Yes, I think it's overblown. I got what I think is this same message from Comcast a little over a year ago at my father-in-laws house. It alerted me that I ne

Yes, I think it's overblown. I got what I think is this same message from Comcast a little over a year ago at my father-in-laws house. It alerted me that I needed to upgrade his still working but End-Of-Life cable modem to a newer model to keep continuity of service. I recall being slightly alarmed by the injection, and then somewhat disappointed that they weren't going to continue support for the old modem, but my eventual conclusion was that this was a useful last ditch effort to contact a customer. His contact email for for Comcast is in unchecked comcast.net address, the mailed notifications probably were thrown away as junk mail, he gets multiple spam phone calls per day which he usually ignores, but this message got through. Surreptitiously modifying web pages would be atrocious, but a last-ditch effort at notifying a customer that they are about to lose service is not the same as Man-In-The-Middle attack for nefarious purposes. I agree that there is a legitimate fear that once it becomes known within the company that this capability exists it will eventually be used for something worse, but (even as someone who despises a lot of Comcast's business practices) alerting customers that they are about to lose service is not something evil in itself. Everyone technical knows (or should know) that their ISP can modify the content of non-encrypted pages. I can't help but think that most people who complaining about this are actually more distraught at having their illusion of security broken than they are at Comcast's behavior. Getting mad at this is like threatening to sue the locksmith you hired for demonstrating how easily your current locks are easily bypassed with a bump key. The problem is not with the legitimate uses of this sort of injection, but the potential for misuse, which has not yet been demonstrated.