18 ms·
TLDR: ISP injected script tag ads. I heard on the latest This Week In Security that Comcast was apparently not just injecting JS, but injecting bad JS. Meaning
by mmahemoff 14y ago
TLDR: ISP injected script tag ads.
I heard on the latest This Week In Security that Comcast was apparently not just injecting JS, but injecting bad JS. Meaning that closures weren't used, so name collisions could occur with the actual sites users were visiting.
For this reason, I can see HTTPS becoming standard, even for public, non-logged in users. I'm in the process of updating my site to be all-HTTPS and recently got confirmation (as much as one could ever expect) from Google there's no SEO penalty (http://goo.gl/sbtxq http://goo.gl/sbtxq).
- godfreykfc 14y agoYou're probably referring to https://news.ycombinator.com/item?id=5482178 https://news.ycombinator.com/item?id=5482178
- stephen_g 14y agoIf your site has a login page anywhere on your domain, I think that really every page should be served over HTTPS, and it should use HSTS to make sure the browser knows it should always be accessed that way. Even if your login page posts to https, if there's a man in the middle somewhere between your server and user and your login page is HTTP, they can alter the login page to post somewhere else. If your login page is HTTPS, then they can change links to that page to something different. Only with HTTPS for the entire site is it safe from those attacks. It is still vulnerable if there is a MITM the very first time the browser has ever visited the site, but it's a whole lot better than always being vulnerable!
- zerr 14y agoThank you very much for TLDR. It is horrifying how many life-hours are spent for such bullshit stuffed articles...
- da_n 14y agoI would like to see https everywhere, but the cost of certs is still an issue.
- smackfu 14y agoTo be clear, Comcast wasn't injecting ads, but bandwidth overage messages. Still terrible though.