A few years ago someone reviewing a public page I was serving over HTTP came and asked "It is breaking the page on my browser, producing a weird console error,

A few years ago someone reviewing a public page I was serving over HTTP came and asked "It is breaking the page on my browser, producing a weird console error, and I don't like the look of some of the things the JavaScript code does." This person's review affected whether we'd use my work or not. I found the criticism puzzling, because I couldn't explain the condone error, and did nothing bad in JavaScript. It took several days before I asked them to show me the page in their browser, and then to show me which bit of JavaScript was bothering them. I didn't recognise the code, and wondered what I had screwed up with my build scripts. But when I looked at the page with my browser we found the source of errors: The ISP used by the institution we worked at was injecting its own code into every HTML front page for tracking or some other unclear purposes. It had been doing this for all devices connected to the network and nobody knew. That was our motivation to switch all our static pages to HTTPS asap, and towards an HTTP client relay VPN at the router, because other sites accessd by users inside the institution should not be subjected to ISP code injection either.