You... and https://www.dslreports.com/forum/r30524429-Equip-Reminder-Please-replace-your-DOCSIS-2-0-modem https://www.dslreports.com/forum/r30524429-Equip-Reminder-Pl... and https://www.dslreports.com/forum/r30450278-Speed-Heads-Up-Time-to-Replace-Your-DOCSIS-3-0-4x4-Modem https://www.dslreports.com/forum/r30450278-Speed-Heads-Up-Ti...
- sulam 9y ago
  If his modem is actively interfering with your network I could see that this is critical. If he has been hacked and is actively DDOSing sites, that’s critical. We can debate the correct response in those cases (getting on the phone and calling seems to work really well when you want people to pay you, as does turning off service). Unless I’m misunderstanding, this was not causing such a problem. Casting it as a customer good is rhetorically amusing, and probably holds water with people who are predisposed to agree with you, but I can make any number of morally bankrupt decisions using exactly the same logic. You have simpler ways to deliver this message, that do not cause nearly as much harm to your customer and do not require you to intercept and modify their traffic.
userbinator 9y ago
...unless the upgrade actually means loss of service due to incompatibility, in which case I would agree that is critical, but nonetheless "go buy a new modem" is something no customer wants to hear, especially if they're already paying $$$ every month for the service.

deleted 9y ago

[deleted]

jlivingood 9y ago

> Although I disagree with Comcast's method and categorization, it would be interesting to learn what modem the OP was using. We start telling customers that a modem needs to be upgraded when one of two things happen: either they are about to or just had a speed upgrade that their modem cannot support or the modem has gone end-of-life (EOL) from the vendor. In the former case, if the device is leased, you are send a new one to replace the device and just have to basically say ok. In the latter case, it is a customer-owned device so the customer is asked to go buy a new one someplace (e.g. Amazon, BestBuy). And in the EOL case, the vendor may have gone out of business or shut their cable modem business down, or otherwise decided to no longer support the device due to its age. That of course means that if a security issue came up, as they do, that the vendor would not be able or willing to provide a software fix for the device. So it's best to get the ball rolling to get those devices replaced when that occurs. Most of our EOL devices today are DOCSIS 2.0 devices (10+ years old), which can only do a single upstream and downstream channel (no channel bonding) and 1st generation DOCSIS 3.0 devices (5 - 8 years old).

davidcbc 9y ago
If only there were some way to notify your users that wasn't so scummy... like via email or regular mail
- alexpetralia 9y ago
  In the spirit of efficacy, browser injection may have a better response rate than email. Taking this to its next logical step, surely showing up in-person at your door is even more effective. Is that the idea here? Or does this efficacy come at some cost (namely, the sentiment behind this thread)?
  - epicide 9y ago
    With all the junk mail I get from my cable company about "upgrading" my service to include some crap I don't want, I would think they could find a way to slip in a "hey, your modem's busted" notice.

NelsonMinar 9y ago

I think it's amazing Comcast documented their MITM attack as an RFC. Are those still literally Requests for Comments? Are the comments collected anywhere?

pbhjpbhj 9y ago
You're wildly OT, I suggest Wikipedia.
- markbnj 9y ago
  Huh? Not even close to wildly OT. The RFC was mentioned above.
  - pbhjpbhj 9y ago
    "What is a RFC?", "What happens to the comments?", OK a specific RFC is the topic but it's like asking "What is the internet?". https://en.wikipedia.org/wiki/Request_for_Comments https://en.wikipedia.org/wiki/Request_for_Comments is much more appropriate resource for that level of question IMO.
    - markbnj 9y ago
      Right, ok so we're in a discussion about what "wildly" means :). Imo the rfc was mentioned, so a simple link to the wiki article would have been a polite reply.
convolvatron 9y ago
unfortunately the word 'RFC' has been corrupted from meaning exactly that, a publishing forum for ideas, into a pretty asinine form of technical marketing whereby you can publish an informational outside any normal consensus process and assume the sheen of standardization. that started happening 2 decades ago.
rdiddly 9y ago
RFC 6108 is from 2011, last revised 2015, and marked as informational, which I think means there's no review & comment... But I'm not sure about that.

daveheq 9y ago

I don't care of it's critical or not, I don't care what the issue is, a carrier should not inject code into a webpage it serves, PERIOD. I didn't knowingly opt into this, and I don't have a feasible alternative where I live. This should NOT be allowed, it's a security and privacy risk, and who knows what that JavaScript is actually doing or what vulnerabilities it opens up for malicious advertisers whose scripts are also on the page. This should be ILLEGAL, I don't give a crap about "getting the government out of our lives", well guess what, they need to step in and prevent these slimy "business" practices from happening or punish the corporations trying to exploit their captive audience.

paultopia 9y ago

Wait wait WHAT? This standard seems like a terrible mistake. Isn't this exactly what malware creators want? To condition users to click the browser pop up that says "YOUR COMPUTER IS INFECTED WITH MALWARE, CALL THIS NUMBER/INSTALL THIS HORRIBLE THING TO FIX IT?" Why on Earth would anyone issue a standard that says that ISPs should deliver that kind of notification, thus training consumers to believe them?

Centime 9y ago
They're the ones who issued the standard. https://tools.ietf.org/html/rfc6108 https://tools.ietf.org/html/rfc6108
- deleted 9y ago
  [deleted]
- jis 9y ago
  Just to be clear. This is not an IETF Standard that has gone through the standards process. It is an "individual submission" published as an informational document. The IETF does not endorse documents classified as "informational."
ajross 9y ago
IETF RFCs are not "standards" in the sense that you are thinking. The RFC process is deliberately designed to be open to submission from anyone, and there is no particular vetting or consensus forming that happens. When used by practicing engineers as a low-overhead way to document interoperability requirements for working software, it's been fantastically successful. But it also lends itself to this kind of pseudo-fraud "standardization" by less ethical players. Bottom line: an "RFC" means nothing per se. What matters is whether the community wants to support it. So RFC7540 is an important standard everyone agrees to support. RFC6108 is garbage.