Slashdot Mirror
ISP Inserting Content Into Users' Webpages
geekmansworld, among other readers, lets us know that the Canadian ISP Rogers is inserting data into the HTTP streams returned by the Web sites requested by its customers. According to a CBC article, Rogers admits to modifying customers' HTTP data, but says they are merely "trying different things" and testing the customer response.
replace "trying different things" with "seeing what we can get away with" and your closer to the truth
If you mod me down, I will become more powerful than you can imagine....
Let's get rational for a second here; the ISP is trying to inform you you're reaching your limit, so you don't overshoot it and start having to pay extra. Lets put arguments about limits aside (after all, you've agreed to a contract involving limits). It's in their interests _not_ to inform you, as you'd have to start paying them extra. But they're trying to find a more pervasive way of letting you know. How else can they do it? Via email? They'd just send it to the email address they provide you with. Who really uses isp-provided email these days? it's all webmail, so they need some window to get through to you, and maybe http is that window.
"I think it would be a good idea" Gandhi, on Western Civilisation
This is not a dupe, it's merely your isp inserting outdated data in to your webpage because Slashdot didn't pay your ISP the brand new anti-crapification fee.
It takes a man to suffer ignorance and smile
Be yourself no matter what they say
In other news, a mad internet subscriber broke into the headquarters of a Canadian ISP called Rogers. Upon entering, he hit shot two techs, broke 3 servers with a sledgehammer and then proceeded to start a fire in the CEO's office. Upon being apprehended by police, he was let go after informing them that he meant no harm and was just trying some different things to see how the company would react.
Babies come from people "experimenting" too.
It seems that the customer would be less unhappy about a warning that he is about to reach a bandwidth cap, page modifications and all, than just get a thousand dollar bill out of the blue. There is no set mechanism for the ISP to communicate with the customer over Internet, so creating one might be justifiable in this case. Write again when a (non-free) ISP injects ads or blocks competitor's websites.
According to a CBC article, Rogers admits to modifying customers' HTTP data, but says they are merely "trying different things" and testing the customer response.
Oh, well, that's ok then, if you are only trying different...HEY! Wait a minute! You can't do that. Why, I oughta....
Are they doing that with Oven Mitts? No?! Lame....
I got your "customer response" right here.
Seriously, when it becomes acceptable for the phone company to break into my conversation with "Did you know that Geico can save you ton of money on car insurance?" then my ISP can screw around with my Web pages. Otherwise, get your sticky paws OFF me, you damn dirty apes.
The higher the technology, the sharper that two-edged sword.
That is to say, this is a case of your ISP using packet modification to insert code into your HTTP stream, but it doesn't have to be so innocuous. It's quite possible that someone who has hacked into your ISP could do the same thing.. and not just to HTTP streams, but any TCP stream. Downloaded any executables lately? Its quite possible that a hacker could have intercepted any packet that begins with "MZ", has a non-zero value at offset 0x3c which contains a 4 byte offset into the packet that has "PE" at it. There's a windows binary, let's change the bytes at the entrypoint to do something malicious.
SSL is your friend.
If only we could get IPSEC happening.
How we know is more important than what we know.
It seems we just had a story that talked about Rogers.
Will ISP Web Content Filtering Continue To Grow?
(No, this one words it differently. -- Inserted by your friends at the NSA)
I propose turning their company name into a verb, "roger", which means to manipulate internet data without the receiver's permission. Everytime you exclaim, "I've been rogered!" or "They rogered my data!" the Rogers company name will hold on to its well-earned place in history. And yes, "roger" already means something else quite similar. With either definition, something is being inserted where it probably shouldn't go.
I am a Rogers [V1AGR4] customer, and I [MORTGAGE RATES FALL AGAIN!] think you're all just overreacting [VISTA - THE BEST WINDOWS YET!].
Now let's have no more talk about this bizarre coverup.
So.... why aren't there any high profile lawsuits against Rogers yet?
First they throttle BitTorrent traffic. Then, when BitTorrent users encrypted their connections, all encrypted traffic was throttled, making VPN connections unbearably slow.
The only reason I can think of that they're getting away with this is that...uh...people in Ontario don't telecommute at all?
Why is everybody letting Rogers get away with these shenanigans? Rogers' practises must be costing some business users serious money. I simply don't understand.
This space left intentionally blank.
If advertisers blacklisted ISPs, wouldn't that make those ISPs users have a better experience? Sounds like a win-win. ;)
This is a dupe, but it's worth commenting on.
The fundamental problem I see with this is that the ISP is changing the content of webpages to suit their own interests. There are a myriad of problems here, regardless of whether or not the customer accepts it:
In light of the fact that a certain ISP blocked access to union websites, this is an alarming event indeed. Democracy depends on the free flow of information, and I'm thinking that it might be appropriate to make such a practice illegal, if only for the sake of preserving democracy. It will first be used for commercial gain, and later, leveraged as a political tool.
The society for a thought-free internet welcomes you.
If you want news from today, you have to come back tomorrow.
What a really stupid thing to do. Never mind that it's unethical, they just lost their common-carrier status. Now the RIAA can sue them for contributory infringement ;-)
At least, that's my understanding of it - ISPs and postal services are legally "common carriers", i.e. they just deliver stuff; they aren't responsible for any legal ramifications of what they deliver. Eg the post service isn't liable if someone mails a forged cheque. BUT...if they demonstrate that they control, inspect, and modify what they are delivering, they might just be liable when someone uses their network to commit fraud.
See this old Slashdot article on how servers can detect such modifications when they happen by using a bit of Javascript as an integrity checker.
(Disclaimer, I'm one of the authors of the work)
Test your net with Netalyzr
And I wonder how many times they're going to insert this story into Slashdot.
Sheesh, evil *and* a jerk. -- Jade
Web sites need to enable HTTPS properly over their entire site. Then your ISP can do nothing more than just prevent the secure connection from being established. And if they do that, they break all kinds of stuff like shopping checkout and access to bank accounts.
Right now, Slashdot's own HTTPS URL just redirects to the HTTP URL. This needs to be changed to just leave things in the HTTPS mode. Eventually this should be changed so that HTTP redirects to HTTPS. Google does the same boneheaded redirection.
now we need to go OSS in diesel cars
As much as I don't like Canada, the totally awesome Rogers ISP is not doing something wrong here. Thats all I have to say. PS, buy a Playstation 3 at 20% off by mentioning the code ROGERS ISP ROCKS at your local S-mart
God spoke to me.
After the Comcast bittorrent interference, the Electronic Freedom Foundation released a tool called pcapdiff. The idea is you capture what your ISP sends you for a given website using wireshark/tcpdump and compare it to what your friend gets for the same site. Pcapdiff diffs the two pcap files and reports discrepencies.
On Fedora you can do "yum install pcapdiff".
It's an early release, but there's bound to be a lot more uses for pcapdiff ahead...
Even better, the CBC article concludes with a reference to the Telecommunications Act, which states that "a Canadian carrier shall not control the content or influence the meaning or purpose of telecommunications carried by it for the public."
Rogers has a long history of playing as dirty as it can get away with. If the old pattern repeats as before, Canadian regulators will respond and Rogers will be forced to back down, leaving everyone -- regulators, investors, competitors, consumers -- slightly more pissed off with it than before.
Parity: What to do when the weekend comes.
Looks like it should. We probably also need a new standard for lightly encrypted pages. Light enough to not put undue strain on the server but heavy enough to make it impractical to modify pages on the fly.
ISPs commit copyright violation by delivering unauthorized derivative works.
For those outside of Rogers' service area, who have not had the pleasure of experiencing their so-called Customer Service directly, you can do so vicariously at http://www.ihaterogers.ca/.
Rogers are clearly not inserting content into users' web pages, as the title claims. They are inserting content into pages viewed by users.
So I have little faith in the claim that they are "intercepting http." What is more likely is that the default proxy server they provide is inserting the content. While it may make little difference to the average user, as the "normal" setup uses the proxy, it seems to me that there's a huge difference between supplying a proxy and intercepting and manipulating http traffic; that is, hijacking TCP port 80. The proxy I can easily avoid by using a direct connection to the internet; TCP hijacking, I can't.
"The little cable company that could." They practically invented negative billing, starting their reign of aggravating barely-legal business practice as far back as the early 80's with the stupid bundling of the new pay-channels. They successfully lobbied to crack open the Bell monopoly so that they could compete on the phone market. Everybody believed their bullshit campaign and as a result, everybody pays many times more for phone service which has fallen from one which was affordable and which worked hard-core in favor of the consumer, (if Bell tried to screw you around, a quick call to the CRTC, and they'd be nodding yes-sir to you. Monopolies are great in this way because the public can very easily punish them through government pressure to do the right thing if they start getting greedy and evil), --phone service through bell and all the competitors has since devolved into a system which is now expensive, punitive, crappy and generally mean-spirited, (all contrary to the whole 'competition breeds excellence' meme which should be obvious for the falsehood that it is to anybody with a brain but which somehow remains an elusive truth; I blame the same American ideological propaganda which has landed us in Iraq and which is responsible for rolling black-outs and for people whose lives suck because they can't afford medical insurance. Thanks, guys! Keep on championing the lie while you take it in the rear.) (Ahem. Did I say all of that out loud? DO pardon me.)
Anyway. . .
Rogers argued that it had the right to use Bell's cable system because it had been built in part with public money, and then they turned around and refused to share its own cable system because they claim to have made it with private money. --All claims which are so riddled with lawyer-logic as to make anybody aware of the situation hopping mad, especially when one considers the huge tax-breaks and government hand-outs Rogers managed to weasel away with; they use the publicly-funded telephone pole system, on public land, to hang its infrastructure, over-charge for their rotten service, don't share and don't pay their taxes. Nice job! --The whole thing reeks, but they got away with it because the public was asleep and easily fooled by promises that, "With competition, your phone bills will go down!" Stupid, stupid Torontonians! Even as a teenager I could see the way the wind was blowing, and yet today few even grasp that they've been screwed. Sigh.
Rogers is one of those companies which has been sneaky and crafty and generally foul from the get-go. This latest move is entire par for their course. I don't own a television and I don't use a cell phone partly because of players like Rogers. Anybody ignorant enough to sign up with Rogers deserves exactly what they get.
-FL
... your jar is probably a little too big. And you're a vicious bastard -- do you have any idea how hard I'm looking to find one for retail price right now, to say nothing of two?
Help poke pirates in the eyepatch, arr.
O2 in Germany has been doing this for UMTS connections for a long time. They've figured that stripping whitespace and artificially compressing images before transmission will save bandwidth.
Unfortunately, their white-space stripper breaks XML-wellformedness, which makes me unable to view any of my own sites with Firefox (unless I disable application/xhtml+xml as an Accepted content type).