5 ms·

pretty much pure evil. But hey its GoDaddy right? There are at least three places where you can get injected, one is from the ISP (including phone company netw

pretty much pure evil. But hey its GoDaddy right? There are at least three places where you can get injected, one is from the ISP (including phone company networks), one is from the hosting provider, and one is from add-ons in the browser. One of the first Java applets I wrote (and you could easily do this in js) did a hash over the document page and reported if the hash didn't match the one stored in the applet. These days you could throw up an other wise invisible div that said "Page Tampered" please report to webmaster (or you could even do that yourself with a lookup on your hosted side to a script that would log IP/browser etc.

userbinator 8y ago
These days you could throw up an other wise invisible div that said "Page Tampered" please report to webmaster (or you could even do that yourself with a lookup on your hosted side to a script that would log IP/browser etc. I've already encountered pages like that, they piss off everyone who uses adblocking/filtering so I would consider it an anti-user technique.
markdown 8y ago
> There are at least three places where you can get injected, one is from the ISP I'm not sure if they still do it, but Vodafone in my country (and many others) used to cache and compress photos on all websites, which often led to visible degradation in image quality. Luckily I discovered that their software respected the `Cache-Control: no-transform` header so include that header on all my websites now.
- int0x80 8y ago
  Vodafone did also inject custom js/html in non HTTPS pages (obviously). This was 2 years ago.
  - markdown 8y ago
    That's right. The js rewrote all image src attributes to point to the "optimised" photos they'd cached.
johncolanduoni 8y ago
Are they sophisticated enough to modify CSP directives (in HTML or headers) to allow their scripts? If not that would be an easy solution.
ufmace 8y ago
Wouldn't it be better to just set up TLS terminated in a service you control?

userbinator 8y ago

These days you could throw up an other wise invisible div that said "Page Tampered" please report to webmaster (or you could even do that yourself with a lookup on your hosted side to a script that would log IP/browser etc. I've already encountered pages like that, they piss off everyone who uses adblocking/filtering so I would consider it an anti-user technique.

markdown 8y ago

> There are at least three places where you can get injected, one is from the ISP I'm not sure if they still do it, but Vodafone in my country (and many others) used to cache and compress photos on all websites, which often led to visible degradation in image quality. Luckily I discovered that their software respected the `Cache-Control: no-transform` header so include that header on all my websites now.

int0x80 8y ago
Vodafone did also inject custom js/html in non HTTPS pages (obviously). This was 2 years ago.
- markdown 8y ago
  That's right. The js rewrote all image src attributes to point to the "optimised" photos they'd cached.

johncolanduoni 8y ago

Are they sophisticated enough to modify CSP directives (in HTML or headers) to allow their scripts? If not that would be an easy solution.

ufmace 8y ago

Wouldn't it be better to just set up TLS terminated in a service you control?