6 ms·

Confirmed on a Google Nexus. In his webpage he also says "They downgrade all images and insert a javascript link into the HTML of each page." The image downgr

Confirmed on a Google Nexus. In his webpage he also says "They downgrade all images and insert a javascript link into the HTML of each page." The image downgrading has been know about for ages, the JS I have not heard about before. I have asked for more info on Twitter but will investigate myself if I can find time today.

jarofgreen 15y ago
https://twitter.com/#!/O2/status/161872584634408960 https://twitter.com/#!/O2/status/161872584634408960 says "@lewispeckover Hi Lewis. The mobile number in the HTML is linked to how the site determines that your browsing from a mobile device #O2Guru" As Lewis replies, "@O2 User-agent header ID's the device. Passing mobile number to third party sites is not ok! Seems like a data protection act breach to me?" Being charitable, that could be clueless support rather than official policy response but hopefully the storm coming their way will get an official response soon.
- alexchamberlain 15y ago
  From the oracle (Wikipedia), Data must not be disclosed to other parties without the consent of the individual whom it is about, unless there is legislation or other overriding legitimate reason to share the information (for example, the prevention or detection of crime). It is an offence for Other Parties to obtain this personal data without authorisation. It is in fact illegal for the website to obtain this information... Lew, you're going down... Only joking.
- cubicle67 15y ago
  The mobile number in the HTML is linked to how the site determines that your browsing from a mobile device #O2Guru" ...and for people using iPod Touches or similar?
- mattmanser 15y ago
  Their twitter has now exploded with a flurry of tweets like '@user we are investigating these reports and will provide more information as soon as we can.'
jarofgreen 15y ago
While waiting for an upload, I had a look. This tag is inserted in the head: <script src="http://1.2.3.4/bmi-int-js/bmi.js http://1.2.3.4/bmi-int-js/bmi.js language="javascript"> This is inserted at the end: <script language="javascript"> </script> The external JS is here: http://pastebin.com/rv3k4meX http://pastebin.com/rv3k4meX Analysis please. At an initial glance it seems to just be about the image compression.
- iamichi 15y ago
  Here is a un-minified version: http://pastebin.com/t0FhS2Z7 http://pastebin.com/t0FhS2Z7 My quick glace at it agrees with you, it looks like it replaces the URLs of the images, presumably to load compressed versions.
samarudge 15y ago
The javascript changes all image URL's to lower quality versions from O2's servers, it also provides a helpful little function which lets you use a hotkey (Alt+D I believe) to download all the images in full quality. The javascript comes from the domain //1.2.3.4/bmi-int-js/bmi.js (Not a real domain, only works behind O2's proxy)
larsgirndt 15y ago
We got aware of that problem in October 2011 during relaunch of our website and we faced it also with t-mobile in germany. After digging around helpful sources have been http://stackoverflow.com/questions/4113268/how-to-stop-javascript-injection-from-vodafone-proxy http://stackoverflow.com/questions/4113268/how-to-stop-javas... Besides injecting the bmi.js they also do their own javascript compression. At that time we had our own minified version of jquery, which got corrupted by their compression. They assume that /* always denotes a starting comment. This is wrong for the jquery lib, which contains some strings containing /* to denote mime type patterns. Anyways, we solved those compression issues with cache-control:no-transform. Also gzip compressing the HTTP responses worked.
- tomgallard 15y ago
  Yes- we were stung by this one. Our boss saw errors loading the site on his iPad, but whenever we brought him into the office to try and replicate it, the problems disappeared. We finally figured out it only happened when he was out the office, so on 3G not WiFi, and then managed to find the stackoverflow post you mention.

jarofgreen 15y ago

https://twitter.com/#!/O2/status/161872584634408960 https://twitter.com/#!/O2/status/161872584634408960 says "@lewispeckover Hi Lewis. The mobile number in the HTML is linked to how the site determines that your browsing from a mobile device #O2Guru" As Lewis replies, "@O2 User-agent header ID's the device. Passing mobile number to third party sites is not ok! Seems like a data protection act breach to me?" Being charitable, that could be clueless support rather than official policy response but hopefully the storm coming their way will get an official response soon.

alexchamberlain 15y ago
From the oracle (Wikipedia), Data must not be disclosed to other parties without the consent of the individual whom it is about, unless there is legislation or other overriding legitimate reason to share the information (for example, the prevention or detection of crime). It is an offence for Other Parties to obtain this personal data without authorisation. It is in fact illegal for the website to obtain this information... Lew, you're going down... Only joking.
cubicle67 15y ago
The mobile number in the HTML is linked to how the site determines that your browsing from a mobile device #O2Guru" ...and for people using iPod Touches or similar?
mattmanser 15y ago
Their twitter has now exploded with a flurry of tweets like '@user we are investigating these reports and will provide more information as soon as we can.'

jarofgreen 15y ago

While waiting for an upload, I had a look. This tag is inserted in the head: <script src="http://1.2.3.4/bmi-int-js/bmi.js http://1.2.3.4/bmi-int-js/bmi.js language="javascript"> This is inserted at the end: <script language="javascript"> </script> The external JS is here: http://pastebin.com/rv3k4meX http://pastebin.com/rv3k4meX Analysis please. At an initial glance it seems to just be about the image compression.

iamichi 15y ago
Here is a un-minified version: http://pastebin.com/t0FhS2Z7 http://pastebin.com/t0FhS2Z7 My quick glace at it agrees with you, it looks like it replaces the URLs of the images, presumably to load compressed versions.

samarudge 15y ago

The javascript changes all image URL's to lower quality versions from O2's servers, it also provides a helpful little function which lets you use a hotkey (Alt+D I believe) to download all the images in full quality. The javascript comes from the domain //1.2.3.4/bmi-int-js/bmi.js (Not a real domain, only works behind O2's proxy)

larsgirndt 15y ago

We got aware of that problem in October 2011 during relaunch of our website and we faced it also with t-mobile in germany. After digging around helpful sources have been http://stackoverflow.com/questions/4113268/how-to-stop-javascript-injection-from-vodafone-proxy http://stackoverflow.com/questions/4113268/how-to-stop-javas... Besides injecting the bmi.js they also do their own javascript compression. At that time we had our own minified version of jquery, which got corrupted by their compression. They assume that /* always denotes a starting comment. This is wrong for the jquery lib, which contains some strings containing /* to denote mime type patterns. Anyways, we solved those compression issues with cache-control:no-transform. Also gzip compressing the HTTP responses worked.

tomgallard 15y ago
Yes- we were stung by this one. Our boss saw errors loading the site on his iPad, but whenever we brought him into the office to try and replicate it, the problems disappeared. We finally figured out it only happened when he was out the office, so on 3G not WiFi, and then managed to find the stackoverflow post you mention.