Charter Is Latest ISP To Plan Wiretapping Via DPI

Charter Communications has begun sending letters to its customers informing them that, in the name of an "enhanced user experience," it will begin spying on their traffic and inserting targeted ads. This sounds almost indistinguishable from what Phorm proposed doing in the UK. Lauren Weinstein issues a call to arms.

Comments

Call to arms?

[Gothmolly]

So if I blog something, and title it a 'call to arms', am I suddenly relevant too?

Re:Call to arms?

[Anonymous Coward]

Maybe, if your 'call to arms' is any good. And being somewhat known helps too I guess http://en.wikipedia.org/wiki/Lauren_Weinstein_(activist)

Re:Call to arms?

[davester666]

And to increase your security, we have to listen to all your phone calls.

Re:Call to arms?

[stewbacca]

So if I blog something, and title it a 'call to arms', am I suddenly relevant too? No, you first have to include incendiary slashdot summaries like Company X to SPY on YOU!

Re:Call to arms?

[gstoddart]

So if I blog something, and title it a 'call to arms', am I suddenly relevant too?
No, you first have to include incendiary slashdot summaries like Company X to SPY on YOU!

OK, let's cut out the middle man here, and go straight to what Charter is saying:

How does this service actually work?
It uses completely anonymous information and, based on your surfing and search activity on the Internet, it infers your interests in certain product or service categories, such as automobiles/sports cars, fashion/handbags, or travel/Europe, and so forth.

Translated ... we're going to inspect the contents of your packets, and infer what you are looking at. Then we will use that information to increase our revenue by supposedly giving you more relevant ads.

So, tell me, how exactly is reading my packets that much different from "spying" on me? I expect my phone carrier to not listen to my calls to decide what inserts they should put into my next bill, because telcos are supposed to have an arms length relationship with your data.

This is not nearly as inflammatory and knee-jerk as you make it out to be. They actually are reading what you do.

And, for the record, it can't be "completely anonymous" if they know to put it into my web-page. They may claim that they can't tie it to you, but, if they know to give you an ad for Depends Undergarments, at some point, they decided that you needed to receive that targeted ad.

Cheers

Re:Call to arms?

[stewbacca]

So, tell me, how exactly is reading my packets that much different from "spying" on me? I couldn't help notice that the linked article doesn't use the word "spying" at all, but slashdot doesn't seem to mind upping the rhetorical ante in that regard. I'm not saying it ISN'T spying; I'm just saying the language is argumentative on purpose.

Re:Call to arms?

[Anonymous Coward]

I couldn't help notice that the linked article doesn't use the word "cerulean" at all, but slashdot doesn't seem to mind upping the rhetorical ante in that regard. I'm not saying it ISN'T cerulean; I'm just saying the language is argumentative on purpose.

All they said was "A hue approaching the color of the clear sky in the daytime" How dare slahsdot suggest that it's cerulean.

Re:Call to arms?

[rob1980]

No, but your 6-digit UID should be enough! Maybe.

Re:Call to arms?

[gstoddart]

So does that mean that rogers.com is already wiretapping its' customers in Canada?

Well, our Privacy Commissioner is wondering that.

Cheers

Re:Call to arms?

[tmarthal]

The same way that AOL Released Search Results for 650k users anonymously with huge privacy and "Spying" concerns.

In my opinion, this is no different, albeit not for academic reasons, but more for a commercial gain (which might make it worse).

Re:Call to arms?

[innerweb]

I couldn't help notice that the linked article doesn't use the word "spying" at all, but slashdot doesn't seem to mind upping the rhetorical ante in that regard. I'm not saying it ISN'T spying; I'm just saying the language is argumentative on purpose.

Here, I'll help you with the understanding of that...

Spying -

• 3. a person who seeks to obtain confidential information about the activities, plans, methods, etc., of an organization or person, esp. one who is employed for this purpose by a competitor: an industrial spy.Most Internet Users expect their traffic to be unmolested and not intercepted in typical usage.
• 8. to search for or examine something closely or carefully.
• 10. to discover or find out by observation or scrutiny (often fol. by out).
• 12. to inspect or examine or to search or look for closely or carefully.

Now, I don't know about you, but these being some of the definitions of spying, and these being the actions being described as being planned by the company, it would seem that the term spying is not just appropriate, but self-proclaimed via definition by the company itself. Maybe I missed something.

InnerWeb

Re:Call to arms?

[xiong.chiamiov]

if they know to give you an ad for Depends Undergarments Don't you mean Lightspeed Briefs?

Re:Call to arms?

[arakon]

Then my 5 digit should put me over the top.

TO ARMS, I SAY!

Re:Call to arms?

[Keeper Of Keys]

Agreed. And sometimes the rhetorical ante needs to be upped.

Re:Call to arms?

[JohhnyTHM]

It uses completely anonymous information and, based on your surfing and search activity on the Internet, it infers your interests in certain product or service.

So, targeted pr0n ads then?

Re:Call to arms?

[BlueStrat]

You missed my point entirely. The original article, consisting of REAL journalists, avoid the provocative term "spying" because they are professional. Slashdot is sensational. You give me a nice list of definitions there, but maybe you should continue searching reference.com for deeper meanings. Besides, I have a 15+ year career in Intelligence, so I think I know a little bit about the subtleties relating to spying.

Perhaps those "REAL" journalists are a little more concerned about offending a possible advertising revenue stream provider than they are about getting to the meat and potatoes of the subject, rather than any "professionalism" being involved.

Intelligence gathering (spying) isn't only performed by uniformed and/or three-letter military/government agencies in foreign countries by cloak-and-dagger secret agents or involve the use of classified satellites, with all due respect to your intelligence career.

Sometimes people and corporations do it to other people or corporations for purely financial and leverage reasons. Having this infrastructure openly in place would make it trivially-easy to target/flag users of interest for further deeper data inspection and snooping.

Trade secrets and other information of commercial interest, blackmail material for troublesome and/or litigious people, as well as for key individuals of regulatory agencies and politicians, etc. Such a system could be a treasure-trove, and the only assurance we have that it won't be used as such is a letter from some PR/Marketing Dept. 'droids?.

With the track record of amoral behavior corporate America has shown over the last few decades, that's not enough for me, nor many others I'd wager.

Cheers!

Strat

Re:Call to arms?

[ultranova]

The original article, consisting of REAL journalists, avoid the provocative term "spying" because they are professional. Slashdot is sensational. You give me a nice list of definitions there, but maybe you should continue searching reference.com for deeper meanings.

No matter what deeper meaning the word "spying" might have, using it to describe someone listening in on my data stream in order to gather data about me and my personal habits is perfectly appropriate. The action described is provocative, no matter what it is called.

And a journalist who doesn't dare call a provocative action by its proper name is not a REAL journalist, but a lily-livered wannabe.

Besides, I have a 15+ year career in Intelligence, so I think I know a little bit about the subtleties relating to spying.

Do you, by any chance, work for Charter ?-)

Enhanced user experience

[Chris Burke]

Someone needs to tell Charter that you don't "enhance" suck.

Re:Enhanced user experience

[Tackhead]

Someone needs to tell Charter that you don't "enhance" suck.

IBM:Apple::Comcast:Charter.

Proof by Advertising follows:

IBM: Think.
Apple: Think Different.

Comcast: Suck.
Charter: Suck Different.

Re:Enhanced user experience

[carambola5]

Someone needs to tell Charter that you don't "enhance" suck. That "someone" could be you.

If you live in the Madison, WI area, attend the Madison Broadband Telecommunications Regulatory Board Meeting this Thursday (May 15, 2008) at 5:30pm in Room 103A of the City-County building (210 MLK Blvd). Complain during the Public Comment part of the meeting, which is immediately after Call to Order and Roll Call. I plan to be there.

If you don't live in the Madison, WI area and have Charter as the local franchise, find out when your municipality holds its regulatory meetings. They tend to be monthly or bimonthly and should be open to the public.

[To no one in particular:] Get out from behind your computer desk and get in someone's face! Tell your government that maintaining a laissez-faire attitude towards Charter is not working.

Re:Enhanced user experience

[BarryJacobsen]

Oooo, thanks for the information! I live in Madison and wasn't aware of that meeting in the slightest. This is exactly the type of thing I'd be interested in going to, but just don't seem to know how to find out about their existence. How did you find out about it, out of curiosity? Was I mailed something (that maybe my roommates threw out) or is there a website that lists upcoming meetings like that?

Re:Enhanced user experience

[carambola5]

I called into net@nite awhile ago and Leo Laporte suggested I go search out the information. I eventually found the city's cable webpage, which is woefully not up-to-date, but the city's scheduling system had the meeting listed.

Re:Enhanced user experience

[Chris Burke]

If you don't live in the Madison, WI area and have Charter as the local franchise, find out when your municipality holds its regulatory meetings.

Yeah, sorry, but I escaped Charter a long time ago. I have Grande instead, which is proving to be good local competition with Time Warner. They're the only service company of any kind whose sales rep has actually tried to talk me down in my package selection. Since I stayed with the higher BW one and had great results, I'm assuming it's not because they're afraid of overselling their capacity.

Re:Enhanced user experience

[sqldr]

Microsoft: We finally made something that doesn't suck.. a vacuum cleaner!

Re:Enhanced user experience

[tomthegeek]

Great idea, anything you would like me to say?

Re:Enhanced user experience

[Anonymous Coward]

"If you live in the Madison, WI area, attend the Madison Broadband Telecommunications Regulatory Board Meeting this Thursday (May 15, 2008) at 5:30pm in Room 103A of the City-County building (210 MLK Blvd). Complain during the Public Comment part of the meeting, which is immediately after Call to Order and Roll Call. I plan to be there.
"

the UKs Phorm activistes are always looking for more information as regards Phorm, and NebuAd (they have offices the UK awaiting the outcome of the Phorm trials [threat]).

we have a lot of info regarding Phorm but not that much for the NebuAd.

the Phorm Public meeting was video taped upto a point by the attendees , but we missed the _vital_ and very informative (some might say embarising for the Phorm CEO etc) Q&A section at the end, as we were informed that they would release the full unedited professional video taken as soon as it was re-encoded for online use.

guess what, they never released it....

if you get a chance to take video footage of this NebuAd public meeting, make sure you get every single minute of it,and sound recordings perhaps, for use later proof of any revealing facts and quotes, especially regarding the tech operation and webmaster opt out options....

see the cable forum Phorm thread to see some of the tech points you might also ask NebuAd directly.
http://www.cableforum.co.uk/board/12/33628733-virgin-media-phorm-webwise-adverts-updated.html

if any and all of you do get a chance to take video footage, please make it available and known to the
http://www.cableforum.co.uk/board/12/33628733-virgin-media-phorm-webwise-adverts-updated.html thread so we can also use its contents for our UK NebuAd fight when it comes.

Re:Enhanced user experience

[sochdot]

I live in Madison and hope to make it. Thanks for letting me know. I also just dashed off an email about this CC'd to Larry Palm (my alder) and the offices of the mayor and city attorney. I have no idea who has the real power in this situation, but it sounds like that meeting will be a good place to start. -Jason

Re:Enhanced user experience

[Change]

For those in the San Luis Obispo market, here's some contact information:

SLO County and unincorporated cities: (805) 781-4357
San Luis Obispo, Bridgitte Elke, Principal Administrative Analyst: (805) 781-7151

These are general city contact numbers, I wasn't able to quickly find the contact info for the departments/persons directly involved with cable franchising:
Morro Bay: (805) 772-6200 x5 (administration)
Atascadero: (805) 461-5000
Arroyo Grande: (805) 473-5414 (administration)
Paso Robles: (805) 227-7276 (city hall)
Grover Beach: (805) 473-4550 (administration)

California Public Utilities Commission: http://www.cpuc.ca.gov/puc/

Feel free to call the appropriate city or county contact for your service area and let them know that Charter's inspection of all web traffic going through their network is NOT acceptable to you, and that you prefer your web browsing to remain unmonitored and unaltered by Charter.
When calling, make sure you speak to someone responsible for cable franchising agreements.

Scummy ISPs

[bestinshow]

Does that mean that the ISP will be altering the copyrighted material sent by the websites? Surely this would create an unauthorised derivative work?

ISPs that modify HTML content going over their network are scummy operators. It breaks web pages, it denies revenue to the websites, and is unethical in so many ways.

Re:Scummy ISPs

[coats]

Does that mean that the ISP will be altering the copyrighted material sent by the websites?

Damned right it does. There are no ads on my web pages, for example http://www.baronams.com/products/ioapi/

Can someone tell me whether Charter is inserting any ads? If they are, I want to complain to the Attorney General and to my CongressCritters about felony copyright infringement.

Re:Scummy ISPs

[BSAtHome]

This might actually fly. If some content owner starts a case, they could very well make a case for an "unauthorized derivative" under the copyright rules. Then ISPs or transits must take a license for all material they modify. I for one would not allow third parties to modify my HTML.

Re:Scummy ISPs

[SWCommand]

Nothing so far, but it might just take time.

Re:Scummy ISPs

[gstoddart]

Does that mean that the ISP will be altering the copyrighted material sent by the websites? Surely this would create an unauthorised derivative work?

I should hope at some point, that very theory will get tested in court.

Agree completely that for an ISP to change to contents of a page I request from a 3rd party is just plain wrong. What next, redirecting you from URLs critical of them onto URLs which sing their praises? Preventing you from reading about the services of competitors?

Modifying the requested data is way too invasive, but it seems to be consistent with the whole strategy of "monetizing what your customers do". What you want is irrelevant, you're just a revenue stream.

As has been said so often, I hope things like this cause the networks to lose anything resembling common carrier status -- right now, they're just a network, so whatever you send it up to you.

Cheers

Re:Scummy ISPs

[VeNoM0619]

Regardless of copyright infringement (although it has a lot more legal backing power). The fact that I am paying my ISP should mean they provide me a service (ONE service, that we agreed to). Last I checked I didn't pay someone to mow my yard or deliver something and have them give me a speech about buying someone else.

Re:Scummy ISPs

[Solandri]

Didn't this already get settled when cable TV was first introduced? IIRC the broadcast companies were up in arms about the cable TV companies effectively re-broadcasting their transmissions, but swapping out the ads for ones which paid the cable company. The cable companies argued that the broadcast companies were being paid a fixed amount for the ads, so it didn't matter if they were or weren't included in cable broadcasts. If I'm remembering right, I pretty sure the cable companies lost. I think the current situation is that the cable companies have to contract agreements with the broadcast studios, and most such agreements stipulate the nationwide ads need to be kept in place, but the cable company can switch out some of the local ads (presumably for a fee).

Re:Scummy ISPs

[hansamurai]

You may want to check out this site, which has tests on in-flight ad injection and tools that you can use to detect (aka tripwire) it.

http://vancouver.cs.washington.edu/

Re:Scummy ISPs

[FuzzyFox]

How is it different from what my FIOS TV service is doing?

I have noticed that they often replace the commercials from the feed, with their own commercials. I mostly notice this because they do such a poor job of it, often cutting their commercial in a few seconds late, and cutting it out a second or two early.

Is Verizon violating the copyright on the video feed that they are supplying to me? Are they depriving the feeds of their ad revenue by supplanting the commercials with their own?

Re:Scummy ISPs

[mikael]

The following web site contains some scripts which do self-analysis/ checksum calculations to determinwe whether they have been interfered unlawfully with:

Corruption detection scripts

Re:Scummy ISPs

[profplump]

No, Verizon is paying the content provider -- the source TV station -- for the privilege of inserting their own ads. If Charter had a deal with the source website to insert ads things would be fine and dandy (at least from a copyright standpoint, privacy is another matter entirely).

It is possible that Charter simply has an agreement with DoubleClick or someone to collect more detailed information about browsing habits and override the default DoubleClick ads with better-targeted ads. From a copyright standpoint that would be A-OK, because the source site already allows DoubleClick to select ads for insertion, and DoubleClick has the right to delegate that selection process and/or make use of additional, external information when selecting ads.

On the other hand, Charter could just be shoving ads into every page where their HTML parser can find someplace vaguely appropriate, which would most certainly be a copyright issue. We can only hope they're doing something that stupid, because it would be a great precedent to set, and we'd get to set it at a federal level on the first go.

Re:Scummy ISPs

[dgatwood]

Actually, no it doesn't. Not without permission. From what I recall reading about this a couple of weeks ago in a very similar discussion (subtle way of saying "I think this story is a dupe"), if I understand what is being done correctly, there are two parts to this:

• Deep packet inspection---stores keywords based on sites you visit.
• Ad replacement---replaces existing advertisements on a page.

There's a specific ad provider that is involved with this, and that ad provider agrees to allow the local ISP to replace its ads with more targeted ads in exchange for a portion of the resulting ad revenue. The ad replacement, therefore, is authorized by the ad provider, who in turn is authorized by prior agreement with the website publisher.

The dirty part is the deep packet inspection, not the modification of the data stream. Attacking the latter to try to stop the former is likely to get you nowhere.

Re:Scummy ISPs

[Ihmhi]

Would, say, injecting a layer over the site (and placed above the site, much like Google does when you are searching for Images) really be copyright infringement though? Stealing advertising, maybe.

Re:Scummy ISPs

[mdmkolbe]

For a little while I worked for a company that specialized in catching cable operators that did exactly this. So for example (names have been changed), Cox might be the cable operator and NBC be the network, so NBC wants to be sure that Cox isn't swapping out ads for a little extra money on the side.

So it is something that the networks worry about (we had some big name customers), but I don't know what the law has to say about this. Inserting ads in HTTP might even be a different case because there is a contract that is being breached between Cox and NBC while the ISP probably doesn't have any explicit contract with the web site.

Re:Scummy ISPs

[godawsgo]

Should I add something about using Adblock Plus here?

Re:Scummy ISPs

[iamhigh]

Damn, you guys must have tinfoil hats in your back pocket!!!

While the technology has the capability to replace existing advertising on websites, this isn't being done (for good reason; it would invite massive lawsuits). NebuAd relies on creating partnerships with publishers, then serving up targeted ads to their ad slots in real-time. So they are not REPLACING content, they are working with content providers to do this!
 
I still don't like it, but calm down and at least understand what you are commenting on.

Re:Scummy ISPs

[xiong.chiamiov]

Not really. The point is not that the ads I'm seeing are targeted towards me, based on my browsing habits (which doesn't matter since I block them anyways); the disturbing thing is that there is no way for me to stop Charter from selling my browsing habits to the advertising companies (aside from encrypted traffic and such). And yes, I'm a Charter customer who got the letter today.

Re:Scummy ISPs

[marnues]

I currently work for a cable company that is setting up this same kind of system. The only people that know what ads are being replaced are the people controlling the ad server, which is not the ISP. We (the ISP) are being paid to set up a black box that we will route ALL port 80 traffic through. Unless you opt out, which I'm not even sure will work properly. So the ad people can be doing all kinds of things with that data. Granted, they can't link the IP Address to a customer since they have no access to our provisioning server (and I'm pretty certain every last one of us Systems Engineers would quit before allowing that to happen). But they can be doing whatever they want with that traffic and we are none the wiser. Its such a black box, the ad company does all the monitoring on the black box. We are apparently the only company that even requested that we be allowed to monitor up/down and traffic status. The real problem is that we are setting up this extra router (it is another layer 3 hop) that also acts as a server and will delay any port 80 traffic. And we're pretty much allowing them full access to do as they will with the hostage packets. We're not checking. And if someone isn't happy with what their site looks like, we'll probably just route that one around the server, still pushing everything else through. I hope Google employees are checking their AdSense images to make sure that ads are actually from Google and that they are paying Google. As shady as this whole thing is, I expect that we will have legit ads removed, but leave the 'src' of the 'img' tag.

Re:Scummy ISPs

[dosius]

Didn't TELUS get in trouble in Canada for blocking websites critical of them?

-uso.

Re:Scummy ISPs

[arminw]

....Can someone tell me whether Charter is inserting any ads?....

If an ISP or a phone company monitors the content of a transmission, don't they become responsible for the content? Does that mean they are no longer enjoy protection from lawsuits as carriers of information have had all these years? If someone plans a crime using the phone, the phone company is not held responsible, since they don't monitor the conversation. They only provide the channel.

If an ISP DOES monitor the information, they are doing more than providing merely a channel and could theoretically be held responsible for all content that traverses their lines. If that actually happened, ISPs would quickly back off from such hare-brained content inspection and modification schemes. Maybe some rich person can hire an army of lawyers to sue an ISP for allowing forbidden porn traverse their network. Maybe, even a state attorney can try to make a name for himself.

Re:Scummy ISPs

[baegucb_18706]

the Cable Communications Policy Act of 1984 prohibits collection of personal information cable subscribers, except for very limited purposes: 47 USC 551 "(b) Collection of personally identifiable information using cable system (1) Except as provided in paragraph (2), a cable operator shall not use the cable system to collect personally identifiable information concerning any subscriber without the prior written or electronic consent of the subscriber concerned. (2) A cable operator may use the cable system to collect such information in order to-- (A) obtain information necessary to render a cable service or other service provided by the cable operator to the subscriber; or (B) detect unauthorized reception of cable communications."

Now that a precedent has been set...

[slashname3]

Now that a precedent has been set, I plan to examine and modify the direct deposit traffic found on the network. Just a few simple modifications, change the account number, add a few zeros to the amount, simple things like that.

Wonder when someone will figure out that their ad is being replaced by something else and sues?

Re:Now that a precedent has been set...

[VON-MAN]

I like it, just make sure you call it an "enhanced provider experience".

A plugin needed perhaps?

[DnemoniX]

Here is a project idea then, somebody start up a project to write a Firefox plugin that detects the inserted ads from Charter and either filter them out or replace them with something else.

As a Charter customer I can tell you that this comes as no surprise at all. They are shady as hell and their local offices are havens for the inept.

Re:A plugin needed perhaps?

[TheGratefulNet]

I tried that.

the snag I ran into was that the plugin was 'intercepted/replaced' and I got an ENITRELY different plugin.

that plugin never really replaced the ads properly. hmmm..

(I'll say it again, DPI is quite evil! JUST SAY NO to isp's that do this shit to you and don't give you at least an opt-out from it.)

Re:A plugin needed perhaps?

[bill_kress]

Already done--called addblock plus

Re:A plugin needed perhaps?

[wootcat]

I wouldn't want to block the Charter interceptions so much as log them, then take Charter to court demanding payment for advertising via my site.

1. Create ad placeholders on my site that aren't really ads, but look like them to Charter's system.
2. Create outrageous price structure for ads.
3. Log all instances of interception.
4. Bill Charter.
5. ???
6. PROFIT!!!

(Now I just need to get that down to 3 steps - everyone knows you have to profit by step 3)

Re:A plugin needed perhaps?

[Z00L00K]

Or just change to only browse sites with HTTPS. If they manage to insert ads or other junk into HTTPS then it's time to close the web.

Re:A plugin needed perhaps?

[no1home]

My original thought was to just use Ad Block Plus, which I already use. Then I realized just how incomplete that answer is! Sure ABP stops the ads from showing, but it doesn't stop Charter, et al from spying. So, to the question of a plugin...

There are several options already available, including Firefox plugins. So far, testing indicates that Charter hasn't begun spying on me YET. I'm looking at using TOR and a local proxy. TOR by itself won't help, though, since your data is unencrypted between you and the first TOR point, so you'll want to go all the way with this and run your own TOR server. Communications between TOR points is encrypted by default. Then, run a proxy server. I don't know if it can be on the same machine as the TOR server, but I don't see why not (not something I've investigated yet and there ~could~ be security complications if you do run them from the same server). Tell your computer to always use the proxy and point it to whatever you chose to run. Often, people use Privoxy on the computer itself, so your proxy settings point to your home IP (127.0.0.1). Set Privoxy (or whichever) to use TOR. You'll need TOR installed locally as well. I think it will automatically use the TOR server you're running, so no need to point your TOR client to your TOR server. I could be wrong since, again, I haven't looked into this very much yet. Through this system, all HTTP will be encrypted. You can designate other protocols to pass through this as well.

You could use a plugin that sets up TOR and Privoxy for you, all built into Firefox. I prefer the full, self-assembled method however since it will cover whatever browser I use, along with other web activity, not just FF.

On the other hand, there is the hard way: rebuild your router (you all have a WR54TGL or similar, right?) with proxy and TOR built in. This way, one little box protects your entire network: PC, Mac, XBox, TiVo, etc. I think that's the best way to go, but it isn't for everybody due to the complex (for many) work involved.

I think that using TOR, with your own local TOR server to make sure you have encryption before your data leaves your LAN, will do the trick. I'm equally sure the wonderful, peaceful, polite /. community will correct me if I'm wrong. :D

Re:A plugin needed perhaps?

[xiong.chiamiov]

As some others have said elsewhere, the ads are not the point - we're not going to be getting any *more* ads, just more "relevant" ones. The thing that's to dislike is the fact that there is no way to opt-out of them selling my browsing information to advertising companies.

Re:A plugin needed perhaps?

[Binkleyz]

You know, all that is great, and if you have the time, knowledge and inclination to implement everything you've documented, you're probably going to be able to avoid all of this..

But.... the 99.9% of people that either don't know about this or don't have the time/knowledge/inclination to do anything about it are being royally screwed (again) by their ISP.

The real question is why we're being treated like so many sheep by the ISPs, and why there isn't more public outrage at these tactics.. Nobody can claim with a straight face that people want MORE ads delivered to us, much less ones that are "targeted" at us by stealing (as in not paying us for) our browsing habits (which DOES have tangible value, else the ISPs wouldn't be doing all of this), so why are people just standing by (like the aforementioned sheep) and allowing this to happen?

Makes me really sick.

Re:A plugin needed perhaps?

[no1home]

You are absolutely correct. I chose to answer the question of a plugin simply because I don't know what to do about the overriding problem of these companies treating us like such garbage. I am outraged. The problem is the virtual monopoly that exists in most areas. Sure, here in Pasadena (California), we have the option of leaving the cable company for somebody's DSL service, but there are reasons for why that may be prohibitive for some (single bill point is frequently cheaper, for one). I'm willing to pay more, but the roommates aren't. DSL also depends on the phone lines in the area being in good shape, which is not the case here. We HAD a competing cable provider, but they demonstrated that better service costs more and put themselves in a position to be bought out... by the very company they were competing against: Charter. AT&T's fiber isn't in my area yet and there are no other competitors in this region. So what does somebody in my area and situation do? Cellular broadband is slower and much more expensive, not to mention probably less secure.

I am not disagreeing with you at all. My solution works for only the few of us who have the time and training to put it together. I am outraged that this even needs to come up. Short of shutting down the internet, how do we fix this when there is no competition and most people cannot build a privacy system (and shouldn't have to)? And don't expect the government to fix it; they'll just screw it up more. They probably want access to this data!

And in other news...

[sm62704]

The McDonald's Corporation has begun sending letters to its customers informing them that, in the name of an "enhanced user experience," it will begin using cat poo on their hamburgers as condiments and inserting...

Re:And in other news...

[Anonymous Coward]

and this would differ from current practices how exactly?

Re:And in other news...

[ExploHD]

and this would differ from current practices how exactly? Cat poo is more expensive

COX dns poisoning..

[Anonymous Coward]

The "enhanced user experience" is nothing more than a smoke screen to spy on you, and get more ad revenue for their own personal gain. It's utter bullshit. Recently COX communications implimented nation wide DNS poisoning similiar to what versign does on domains it can't resolve.

http://support.cox.com/sdccommon/asp/contentredirect.asp?sprt_cid=e047dc81-18c4-485f-bcf3-1263d0b7b904

How to opt out of the "enhanced user experience"

How does injecting ad's into my browser "enhance" my experience? Give me more fucking bandwith you money grubbing cheap fucks, and that MIGHT enhance my experience.. I hate them.

Re:COX dns poisoning..

[saberyo]

At least Cox lets you really opt out of it with a static configuration. Charter does this same DNS poisoning/Sitefinder type thing to DNS failures and the opt out procedure relies on a cookie (sound familiar?) that really just makes DNS failures look like stock IE error pages regardless of what browser you use.

Scoundrels.

Now or Never

[hyades1]

Some things call for the proverbial nuclear response: boycotts, lawsuits, all-out opposition. This is one of them. Once one of these corporations gets away with this, it's game over for those of us who want a corner of our lives that doesn't have some lying prick forcing his way into it to sell us something, spin the information we get and otherwise screw with our reality in a way that works to somebody else's advantage at our expense.

Re:Now or Never

[riceboy50]

to sell us something, spin the information we get and otherwise screw with our reality in a way that works to somebody else's advantage at our expense You just summed up the modern world.

Re:Now or Never

[twistedcain]

I have a few websites, and it wouldn't take much to block all requests from charter. It would only take a few thousands webmasters boycotting places like charter and their customers would slowly migrate to better service.

Re:Now or Never

[hyades1]

Thanks for a creative, workable solution to at least part of the problem, maybe more. The bottom line on attacks like this is that they aren't going to stop unless we find a way to put a metaphorical gun to a few corporate heads. The prize is simply too valuable: unrestricted access to the eyes and ears of everybody old enough to access the internet, and no enforceable legal control. It's a bottom-feeder's wet dream.

Re:Now or Never

[Raenex]

The word "modern" overly specifies your statement.

Maybe?

[Anonymous Coward]

Now I think this is a grave violation of so many rights, but I wonder, does this make the service cheaper? Currently in Texas, for me, Broadband is about $30-40 for me, but if this service pegged the service down to say $10 a month, i'd opt for it. Past that, these people deserve better.

Re:Maybe?

[Anonymous Coward]

does this make the service cheaper? No, it won't. Next question please.

Re:Maybe?

[Intron]

If you want internet access and are satisfied with this, then I will sell you $100 Red Sox tickets for $10. It will look just like you are at Fenway, but you will actually be seeing the game with ads on a TV screen.

Details of Phorm

[giafly]

This new system seems very simplar to Phorm, so here are details. The Phorm "Webwise" System - Richard Clayton. Seems you can avoid being monitored by blocking Phorm's cookie.

Re:Details of Phorm

[Z00L00K]

So the next step is for us running websites to provide a different set of pages for any "services" like Phorm so that they get completely confused. A large set of pages provided that only contains texts in latin about plants and animals.

OK, I'll probably get a lot of bird-seed commercials injected then but WTF...

Re:Details of Phorm

[mikael]

Have a look at Track Me Not. It is a Firefox plugin which acts as a spider crawling through the web in the background. In this way, it scrambles any profile that spyware vendors like Phorm try to build up.

Re:Details of Phorm

[mjmeyer]

Charter Communications "Special Offer" "To opt out, it is necessary to install a standard opt-out cookie on your computer. If you delete the opt-out cookie, or if you change computers or web browsers, you will need to opt out again."

Re:Details of Phorm

[Janos421]

As far as I know TrackMeNot just generates queries on search engines. Therefore, spyware vendors will just think that you're googling a lot, not sure that's enough to deceive them.
Besides, I'm developing another FF extension called SquiggleSR that (basically) uses the same idea than TrackMeNot and also simulates click on non-sponsored results.

Firefox add-in to block Phorm

[giafly]

Firefox add-in to block Phorm.

Re:Firefox add-in to block Phorm

[mikael]

You need a plugin to block a cookie? Yes, because Phorm deletes their cookies after two years. You have to visit their web-page or something similar in order stop them providing "context-based adverts". Even then, they are still building up a keyword profile of you based upon the web pages you have downloaded.

I certainly do not wish to be bombarded with adverts on outdoor shooting if I read human rights articles. Nor do I wish to have vermin removal adverts if I start looking for a new multi-function input device. Or even camping and holiday adverts, simply because I am reading historical literature. This is just as a bad as those web-pages where every Noun becomes a green instant pop-up hyperlink to some advertising pages.

Sounds Like...

[Nom du Keyboard]

Sounds like how Microsoft Genuine Advantage is presented as good thing for all Windows users.

The only way this will be any good is if any, or all, of the following are true:

1: You can opt out.

2: You ISP has gone to an ad-supported model that results in a drastic reduction of your monthly fees.

3: They are providing you with extra bandwidth free in order to carry the extra traffic they're generating to you (and not counting it against your usage caps).

Otherwise give them hell until they back off!

One is left to wonder how long before they start actually replacing ads on other sites with their own ads. After all, gangsters like this hate competition. Making you pay to get their ads, however, really sux!

Re:Sounds Like...

[gstoddart]

2: You ISP has gone to an ad-supported model that results in a drastic reduction of your monthly fees.

*laugh* If only that were true. They're trying to gouge you by selling you the service, and then make some more money by selling you targeted advertising based on what they have scraped out of your packets.

One is left to wonder how long before they start actually replacing ads on other sites with their own ads

That's exactly what they've said they're going to do -- in their eyes, they can make more money by changing the ads from 3rd party sites with ones they're getting paid for. They're not talking about selecting the right ads to show you on their pages, but changing the ads you'll see.

Or, are you being ironic? :-P

Cheers

Re:Sounds Like...

[Gat0r30y]

The Article is mostly about how yes, you can opt out, but you have to go to their site, send them an unencrypted form with all your personal information, and download and keep a "privacy cookie" so that the company knows not to track you, and not to insert ads. My question - If anyone other than an ISP did this, it would be illegal right? Can I start going around injecting ads to make me revenue from other peoples original works? Being an ISP doesn't give them any special privilege to infringe on copyright laws right? If they go through with this, and it stands, I'm going to do it too.

Re:Sounds Like...

[InlawBiker]

That is my favorite gripe about Microsoft Genuine Advantage. Advantage for whom, exactly? It's an advantage only for Microsoft, for the customers it's a hassle.

They're not in the business of finding way to cut fees for customers. Not only are Internet ads becoming more invasive, the people selling them are finding ways to subvert each others inventory and revenue. We, as the customers, just sit back and *benefit* from this enhanced user experience.

I hope they all bankrupt each other in court. AdBlock is becoming more and more attractive every day.

Re:Sounds Like...

[brunascle]

a cookie? how would that work? the cookie would only be sent to the website that created it. how would they see the cookie when someone goes to a different site? are they still injecting something into web pages that points to their own site, to check for the cookie? that's still bad, bad, bad.

Re:Goodbye Maggie

[damiangerous]

Margaret Thatcher and Stephen King on the same day? What are the odds?

Instant Global Collapse

[azzuth]

in a few days you could afford that 800,000 dollar DPI machine and automate the process. Within weeks all the worlds wealth will be yours! I for one welcome our slashname3 overlord...

Re:Instant Global Collapse

[slashname3]

I don't want all the worlds wealth. Just a very small percentage will do. There is plenty to go around for everyone on /.

Re:Instant Global Collapse

[TubeSteak]

I don't want all the worlds wealth. Just a very small percentage will do. There is plenty to go around for everyone on /. PETER
Well, how does it work?

MICHAEL
It's pretty brilliant. What it does is where there's a bank
transaction, and the interests are computed in the thousands a day in
fractions of a cent, which it usually rounds off. What this does is it
takes those remainders and puts it into your account.

PETER
This sounds familiar.

MICHAEL
Yeah. They did this in Superman III.

PETER
Yeah. What a good movie.

Praise the invisible pink unicorn for SSH

[NobleSavage]

As a Charter customer I guess now is the time for > ssh -D 9999 me@myserver.com

Anyone on charter, please visit our tripwire...

[nweaver]

If anyone is using charter (or just suspicious of things), please visit our tripwire server:

http://vancouver.cs.washington.edu/, to (hopefully) detect in-flight page changes.

Re:Anyone on charter, please visit our tripwire...

[chihowa]

Have you considered adding some images (preferably a standard banner ad size) to these pages? It's conceivable that the injected ads may replace already present banner ads to avoid screwing up the page layout and drawing attention to the practice to the content providers.

Re:Anyone on charter, please visit our tripwire...

[hansamurai]

Do you have any mirrors on a non .edu domain? Maybe they're being kind to the .edu TLD (doubt it) or even specifically avoiding your tripwire site.

Re:Anyone on charter, please visit our tripwire...

[hansamurai]

Yeah, I did look through the page but I guess I didn't realize what it was doing. I feel dumb now, thanks.

Re:Anyone on charter, please visit our tripwire...

[nweaver]

We've considered this, we haven't yet done this.

Re:Anyone on charter, please visit our tripwire...

[AnotherBrian]

Except that they can search the code coming from *.washington.edu for other domains and add them to the list of pages to not mess with.

Plus, it is very unlikely that they would insert an add into a page that doesn't have one because that could be easily noticed. Although they might try that Intellitxt shit. What would be much more likely is swapping the image from a third party ad server. That would be very difficult for the webmaster or end user to detect because the ads are constantly rotated anyways. The ISP's boxes would even grab the ad image so as not to tip off the provider.

This actually might open up the ISP to a click-fraud complaint by an ad provider.

charter - u-verse

[spottedkangaroo]

I just jumped ship this morning because of their prices. I would certainly pay more for a service that doesn't do this, although I don't have to.

... how do they do the actual inserting? Do they use a transparent web proxy setup? How do they see the cookie? I have so many technical questions I almost wish I hadn't canceled their service yet.

Double-Standard

[LilGuy]

I'm not trying to troll here but these questions will surely sound like it.

Now copyright infringement is a major deal? So the RIAA was on to something when decided to try to protect their copyrighted materials after all?

Re:Double-Standard

[Caste11an]

These two concepts are nothing alike, and you know it.

If I want to record my own music and then post it on the web as a new Backstreet Boys song, or go into a music store and replace all of and artist's CDs with copies that include my song instead of the one that was officially recorded, then you've got a point. And I don't think anyone on Slashdot would argue against the RIAA prosecuting someone who does that.

This is a bait-and-switch. It stinks to the highest elevation and means that ISPs aren't just abusing/violating copyright -- they're also invading my privacy.

If you honestly believe this is a double-standard, you've got some serious fucking problems.

Re:Double-Standard

[howdoesth]

It's about using enemy's own weapons against him. I refer you to the 1968 Supreme Court ruling in Two Wrongs v. One Right.

Re:Double-Standard

[TubeSteak]

Now copyright infringement is a major deal? So the RIAA was on to something when decided to try to protect their copyrighted materials after all? The formal idea of copyright was originally created (after the invention of the printing press) to protect written works and maps.

The US Congress didn't make music a protected work until ~40 years after the first Federal copyright law was passed and even then, most everyone went ahead and ignored it for another 70~80 years.

Copyright on music is a very modern idea.
Copyright on books is a very old idea.

Revoke common carrier status now

[Just Some Guy]

MP3s in the incoming folder? "Charter put them there."

Child porn in the cache? "Charter put it there."

Nuclear weapon plans in email? "Charter sent it."

Seriously, WTF are they thinking? Do they really want to be named as co-defendants in every criminal or civil case brought against their customers? Because if they modified my incoming data and I was later called in to account for anything, you can bet my first line of defense would be to blame it on them.

Re:Revoke common carrier status now

[mlts]

This brings up another concern. Even though Charter/Phorm is not being malevolent, just greedy... what happens if their proxy server/ad server gets hijacked or compromised? Such a server would make a big target for thieves because of the gains.

Should something that injects ads gets compromised, a malware distributer now would have unfettered access to every single Charter subscriber. A compromised ad server could be done in such a way where only a relatively few people at random would get exposed to zero day exploit code.

What was intended as a money stream would make an identity theft ring very happy, with not just being able to add new members to botnets, but to log traffic of subscribers for either use for ID theft, or perhaps extortion.

What is ironic is that damage caused by an ad injection server would be immediately blamed on the destination website, and in a court of law, criminal charges can be pressed and likely made to stick (because juries won't consider ad injector "services" as reasonable doubt.) Civil charges almost certainly will be able to be won. A compromised ad injecting server could easy go for months if not longer, escaping detection, as there would be zero proof that it was the ad injection "service" that did this.

Again, I posted earlier about having some facility to sign Web pages without needing the overhead of full SSL... perhaps someone should look into this, so high volume websites can still serve pages with little overhead, but offer immediate detection if the page is modified in transit.

Re:Revoke common carrier status now

[Anonymous Coward]

Goddamn it, with your UID I would think you know this but ISPs do NOT enjoy common carrier status. If they had common carrier status, they couldn't do this. They have chosen to not have common carrier status and instead embed provisions in their contract with you saying that you agree to claim responsibility for anything bad that comes from your IP address.

Re:Revoke common carrier status now

[compro01]

but they do have a common-carrier like status in the copyright act. can't remember the citation at this moment though.

Re:Revoke common carrier status now

[Forbman]

Well, I think by doing this, then Charter should have to waive its own protections as a "common carrier". They would also be interfering with data streamed by someone else. It will be the advertisers on websites and/or the websites themselves (Google) that will throw Charter around for doing this, much like that french equivalent of the AP sued Google for doing a couple of years ago for Google suckings its news articles into GoogleNews.

On the other hand, cable companies have been injecting local TV ads over national/network advertisements for quite some time. I would like to think that when company X bought their ad time on the network or cable channel in question, that there is some sort of flag sent down the pipe as to whether the cable company can overlay local ads over the network-fed ads. this way, the people paying for the advertisement could get a slightly reduced ad space in exchange for their otherwise national or regional ad from showing up in some markets.

Would ClearChannel (take the FCC out for this argument) be too keen if people were setting up transmitters in areas to blast local advertisements out, overriding whatever ads the station was blasting out (unless it was ClearChannel doing it)? I'm thinking for areas far away from clear channel stations (like up here in Portland over KGO 810 AM) at night having an advertisement company with their own hilltop transmitter spewing out PDX-relevant adverts on 810AM at night... Yes, the FCC would use their Difi equipment and call in a Predator to drop a Hellfire missile onto their pirate transmitter (unless it was a Halliburton or Blackwater subsidiary doing it...).

BTW, this is exactly what the USAF's "Command Solo" aircraft does...

Re:Revoke common carrier status now

[ScrewMaster]

ISPs generally are not common carriers, so there's nothing whatsoever to revoke. They probably should be, but they managed to finagle an exemption for "data services". That's quite irrational, really, given how much phone traffic is carried by the same packet-switched networks that carry regular Internet traffic. I don't know why this myth persists that ISPs want or have ever wanted to be considered common carriers. Even the Telcos who are legally common carriers for their telephone offerings are not common carriers when it comes to data.

Two things...

[stewbacca]

First, much like ANY transaction in any medium, the article claims your name and address is required. Why are we willing to give our name and address out for nearly any transaction, yet as soon as an online transaction calls for it, we freak out? I'm pretty sure when you signed up for Charter service, you probably gave them your name, address, phone number, checking account number, debit card, etc. etc. You probably gave them a deposit and they probably looked up your credit using, gasp, your social security number.

Second, how is this any different than Google? They track my online activity then target me with ads that I might find interesting. Am I even given the option to opt out of Google ads? (serious questions, not flame-baiting)

Re:Two things...

[eNygma-x]

It's different because you are going to Google's website. I'm chosing to use them. But for someone to inject their ads on a site that does not belong to them pisses me off.

Re:Two things...

[FatMacDaddy]

The difference in your first question is that this company is asking you to submit personal information in the clear. I'm pretty sure that most of us would expect to use an https page for that and would not want to submit that information in the open. That was (one of the) big complaint(s) of the person in the article.

As for the second question, the difference I see is that Google puts ads on their search pages, while these guys are proposing to insert ads in *any* page you request.

Any customer who doesn't vote with their feet on this issue deserves what they get.

Breach of copyright

[DigitAl56K]

Isn't inserting ads into pages creating unlicensed derivative works and subverting revenue ala Gator back in the day?

Re:Double-Standard. WHAT?

[Viewsonic]

It has always been a major deal.

I don't think anyone will argue that the RIAA shouldn't be upset that people are giving away their product for free. What people are upset about is that they are demanding extremely high fines that don't fit the crime. Where it should be a warning, or a small fine of perhaps $100, they are destroying peoples lives entirely. The punishment does not fit the crime, which is the problem.

Any ISP could be doing this....

[8127972]

....and the thought of that scares me. It got the attention of another blogger who sees this as a slippery slope in Canada since Bell Canada uses DPI to throttle users:

http://itnerd.wordpress.com/2008/05/13/charter-uses-dpi-to-spy-on-its-users-canada-are-you-paying-attention/

Can a common carrier inspect content?

[artifex2004]

I don't see how they can inspect content like this and retain their common carrier status.

Re:Can a common carrier inspect content?

[Eco-Mono]

ISPs are not common carriers.

Re:Can a common carrier inspect content?

[Knara]

ISPs are classed as "information services".

Re:Can a common carrier inspect content?

[compro01]

yes, but they do have a common-carrier-like exception in the copyright act.

Plugin, or perhaps a signing routine?

[mlts]

For web content that doesn't need to go over SSL/TLS, I wonder about some way of having webservers sign the HTML of the get request with their SSL key, and cache that signature, so subsequent requests of that HTML page have almost no overhead incurred.

Then, on high volume servers that are not needing the security of SSL, the core HTML page that gets to the client can be verified (using the client's CPU time) if it was modified in transit, without the server needing to spend the CPU time for SSL's overhead. If the HTML doesn't match, then offer the user a mechanism to browse the site entirely using SSL.

The only issue is for dynamic content that can't be cached, this will add a cryptographic signing step for each page.

An example:

Someone browses www.foo.com
the webserver at foo.com grabs index.html, signs it with www.foo.com's SSL key, saves the signature in a cache that is reset if someone legitimately edits index.html on the server, then sends the web browser index.html and after that, index.html's signature, perhaps in OpenPGP format. After the first signing, all the webserver is doing is sending two files (index.html and the cached signature.)
The web browser compared the received index.html to the signature, and alerts the user if it was tampered with.

As for my stuff, for low volume web servers such as my home domain, I just automatically redirect the user to the SSL server, because that stops this problem cold. If an ISP is able to intercept SSL traffic, (especially with an EV certificate), they are so advanced at crypto, they deserve to be able to insert ads.

I have a feeling that it will only be a matter of time before not just ISPs that people are subscribed on, but large volume peering nodes will try their hand at inserting ads, so might as well just force as much traffic to SSL whenever possible now, although for high volume sites, this is far easier said than done.

Re:Plugin, or perhaps a signing routine?

[Burz]

Once you are signing/verifying documents like that, you are already expending 95% of the effort to perform the encryption in the first place. So, might as well encrypt anyway IMO.

The actual encryption that takes place is triflingly easy to perform since it involves only a symmetric key which is established after the asymmetric (signing) stuff happens. And it is the asymmetric stuff that is somewhat processor intensive.

Re:Plugin, or perhaps a signing routine?

[SanityInAnarchy]

Once you are signing/verifying documents like that, you are already expending 95% of the effort to perform the encryption in the first place. So, might as well encrypt anyway IMO. Signing can be cached for static pages. Crypto can't.

Re:Plugin, or perhaps a signing routine?

[Burz]

What I'm thinking of is that the initial https login page gets signed and verified, but then the symmetric keys that were exchanged get cached and used for subsequent pages transmitted between the same browser/server. The keys could be expired from either side, after a timeout of 6-8 hours for instance.

Re:Plugin, or perhaps a signing routine?

[SanityInAnarchy]

Yes, I understood your concept. That still requires unique symmetric keys for each user, though, right?

So still not as useful, for a static page, as a single signature that can be cached for all users, meaning you've got your CPU usage down to nothing until the page changes.

Also, they're not mutually exclusive. We're both right! Let's get both our ideas into the next https rfc, or however we'd do that!

Arguing your analogy

[DesScorp]

"Second, how is this any different than Google?

You can choose not to use Google. You know up front, before you use their site, what Google does. You either decide if the loss of privacy is worth it or not, and then choose appropriately. You can use any number of competing search engines.

But most places have no more than three choices of broadband access, with expensive satellite connections one of them. In reality, if customers really won't stand for Charter's actions on this, it means changing their ISP to whoever their local DSL provider is.

I'm fairly sympathetic to ISP companies trying to get the most revenue out of customers in different ways, as long as its not a matter of forcing something on customers... after all, those networks, with a lot of physical infrastructure, in addition to network administration and staffing, cost a lot of money to set up and operate. And these companies are for-profit businesses, after all, not charities. But this goes way too far. This isn't just violating a customer's privacy. That's too simple. It's violating their very user experience. Not what I'd call "enhanced" at all.

Look at an analogy from the old phone company days, pre-Internet. Imagine talking on your phone to friends or family about, oh, say a camping trip, and then having an operator break into your conversation to sell you tents and sleeping bags. Not only would it annoy the hell out of you, you certainly wouldn't like the idea of always having an operator listening in on you during every phone call.

This is going to be a situation where my Congressman and Senators and various FCC functionaries get letters from me.This crosses the line.

Re:Arguing your analogy

[stewbacca]

You can choose not to use Google. You know up front, before you use their site, what Google does. I would argue differently. Most people think Google is a search engine and have no idea that their primary function is ad-based revenue production. Also, I don't use Google, yet they seem to have no problem inundating my web experience with ads. What I guess I'm saying is, I understand (but most people don't) they are an ad agency but I don't understand HOW their technology works since I chose not to use it, yet still get targeted.

"Customer Care" Response

[the JoshMeister]

I went to Charter's contact page and selected the option to chat live with a Customer Care Representative:

You have been connected to TTD Jomar .
Me: I just read an article stating that Charter has begun sending letters to its customers informing them that, in the name of an "enhanced user experience," it will begin spying on their traffic and inserting targeted ads. Is there any truth to this?
TTD Jomar : Thank you for contacting Charter High Speed Internet Technical Support. My name is Jomar. How may I assist you today?
TTD Jomar : I'm so sorry, but this is already beyond our scope of support. Please call 1-888-438-2427 for further assistance.
Me: Thank you.
TTD Jomar : Again I apologize for the inconvenience you've experienced, but if there is anything further I can help you with please, let me know.

That kind of response doesn't sound like "Customer Care" to me.

Anyway, I called the number and spoke to someone who didn't have a clue what I was talking about. He transferred me to someone else.

The second phone rep said she hadn't heard about the new "enhanced user experience" feature, so she put me on hold to ask someone else. After she came back on the line, she said that she wasn't able to find out anything about it, so said to go to charter.net to stay informed about new features and services.

Naturally, there doesn't appear to be anything on Charter's site about the new "enhanced user experience."

Re:"Customer Care" Response

[trickno]

Being a former Charter subscriber, I assure you that you will not find another 'technology' company that lacks even the basic customer service tools available to its end users. I want to transfer an account? No, you can't do that over the internet... OR over the phone. You need to drive to our location (albeit 2 hours away) and SIGN A PIECE OF PAPER. What???

Beyond that, customer service redirecting you back to there website does a lot of good. I would have found gouging out my eyes with a blunt object more fun and entertaining. At least then I came blame that on my own stupidity. Charters website however... rediculous.

Re:"Customer Care" Response

[thedbtree]

http://connect.charter.com/landing/op1.html

Re:"Customer Care" Response

[Boogaroo]

http://connect.charter.com/landing/op1.html

Can I choose to opt out of this enhanced service?
Yes. As our valued customer, we want you to be in complete control of your online experience. If you wish to opt out of the enhanced service we are offering, you may do so at any time by visiting www.charter.com/onlineprivacy and following our easy to use opt-out feature. To opt out, it is necessary to install a standard opt-out cookie on your computer. If you delete the opt-out cookie, or if you change computers or web browsers, you will need to opt out again.

Nice! The link mentioned in the Opt-Out section isn't even a link, you have to copy/paste it!
They've done every little stinking petty thing to make this just a little bit harder for people to opt out of it.

And, it's a cookie! You use Firefox and opt out, ok(assuming you even keep cookies!). Your roommate/spouse/family uses another browser? Guess what, they have to opt out too. And if you regularly clean out cookies, you need to go back and re-opt out.

No way to opt out at the subscriber level. Geez.

Re:"Customer Care" Response

[mmascari]

http://www.charter.com/onlineadvertising
Includes the URL to opt out (not as a link though), which is a cookie for connect.charter.com

But, I can't think of how a cookie can actually create an opt out of this. And it's a huge inconvenience to require a cookie.

Really wish FiOS would come out this far.

This marks the end of what was the Internet

[a4r6]

When ISPs can actually MODIFY data that does not belong to them, a SERIOUS boundary has been broken.
It's like the telephone company talking in place of someone on the phone.

"Hey mom" "Hi Mike, how are you?"
becomes:
"Hey mom" "HI MIKE, GET VIAGRA NOW FOR $3.99/20mg!"

Easy fix to this solution

[thorkyl]

2 actually,
1. Mail them a letter and tel them no, I do not agree with your data sniffing

2.
HOSTS file...
find the charter server(s) info point to 127.0.0.1 or other ip of your choice...

then have a script that files and electronic version of a small claims suit
on the IP address. Each ad replacement would be its own cause of action.

then surf away...

spammer.charter.net
got.screwed.by.charter.net

and so on...

A threat to every publisher who uses AdSense, etc.

[GeorgeK]

I'm astonished. How is this any different from the postal service ripping out all the magazine ads and replacing them with their own ads before they get delivered to your house?

With the "deep packet inspection" technologies, conceivably ISPs can just replace, in real-time, our Google AdSense pubisher IDs with their own. Or, they could simply replace the Google AdSense Javascript snippet with something else.

I would hope that Google and other large advertising networks lead the charge against this, and that they are not partnered with any ISPs involved in this activity. A large class action lawsuit on behalf of publishers might slap sense into any ISPs using this "enhancement" to steal revenues from legitimate publishers.

Why no SSL on (for example) google.com?

[jep305]

I've often wished that Google would let me use SSL to access their services. Looks like this might provide them some motivation to do so. JP

Re:Why no SSL on (for example) google.com?

[Haeleth]

SSL costs CPU time (that's part of why it's secure). When you have a busy site like Google, that CPU time costs money. They won't implement encryption until the Spy-SPs hurt their bottom line enough to make it worth their while.

(And even then, there may be cheaper solutions to this particular problem, such as signing pages instead of encrypting the whole lot.)

Re:Why no SSL on (for example) google.com?

[WuphonsReach]

And even then, there may be cheaper solutions to this particular problem, such as signing pages instead of encrypting the whole lot.

I suspect, that while signing might work for static pages where the signing values can be cached - you won't gain any CPU time from merely signing instead of both signing and encrypting.

(That's a guess... my crypto books are buried in boxes at the moment.)

Re:Why no SSL on (for example) google.com?

[Burz]

When you have a busy site like Google, that CPU time costs money. By far most of the effort expended in https is setting up the link with PKI asymmetric keys. If browsers (or browser add-ins like Google's) cached the temp. symmetric key for a long while, then demand on the CPU drops to a small fraction of a frequently-renegotiated https link.

We could have the browser hold onto the temporary keys and drop them only after NIC status has changed (say, switched from Ethernet port to Wifi or disconnect-reconnect) or 8 hours has elapsed since the key was forged. That should make the https overhead very low while keeping links secure.

It would be interesting to find out the extent to which web browsers already do this...

Re:Why no SSL on (for example) google.com?

[SanityInAnarchy]

Question: How much more CPU time will this require than Google currently uses to search the entire fucking Internet?

I bookmark https://mail.google.com/, for when I'm forced to use Gmail. I've got no sympathy for the extra CPU and money they have to spend to prevent people from intercepting my session.

Adverts?

[flyingfsck]

What adverts? I don't see no adverts. Do I need to install Windows to get the full user experience?

Re:Adverts?

[Osurak]

What adverts? I don't see no adverts. Do I need to install Windows to get the full user experience?
If you know what you're doing (ie. Ad/Script/FlashBlock + FireFox) you probably won't see the ads anyway...but the problem is that the ISP is either replacing the advertising content served by the remote site with their own advertising, or just serving you ads on top of the ads that are already on the website.

The real party that gets screwed here is the advertiser...depending on how they set things up, they may see a hit on their ads that end up getting chopped out by the ISP and never actually displayed to an end user.

I can picture something like this getting challenged in court pretty fast by the actual advertisers, but I'm not so sure about what would happen if they just send additional ads down the pipe along with your requests. That would probably take a class-action suit led by users (EFF, ho!)

I'd like to think that for $50/month *minimum* they wouldn't need to resort to this type of bullshit to generate a profit.

Also, God forbid they simultaneously switch to some sort of metered bandwidth plan and ALSO start wasting said bandwidth with extra ads. That would be enough to motivate any nerd to drive down to the local ISP office and start shooting people.

Re:Adverts?

[brunascle]

i think it would be the website owners, not the advertisers, that have issue with this. the advertisers know how many hits they get from a given website, and they pay the website accordingly (on a contract basis, not a $$-per-view basis). if the advertisers get fewer hits, the contracts get smaller, and the website gets less money.

HTTPS Everything.

[alextheseal]

So the end game is this. If I as a web site operator don't want anyone stealing my ad-revenue, or messing with my content all I do it add an SSL cert to my web page for $20-100 per year and a little more server meat and boom, $500K for that neat DPI box they just bought has an ROI of 0%. Let them try to decrypt 80GPS in realtime for $500K.

Re:HTTPS Everything.

[spazdor]

But every other website operator will have to do the same.

Charter's blown $500K, and VeriSign makes....

OH MY GOD I THINK I CRACKED THE CONSPIRACY_

My Conversation with Charter

[tedivm]

A representative will be with you shortly. You have been connected to TTM Mike .

TTM Mike : Hi this is Mike from Charter. How may I help you today?

Robert Hafner: I read an article online, and the followed it to the Charter webpage, which states that Charter is going to be monitoring my surfing habits and placing ads into pages I'm viewing. I am wondering how soon this will happen to me personally.
Robert Hafner: http://connect.charter.com/landing/op1.html

TTM Mike : I do apologize but let me transfer you over toour internet support line.
TTM Mike has left the session.

Please wait while we find an agent from the CHAT - DUMA - HSD Support department to assist you.

You have been connected to TTD Grah .

TTD Grah : Hi, this is Grah. Thank you for contacting Charter's High Speed Internet support. How may I be of assistance to you today?

Robert Hafner: I read an article online, and the followed it to the Charter webpage, which states that Charter is going to be monitoring my surfing habits and placing ads into pages I'm viewing. I am wondering how soon this will happen to me personally.

TTD Grah : One moment please.

Robert Hafner: http://connect.charter.com/landing/op1.html Contains the information
Robert Hafner: that I am basing this question off of.
Robert Hafner: As well as http://consumerist.com/5008801/charter-to-begin-tracking-users-searches-and-inserting-targeted-ads

TTD Grah : Yes, that is our new update.
TTD Grah : One moment please as I download the document.
TTD Grah : Charter has formed a partnership with an industry-leader in online advertising, NebuAd (www.nebuad.com). NebuAd, through their advertising network, will display targeted advertisements to Charter High-Speed® Internet customers while they are surfing the Web. NebuAd does not collect and use personally identifiable information to deliver advertising. Customers will not see more ads - just ads that are more relevant to their interests that have been expressed through their web-surfing activity.
TTD Grah : The feature will be activated automatically for Charter HSI customers beginning in June 2008 in the following four Charter markets:
Newtown, Connecticut
Fort Worth, Texas
San Luis Obispo, California
Oxford, Massachusetts

Robert Hafner: So the ads are placed directly into websites I would normally view?
Robert Hafner: How do I opt-out for an entire household, with multiple computers and browsers?
Robert Hafner: Currently the only way to opt-out is by placing a cookie under each browser of each account of each computer, which is absolutely insane.

TTD Grah : The technology can actually often distinguish between different users on a shared computer and, therefore, can serve different ads to different users. Only a portion of the ads you see will be a function of the enhanced service - you will still see some ads that are served based on other criteria.

Robert Hafner: The question was were are those ads being placed- are they replacing other ads on websites, for instance?
Robert Hafner: And if so, how is the owner of the actual website going to be compensated?

TTD Grah : This site may appear depending on what are you trying to view online.
TTD Grah : This site will give you options on what to have according to what you need.

Robert Hafner: What site are you referring to?

TTD Grah : Say for example, you are surfing because you wish to purchase shoes online, this site will pop up and give you options to chose from.
TTD Grah : That is how it works.
TTD Grah : That is how it works.
TTD Grah : The site will not pop up everytime you go online.

Robert Hafner: So this only affects my traffic to

Re:My Conversation with Charter

[azzuth]

TTD Grah : Say for example, you are surfing because you wish to purchase shoes online, this site will pop up and give you options to chose from.
TTD Grah : That is how it works.
TTD Grah : That is how it works.
TTD Grah : The site will not pop up everytime you go online. I'm not even sure that makes any sense. Charter sounds like they never even told their employees what the new system was about and this guys is just making it up/quickly skiming some brochure while hes chatting. Thankfully Charter is not available where I live, however I'll bet ya this will be standard operating procedure here soon..

Re:My Conversation with Charter

[Anonymous Coward]

This may be the last ditch resort of a failing company. Reports on Charter Communication (CHTR) stock, at $1.20 per share (approaching the Penny Stock range), show a minus $4.39 earnings per share. Desperate companies do desperate things.

Re:My Conversation with Charter

[mysidia]

I think that conversation was either with a bot, or someone with a little "chat console" where they push a button to choose which canned message to send.

The text is just looks like I would expect a templated conversation to look.

Re:My Conversation with Charter

[Trick414]

I'll give you all my little story of how my interaction went with Charter. I live in Fort Worth, TX, USA and got my letter today. As some poster noted above it was signed by "Joe Stackhouse, Senior Vice President, Customer Operations".

So, I decided to see if I could get an email or physical address for Mr. Stackhouse.

Mind you, this was about 1900 hours CST, so I wasn't expecting a whole lot.

Further, I'll be honest here. I really sunk low on this one. My ethics and morals were screaming at me. My primary goal was to simply tie up a bunch of support people for as long as possibe, or until I got tired, to negate any possible benefit that Charter will get out of this. Not company wide, of course, just per capita if that makes sense.

I started with the online support. I asked for the email or phone number of Joe Stackhouse. They simply replied that they didn't have that information and to contact the generic 888-Get-Charter. Thanks and good bye.

I called the generic number and tied up a few people that sorta tried to help me. Now, try to take my next statement in context. I wasn't an over the top jerk, but I launched into anybody I talked to instead of behaving in an extremely respectful manner. Don't get me wrong, I didn't try to be personally degrading, just that I had a chip on my shoulder going into it (in character so to speak). In fact, I told a few reps my exact intentions were to negate any possible benefit that Charter would realize by engaging in such a business venture.

Before anyone beats me up too badly, I realize that the ultimate cost is going to be passed onto the consumer. But, I feel pretty strongly about this one. I'm willing to not only pay my fair share, but to also quit the company. I am going to talk to someone somewhat important at some point, and I will drop Charter. Fortunately, I've already been looking around. There are now several options in my area (unlike when I moved in to my house in 2000), so I have some bluffing ability.

In any case, I ended up arguing with "J.T." from St. Louis. I'm a bit skeptical he was from St. Louis, though. He sounded like he might have been from a few hundred (thousand) miles east of St. Louis...

J.T. and I went round and round for about 30 minutes. He would not give me Mr. Stackhouse's physical address. He did tell me he thought he was in Denver. Again, we went round and round and I won't bore you with the details, but J.T. did compare Mr. Stackhouse with a "star" and said he couldn't possibly respond to millions of fans. J.T. and I then had a conversation about "stars" versus companies with investors and customers, but I don't think he made the connection.

There were many little parts to our conversation that could be talked about in detail, but I figure it doesn't really matter. Charter is losing a long-time customer that pays about $160 per month for their various services. It is not the end of the world for them, but it is where I make my stand.

You can opt out...

[TheMonkeyhouse]

According to the letter I got you can opt out. The FAQ is here http://connect.charter.com/landing/op1.html

It *seems* to be well dodgy nevertheless. I am still waiting for FiOS then i am gone...

Re:You can opt out...

[TheMonkeyhouse]

more info...

i just opted out and it is a load of crap! Got to www.charter.com/onlineprivacy to opt out BUT all it does is place a cookie on the machine so you have to do it for all machines for all browsers for all OS - bunch of BS if you ask me.

if is it a per user/browser/os/machine configuration - what other information are they gathering and using to change the ads on the pages? and obviously they are querying this information on the machine before they modify and feed the page - this has got to impact load times!

Re:You can opt out...

[Knara]

One wonders how easy it would be to make an FF plugin to just replicate the cookie content.

Re:You can opt out...

[sigterm9]

One wonders how easy it would be to make an FF plugin to just replicate the cookie content.

I'm betting that will be available by sundown of the first day it goes live.

Re:You can opt out...

[QuantumRiff]

I looked at the opt out page, but I am not giving them my information on a non-SSL page. Also, The first rule people learn about web browsing is to regularly delete your cookies. (I have lots of friends that set firefox to do this everytime they close the browser). So then you have to give them all your information every time you re-open your browser.

Re:You can opt out...

[mysidia]

The issue I have with this whole opt-out thing -- they set a cookie. This suggests the "opt-out" isn't really a full opt-out. Maybe it's just an opt-out of the user-visible elements of this service, and some invisibile injection and inspection via say a "transparent", caching HTTP proxy is still being done.

If they are using DPI, and opt-out is only a cookie, this implies the deep packet inspection and/or some type of injection will still have to occur sometimes even for users that have opted out!

They have to have some way of detecting that the opt-out cookie is there -- and they can't detect it without inspecting the HTTP traffic to see the cookie being sent. Also, the traffic has to be to a domain in the cookie's allowed list, for the cookie to be automatically sent with HTTP protocol messages (google.com can't see your charter.net opt-out cookie...).

To be able to see whether the cookie is set or not, I am concerned they will have your browser loading some image or file from a domain associated with their domain by injecting javascript or a hidden img into pages that have advertising.

I'm concerned "opt-out" may just mean the injected javascript/CSS during page load will check for the presence of opt-out cookie, and if not present, proceed with replacing the advertising, otherwise pretend not to be there (but naturally still have artifacts if you use 'view page source').

Re:Goodbye Maggie

[budcub]

Stephen King died again?! He just keeps dying and coming back to life and dying and coming back to life...

Well he is Stephen King after all.

Re:Goodbye Maggie

[Drgnkght]

1 in 133,225?

Re:*ahem*

[geminidomino]

Just came here to say: Charter is from the debil.

That is all.

=Smidge=

When asked for comment, Old Scratch replied "Screw you, Smidge! Don't go trying to pin this one on me! I have SOME scruples!"

Three answers...

[argent]

(1) I don't enter that kind of data over an unencrypted link.
(2a) Google tracks my online activity when I'm not using Google's servers?
(2b) Charter pays the site that's getting their "deep inspection" ads inserted?

Re:Three answers...

[stewbacca]

(1) I don't enter that kind of data over an unencrypted link. So you've never given your name and address over the telephone, or while standing in line at the bank?

Re:Three answers...

[argent]

Until Google Streets View adds real time audio pickups, I'm not going to worry about some transproxy snooping what I say in a public place.

Eventually we'll be in a transparent society, with smart pebbles and smart dust and confetti-scale spybots making it necessary to use direct neural links to keep personal information private, but we're not there yet.

SSL and HTTPS

[BlueParrot]

Time to start using it... Even if you just sign your own certificates, thus making the whole thing completely vulnerable to man in the middle attacks, these ISPs would be guilty of rather serious violations of cybercrime laws if they started sending your clients fake SSL certificates. I.e, if you just want to prevent the ISP from doing this you don't even need a secure session, you just need one they can't interfere with without incriminating themselves.

Re:SSL and HTTPS

[spazdor]

US Criminal Code TITLE 18 > PART I > CHAPTER 47 > Â 1030 (a)2(C):

(a) Whoeverâ"

(2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtainsâ"

(C) information from any protected computer if the conduct involved an interstate or foreign communication;

---
shall be punished as provided in subsection (c) of this section.

IANALbutAFAIK, this is the law prohibiting civilians from intercepting and cracking each other's crypto. I think the argument is that cryptography is a clear indication of what kinds of access the user didn't intend to authorize.

This is what they are going to argue.

[Irish_Samurai]

Well, they don't have your HTML. They have a copy of your HTML.

Your original HTML is still residing on the server where you put it. They are not interfering with your data.

What they are doing is interfering with their subscribers requested copy of that data. Their subscriber has the right to render the requested HTML in any way they see fit. They can use a different CSS file that resides on their box or some other network location. They can choose not to render graphics, flash, or allow JavaScript to run.

The provider, being in contract with the subscriber, is allowed to act as their agent while the packets are being transmitted over their part of the network. During this time, the ISP exercises that contracted ability, and injects code into the packets.

The ISP will tell the subscribers that this right is part of the contract, and if they don't agree to it - they don't get service. The ISP will also tell you to shove it up your ass - you can refuse requests made from their subscribers if you don't like what they do on their network.

According to your stance, the end user doesn't have the right to modify your HTML from what was intended. This, ironically, is the same exact stance that internet marketing companies take when confronted with browser plug-ins that effectively remove their code. Unfortunately for us, we can't have it both ways. Either we are allowed to alter how the packets are rendered, allowing us them to inject into packets due to powers granted them by their user terms and conditions, or they cannot - setting a precedent that would open the floodgates to client side packet altering and rendering changes.

Another point of argument they are going to make is that they aren't messing with your copyrighted web pages because they aren't distributing it without permission. When a user makes a request for your page, and your server fulfills that request, you have distributed the materials yourself. They are merely making a "derivative work" from that material.

I'm not saying I'm down with this at all. Frankly its a scummy tact and I hope their business dies. But this is what they are going to argue, we should get ready for it.

Re:This is what they are going to argue.

[Overzeetop]

Didn't the Colorado(?) company that rented "clean" versions of Hollywood movies lose in court? I can't remember the details, but they bought the DVDs then clipped out the naugty bits and rented them as "family friendly"

Re:This is what they are going to argue.

[Irish_Samurai]

That's where the kicker is.

Those guys took copyrighted materials, changed them, and then redistributed them. Here there is no redistribution. The ISP is acting as an agent of the user, a right granted to them in their terms and conditions, while the packets are on the ISP's network.

The ISP is going to argue that there is no material difference between rendering changes made on the requesting clients system and the requesting clients ISP network. They want to push the issue that they can extend an end users reach out to the ISP's network - and the ISP will grant them that right. In exchange, the user grants the ISP to act as an agent of the end user while packets are on that network.

In reality its a one way deal. How an end user would ever actually affect packets on their ISP's network without the ISP acting as their agent is beyond me.

Re:This is what they are going to argue.

[grahamsaa]

"Well, they don't have your HTML. They have a copy of your HTML. Your original HTML is still residing on the server where you put it. They are not interfering with your data. What they are doing is interfering with their subscribers requested copy of that data. Their subscriber has the right to render the requested HTML in any way they see fit. They can use a different CSS file that resides on their box or some other network location. They can choose not to render graphics, flash, or allow JavaScript to run." By that reasoning a bookstore could rewrite portions of my book and sell it without my consent. This line of argument seems badly flawed.

Re:This is what they are going to argue.

[shadowturtle]

Let's add in a little bit more. What happens if the subscriber's terms with the company that hosts the copyrighted data limits them in how they can use or transform the data they receive? By using a particular ISP that modifies packets the end user is essentially breaking their terms with the company they are requesting data from.

Re:This is what they are going to argue.

[Irish_Samurai]

No.

Fair use allows someone to alter their copy to their liking. The copyright gets infringed upon at the point of distribution. The bookstore would be redistributing.

Re:This is what they are going to argue.

[Anonymous Coward]

According to your stance, the end user doesn't have the right to modify your HTML from what was intended. Sure they do. End users are protected by the fact that they are modifying the HTML for personal, non-commercial use. In other words: fair use protects the end user's right to do what they want to the HTML that reaches their machine, as long as they don't modify it for commercial use and don't redistribute the modified work without authorization.

This, ironically, is the same exact stance that internet marketing companies take when confronted with browser plug-ins that effectively remove their code. Unfortunately for us, we can't have it both ways. Either we are allowed to alter how the packets are rendered, allowing us them to inject into packets due to powers granted them by their user terms and conditions, or they cannot - setting a precedent that would open the floodgates to client side packet altering and rendering changes. Again, the end user is protected by fair use. The ISP is not. The ISP is in flagrant violation; they are modifying the work and then redistributing that modified work, and they are doing it for commercial purposes.

Another point of argument they are going to make is that they aren't messing with your copyrighted web pages because they aren't distributing it without permission. When a user makes a request for your page, and your server fulfills that request, you have distributed the materials yourself. They are merely making a "derivative work" from that material. Sure, they have permission to distribute it as the server hands it to them. But they don't have permission to make an unauthorized derivative work from it and make a profit off it. The fact that they make the modifications without informing the end user on the page with a big "this page has been modified by Scummy ISP, Inc" makes it that much more willful and evil, and likely increases damages should anyone actually take this to court.

IANAL, I am not a copyright expert, etc.

Re:This is what they are going to argue.

[Irish_Samurai]

You're completely ignoring the fact that the ISP is going to argue they are acting as an agent of the end user through powers allowed them in their services agreement.

The fact that they make the modifications without informing the end user on the page with a big "this page has been modified by Scummy ISP, Inc" makes it that much more willful and evil, and likely increases damages should anyone actually take this to court. You can't just make up how things work. If the user and the ISP enter into a contract for goods and services, the user doesn't have to be informed on every page. Just because you don't like it doesn't make it illegal. The user was informed in the contract. Also, the ISP sent notice to all the users that they were going to do this.

You are not understanding whats going on at all.

Re:This is what they are going to argue.

[BSAtHome]

Another point of argument they are going to make is that they aren't messing with your copyrighted web pages because they aren't distributing it without permission. When a user makes a request for your page, and your server fulfills that request, you have distributed the materials yourself. They are merely making a "derivative work" from that material.

But this is exactly their downfall. The "They are merely making a "derivative work" from that material." is something that is explicitly not allowed unless written consent is provided from the copyright owner. The thing is that they are redistributing a derivative without permission. The stream of data is consented from originator (me) to the recipient (the enduser). Even though the ISP could be interpreted as "agent", they are not allowed to make derivative works. The ISP provides a transit service which is not considered a derivative (proxies are transit performance implementations or transformations on the transit channel; proxies are generally not supposed to be transformations on the data).

Worse, if an ISP would be allowed to do this kind of rape to my data, what could possibly stop them from using the data in any other way and taking things out of context? Imagine that I have an article written in one way, where the ISP-side modifications would pull the article in another way? Subtle changes, even an advertisement, can change the meaning of an entire page.

Apart from the copyright issues, there are numerous other problems with such a system. Next time you visit http://www.gnu.org/ you will get a nice frame of Microsoft ads about "Get The Facts"?... Or what about the abusive tracking possibility of such a system? Imagine that ads are inserted based on content. That basically means that any mean bastard can track you. The government then indirectly can attach an ad on any content containing the word "xyz"... Nice to know that you are seeking that carbomb info and other details.

Re:This is what they are going to argue.

[Irish_Samurai]

If they were acting as an agent of the end user, and the end user wanted to put ads on any HTML they rendered on their client (absurd, I know), the end user would be making derivative works on their client. The ISP is trying to argue that since they are acting as an agent of the end user, they are removing the need for the client application to insert the code. They are going to put forth that there is no material difference between rendering on the client and rendering slightly upstream as an agent of the client.

It is a stretch in logic, but it is what they are going to try and argue.

Re:This is what they are going to argue.

[PhxBlue]

Are you actually a lawyer, or are you making this shit up as you're going along?

When I request a page on the Web, I have a right to see it as it was originally presented. I also have a right -- because it's now on my computer -- to choose whether I want to see the advertising that's on the page. The ISP, as an "agent," has no more right to alter the data coming to my computer than my phone company has the right to interject itself into my conversations, and trying to argue otherwise is just horseshit.

Re:This is what they are going to argue.

[Pikoro]

"They are not interfering with your data. What they are doing is interfering with their subscribers requested copy of that data. Their subscriber has the right to render the requested HTML in any way they see fit."

The difference here is that the end user is deciding how the html will be _rendered_, which is not in any way altering the packets themselves. The ISP should not have the right to manipulate the data coming into my browser. When the ISP does that, they are taking the choice out of the user's hands.

To use your book analogy, the bookstore is altering the book and selling it to you without letting you know what changes have been made.

Re:This is what they are going to argue.

[arminw]

....During this time, the ISP exercises that contracted ability, and injects code into the packets...

If a carrier, phone or ISP, inspects the content of conversations or digital data, can they not be held liable for that content? If that content is illegal, such as someone planning a crime or digital data of forbidden porn, can they not be held liable for failing to prevent illegal activity? Traditionally carriers have not looked at or cared what data travelled over their wires and were therefore shielded from such liability.

If ISP now have the ability and use that ability to inspect the information and modify that information, could they then not become responsible for that information and be no longer immune to lawsuits? If that were to happen, ISPs would certainly forgo the inspections of data, rather than face huge lawsuits for taking or not taking action, based on the data flowing through their networks. They could even face criminal prosecution as accessories to crimes which they knew or should have known was happening, because they were inspecting the contents of all data.

If UPS or Fedex started opening all packages, could they then also be held responsible for not reporting illegal merchandise to the proper authorities?

If the messengers are inspecting all messages entrusted to them, and even worse, changing the message, do they then not become responsible for the message also? Messengers ought to never know or care about the contents of the messages they are paid to deliver.

Re:This is what they are going to argue.

[arminw]

...the end user is essentially breaking their terms with the company they are requesting data from....

If I request data from some random website, how can I have an agreement with them? If I listen to the radio, how do I have an agreement with a particular radio station? The internet is just as public as the air waves. Anyone who puts a web server up is no different tan a broadcaster. When I make a request of their server, I am in effect tuning in on their channel and receiving whatever they send.

The ISP interfering with this is like my neighbor setting up a transmitter and sending additional material to my receiver.

Re:This is what they are going to argue.

[shadowturtle]

The Internet isn't just random Websites over http/s. There are many different protocols used to access data and some content you have to pay for, or at least agree to the provider's terms prior to accessing the content.

Re:This is what they are going to argue.

[Irish_Samurai]

Well, that's the crux of it.

To stop this we have to establish that there is a material difference between rendering done on the client and changes made to packets so the rendering will change.

Re:This is what they are going to argue.

[arminw]

...or at least agree to the provider's terms....

Those "agreements" are worth about as much or less than EULAs are. Clicking a mouse does NOT identify who clicked it nor whether such a clicker was of age to enter into any sort of agreement.

Someone can connect to one of the millions open WAPs and click away. There is no way to determine who it really was that did what at any time. All that the IP and MAC addresses do is to identify the COMPUTER, not the person responsible for its operation. Even that computer only identifying information is not available beyond the NAT/router gateway. If that gateway doesn't keep some sort of long term record, even the identity of the computers used is unavailable.

Most subscribers to an ISP get only one dynamically assigned IP address which then is usually shared wireless with a number of individual computers, both known and unknown. In cities, finding such open wireless networks is easy. Some people have inadvertently and unknowingly used their neighbors WAP for extended periods of time, even though they have their own subscription to an ISP. As long as there is no sure way to identify the actual users of the computers, the use of some IP or MAC address will always be ambiguous evidence.

Re:This is what they are going to argue.

[Irish_Samurai]

I'm not making it up. Fair Use is a valid defense for derivative works. There are four elements that need to be looked at in every in cases concerning fair use of copyrighted work.

• the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes;
• the nature of the copyrighted work;
• the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and
• the effect of the use upon the potential market for or value of the copyrighted work.

Obviously, the ISP thinks they can win this battle, but since it hasn't been fought you cannot unilaterally state that you're right. No court has settled on it. Get as pissed off as you want to about it, it doesn't change a thing. I have merely been stating the case the ISP is going to make. You have an opinion, that's about it.

Re:Open-source technological solutions....

[dgatwood]

The https protocol is fundamentally broken because of a serious flaw in the way it was designed. It is impossible to use virtual hosts with separate certs via https. This has pretty significant ramifications in terms of the number of additional IP addresses it would require for everyone to switch to https.

The alternative, of course, would be for the HTTP protocol to be redesigned to either A. allow an unencrypted request containing only the host part to be followed by a switch to an encrypted stream on the fly or B. allow an encrypted request with a generic host key to be followed by a switch to the host key of a specific VHOST on the fly after identifying the host but before making the actual request. Unfortunately, both of these are completely upside down from the way the HTTP protocol works, which sends the most specific request data first, followed by the host data. This is because support for VHOSTS was basically hacked onto the HTTP standard. Poorly.

While such a thing would be nice in theory, in practice, unless we move to IPv6 first, it isn't practical.

Definately Expected.

[klock]

Living in an area around St. Louis, MO wherein charter is the only broadband ISP that carries service in the area, many of my neighbors along with myself are forced into choosing between charter and dial-up services. Charter throttles its traffic at strange times in the day, grinds traffic to a halt at strange times for seemingly no reason, and provides its customers with very vague answers or none at all. This is not the way an ISP should treat the customers. Charter is a monopoly ISP in my area and we all suffer for it. This new information regarding DPI is no suprise to me. Just another lousy thing that I have to deal with now. :(

bye Charter

[sharp3]

I've just called and canceled my Charter subscription today. I'm not even in the effected areas, I just wholly disapprove of my Slashdot addiction being monitored. Plus, I pay 150 bucks a month and don't even get HBO... I hope ATT is more in tune with their customers.

no SSL?

[jep305]

Might be cheaper to hire lawyers. I don't know. But it is probably going to be Google and everyone else whose content is violated by Charter that stops them rather than customers complaining. The hubris of cable companies is legend.

Internet "enhancment" - sigh.

[fahrbot-bot]

From the Charter FAQ:

Charter can display advertisements that are more likely to be related to your interests. You will not see more ads, but some of the ads you see will be more relevant to you. Browsing the web can become more like flipping through your favorite magazine, where you see ads that are appealing to you and enhance your enjoyment and the utility of the experience.

Ya, I don't want to see *any* ads, unless I choose to look for them. I want to surf the Internet "as it is", without any "help" from Charter trying to "enhance my enjoyment".

I understand that vendors want an Internet presence, and many want it done cheaply, meaning Ad supported. But the Internet isn't really about advertising and selling things, it's about Information (which may include the former).

ISPs and Vendors, please stop trying to turn the Net into an interactive version of broadcast TV. If you can't make money without interfering, then go away.

Complain to the ad-supported sites...

[argent]

I don't use Google, yet they seem to have no problem inundating my web experience with ads.

If you don't like the site you visit using Google Ads, tell them that. When they come back and tell you that they're paying for the site with Google Ads, see if that helps clarify the difference between Google Ads and Charter Ads.

Re:Complain to the ad-supported sites...

[stewbacca]

If you don't like the site you visit using Google Ads, tell them that. When they come back and tell you that they're paying for the site with Google Ads, see if that helps clarify the difference between Google Ads and Charter Ads. That's a perfectly valid statement, but I go back to the first point somebody made saying I have the option NOT to use Google. Well, I don't, yet I still get the ads...not really an option.

Re:Complain to the ad-supported sites...

[argent]

I go back to the first point somebody made saying I have the option NOT to use Google.

You have the option to not use sites that serve Google ads. If you care THAT much about them, then that's a choice you can make.

I don't care about Google ads, but I used to boycott sites that sold advertising to X10, and I turned them down as a potential advertiser on my own site, because of their obtrusive popups. I understand that a lot of people did the same thing, and they eventually went out of business. It's a pity, the products themselves were pretty good and pretty good value... they didn't need to turn to the dark side.

When your only broadband service is a single ISP that's a bit harder.

Re:Complain to the ad-supported sites...

[stewbacca]

Google ads don't bother me either, but that's not my point. The point is, that no matter how anti-ad we are or how concerned we are about our privacy, how is it that Google gets a pass on slashdot (no, I'm not new here, but yes, I must be new here), but Charter is "spying" on us.

Re:Complain to the ad-supported sites...

[argent]

The point is, that no matter how anti-ad we are or how concerned we are about our privacy, how is it that Google gets a pass on slashdot

Google doesn't get a pass from me when they don't deserve one. I can't speak for other people, just myself. If these situations were comparable, and Google was doing something similar to what Charter is talking about, I wouldn't defend them.

But they're not, and I've explained why they're not. If you think I missed something, then I would appreciate it if you'd go back and explain my error, but just repeating "Google's getting a pass" doesn't do the job.

Re:Complain to the ad-supported sites...

[spazdor]

But I'm paying for my free net connection with Charter's adver-..
HEY WAIT A SEC.

Pipe

[element-o.p.]

*#$%!#$!!!!

Why can't a major telco just sell a friggin' PIPE?!?!?!

Re:Pipe

[compro01]

because they have to make as much profit as possible, at least for the next quarter. greed is good, dontchaknow?

this could be bad.. or..

[werelord]

There's going to be major problems with this, depending on how its set up.. If they start replacing ads on pages, Google or other Ad-serving companies will definitely sue (as they are subverting their advertising revenue; akin to your local TV station replacing SuperBowl ads with their own). If they are inserting their ads into a page without actually replacing other content (ads or other) they get into content issues; they don't have the right to monetize content that they do not own.. However if they actually become an ad-serving company (other websites to have thier ads served by Charter) this could be viable.. Only due to their large subscriber base.. Privacy issues aside, of course..

Re:Anonymous Coward

[coats]

As a web author, I've sent copyright infringement complaints to the heads of the House and Senate Judiciary committees, the FCC and the Department of Justice, complaining that the practice is felony copyright infringement for which Charter should be prosecuted.

I suggest you do the same.

Not so bad in the long run

[fishdan]

Obviously this is a "bad thing" but I predict "good things" for consumers out of this. Consumers will learn they can avoid extra ads by using https. Content providers will learn they can improve their customer's experience by removing ISP ads by using https. Sites will have to have signed certificates, and users will have to import them. Phishing ends (well of course not because of Cook's Law and the web becomes a much safer place, because no more unencrypted traffic!

And seriously -- we've got the bandwidth -- why not encrypt it all now? Maybe not mobile bandwidth, but ok, we'll live. Maybe this is the draconian kickin the ass we need to get more serious about our own privacy??

Re:Not so bad in the long run

[innerweb]

Here is a prime example of copyrighted material being stolen and then used without the appropriate royalties being paid. This seems to me to be a prime example of copyright violation! The web pages being served in their aggregate form are copyrighted by the users/companies who created the pages. By modifying those web pages from their original form, they have modified a copyrighted work without the express approval of the copyright owner.

If for no other reason, this ought to be an expensive lesson for the companies involved in this. If it is not, then all pages are able to be copied and modified for almost any purpose, including but not limited to modifying someone else's content for your own profit.

Did I miss anything?

InnerWeb

Re:Not so bad in the long run

[Irish_Samurai]

Well, the stance that the ISP is going to take is that they are acting as an agent of the user through rights granted to them in the services agreement. The ISP is exercising those rights when the packets hit their network. They are working under the auspice that since the user has rights to alter how the copyrighted material is rendered, they can transfer those rights to ISP.

The ISP is making a second assumption, and this is the crux of the argument, that there is no material difference between changing how the HTML is rendered on the actual client and having the materials to be rendered changed slightly upstream on the ISP's network. Since the service agreement gives the ISP the ability to act as the end users agent in this matter, they will argue they are offering a service to the end user by pro actively changing packets in a manner allowed them.

The service agreement says something to the effect of "since I am using your service I also state that I would like more commercials." If an end user so chose to, they could literally insert code on their client that would serve them ads in any web page they viewed. This would be within their fair use rights, roughly the same as me choosing to put coupon pamphlets in between pages of a book I bought and am going to read. The ISP is arguing that this fair use right is transfered to them through agreement and they are just exercising this fair use as an agent of the end user.

Its a lot of bullshittery, but they may be able to pull it off under the auspice of fair use.

Re:Not so bad in the long run

[arth1]

HTTPS isn't necessarily safe.

If the ISP requires you to or tricks you into installing something to use their service, they can install their own signing certificates on your machine, and then their transparent proxy can present a bogus certificate to you which your browser will use to communicate with the proxy, where it gets decrypted and then passed on to the real HTTPS server.

This is, incidentally, why browsing with HTTPS on a public computer (including cybercafes, libraries and airport terminals) is not safe, despite people thinking it is. You'll have to inspect the actual certificate manually to see that it's signed by e.g. Charter, and not who should have signed it. And even then, you can't be certain -- what stops someone from adding a plug-in to the browser that will ALWAYS present the visual representation of a SSL certificates as if it was signed by Verisign or Thawte? You need to bring your own browser on a USB drive, and make sure it won't use any system wide certificates. And even then you're not safe...

Re:Not so bad in the long run

[baeksu]

True. I don't really buy the claim that inserting ads in to a page is infringing on any copyrights.

It's not much different from TV broadcasters using overlays of their own logos or ads during a TV show, at least from the perspective of copyright infringement.

Re:Not so bad in the long run

[fishdan]

Outstanding points. Probably your best option is to bring your own OS on a flash drive and go from there.

Re:Not so bad in the long run

[Muad'Dave]

Well, the stance that the ISP is going to take is that they are acting as an agent of the user through rights granted to them in the services agreement.

Except that the copyright holder does not have any sort of agreement with the ISP! The customer can 'want' all the ads in the world - that doesn't make modifying a copyrighted work in flight legal. Suppose an ISP 'accidently' injects code into the download of an application that 'phones home'. Still legal?

Re:Not so bad in the long run

[Irish_Samurai]

You aren't understanding the argument.

I can render any amount of ads I want to on your web pages if I insert them at the point of rendering on my browser. Nothing you can do about it. If you can run scripts on your browser that remove code, you can run scripts on your browser that inject it. Altering under fair use goes both ways.

The ISP is setting a contractual agreement with their subscribers that states the subscribers would like to render more ads on the web pages they view. They are also entering a contractual agreement stating that they are willing to allow the ISP to act as their agent for this purpose. Now, if the ISP developed a browser plug in that did this there would be no debate. If I choose to install a plug in on my browser that feeds me contextual ads based on the pages I choose to visit, I can do so. Its well within my fair use rights. The ISP is taking an interesting logical leap with this.

The ISP is turning around and arguing that there is no material difference between changing the rendering of your webpage on the users client and altering the packet while in transit on their network. They are attempting to state that they are allowing the users fair rights actions to be implemented on their network and that in exchange the ISP is enabled to act as an agent to further those goals. The ISP is stating that their subscribers have effectively declared they want to render ads on the web pages they visit through clauses in the services agreement.

The ISP isn't saying that they are allowed to inject anything they want to on your web pages. They are saying that their clients want to have ads fed to them and they are undertaking the responsibility of doing so through contractual outsourcing. All of this is legal if they can establish there is no material difference between content changes made at the time of rendering and content changes made slightly upstream on their network.

This isn't an argument based on copyright. If you take that stance, then all those noscript and adblock plugins violate copyright also. Its an argument on where fair use rights actually begin to apply concerning materials distributed over HTTP. Packet or rendering? And if its packet, where in the transaction does the content provider lose control? This has HUGE implications.

I say rendering, but then its just an issue of having ISP's say you need to run this browser plugin for service.

Re:Not so bad in the long run

[innerweb]

The real comparison is to a newspaper or magazine that is delivered and the post office having the rights to modify it on the fly.

The content publisher has designed a *page* (think magazine or newspaper) that may have dynamic content or not. The crux of the issue is that the publisher has designed this page to provide a certain look and feel with specific content. This is their publication. The delivery agent (like the US post office) has no rights to modify the contents of the page (package). The end user might want to have it changed, but that does not mean the delivery agent can do that. That would be akin to the US Post Office having an opt out policy where they open the mail (packets) and add pages to publications advertising products based on the publications.

As far as the comparison to "If you take that stance, then all those noscript and adblock plugins violate copyright also", this is the same as clipping the publication. To my understanding, perfectly legal under fair use. The product has been delivered and the recipient (and nobody else) has decided what to do with the package. They may have received a hint from the neighborhood watch group about what content might be unsafe, but it is their decision and their action in the end (not an opt-out policy) that determines this.

I would love to see the WSJ or the NYT get a bite in this. Or maybe, Amazon. One of the big players who is probably going to have the muscle and the will power to take them on.

InnerWeb

Re:Not so bad in the long run

[Irish_Samurai]

But if the papers subscriber gets it and then puts stickers for Jolt cola over all of the other ads that is well within their rights.

The ISP isn't arguing that they can do this as rights granted to them as an ISP or a carrier, they are going to argue that they are merely an extension of the end users fair rights.

This has never been argued before. There are little examples of this happening.

Bookstores put bookmarks advertising their store or a special they are running into every book they sell at the time of purchase.

On demand movies adding an ad for a different movie or special before the movie plays.

Theaters selling advertising space and time on the screen before the movie shows.

One of the biggest hurdles we are having right now is that there is no definition of where fair use begins and ends as far as digital delivery goes. This is one of those cases that helps solidify that.

Re:Not so bad in the long run

[Muad'Dave]

I think innerweb is on the right track.

In my mind it's really simple: There are at most 3 entities here; the content provider, the delivery service, and the consumer.

The content provider can insert as may ads as they like before they hand it off to the delivery service (limited by their agreements with any upstream content providers such as movie studios, etc).

The delivery service, IMHO, cannot modify the content in any way lest it be considered either a copyright violation or a violation of the agreement between the consumer and the delivery service. The consumer, once in possession of the content, may exercise their fair use rights as they (and only they) see fit.

As to your examples:

Bookstore = content provider, and there's no delivery service. They do not modify the original work, they bundle ads at the point of delivery to the consumer (more on this later). They do not attempt to sew new pages into the center of the book or try to make their ads look like it's part of the book.

On-demand movies: Once again it's the content provider that's doing it, so it's legit

Theaters: Content provider, once again.

Examples of delivery agents running amok:

The phone company whispering ads while you're talking on the phone.
The Post Office stuffing ads in your private mail.
The ISP modifying content in flight from a website.

More about bundling. The only way I see the ISPs can get away with this is by bundling the ad content after the point of delivery to the consumer. This means that they'd need to use a special browser that gets the ads from an independent source (not in the stream from the content provider), and show them together. Yes, that means the consumer must use a special browser if they want to be pelted with ads.

Everyone's happy: the content providers are not having their copyrights violated, the consumer is assured of getting pure content, and those that OPT IN can get hammered by the ISPs ads all they want.

Re:Not so bad in the long run

[Irish_Samurai]

Well, that all works as long as we ignore the fact that I can inject stuff into the payload without actually altering your code, hence the reference to the bookstores. They are not a content provider, they are the delivery service. Movies also. Last time I checked LaFonte theaters was not Warner Bros. Finally, On Demand Movies, Comcast isn't Stars who isn't the producers of Clash of the Titans.

All of these examples were the distributor, not the content provider.

Re:Not so bad in the long run

[Muad'Dave]

I disagree that you can "...inject stuff into the payload without actually altering your code." My contention is that the response from the content provider must not be altered from initial SYN to final FIN-ack/ACK.

I agree that theaters are not content providers - as a delivery agent they show stuff before the movie, but do not alter the movie itself. I get exactly what the content provider intended; no ads in the corner, no commercial breaks, etc during the movie. Books are the same deal - the book is not modified at all, but content is added 'around' it. That's not the same thing as altering the content.

Re:I don't trust The Consumerist

[coats]

I'm rather more trustful of http://arstechnica.com/news.ars/post/20080513-charter-enhances-internet-service-with-targeted-ads.html/ Ars Technica's coverage...

Re:Open-source technological solutions....

[compro01]

3. Ignore the not-insignificant additional load added by HTTPS.

HTTPS is an option, but not a very good one for this problem. something more efficient is needed, though i have no idea what.

Re:Open-source technological solutions....

[ACMENEWSLLC]

So create an RFC with the goal to provide multiple site protection from one Certificate.

They are computers. They do what we tell them to. We now have wildcard certs for things like *.yahoo.com.

How about a certificate which handles the company providing the HTTP server? One certificate which installs onto the server and delivers certificates for the specified hosts.

And don't tell me this is not possible -- read the first sentence.. I'm saying make it possible..

Re:Open-source technological solutions....

[Skapare]

This means shared web sites can't make the switch to HTTPS just yet. However, those web sites that own a specific IP address can do it. The more that at least begin to use or allow HTTPS, the better.

Right now if you visit Slashdot's HTTPS URL it redirects you back to clear HTTP. That's where we need to start changing things. Someone who specifically wants their web requests in HTTPS where it can be delivered, should get it.

At least my page delivers in HTTPS, even if it is just a self-signed certificate that causes the browser to ask if you want to do this. I need to get a real signed certificate soon.

Re:Goodbye Maggie

[Deagol]

Stephen King is obviously the last unknown cylon.

Does Charter charge the submitter?

[Fear the Clam]

Because if they do, the only acceptable answer to this "opt out" bullshit is along the lines of "fuck yourself with both fists." If I pay an ISP and they start slipping ads into my data, they'll get dropped like a hot rock and there will be a flaming bag of shit on the local branch's doorstep the next morning.

If they're free, well, you get what you pay for.

CenturyTel is doing the same thing.

[Stedly]

Yeah, just got the memo too. Im not too happy about it either, wonder if there is a possible way to make this more automative. Any coders have any ideas? http://www.nebuad.com/privacy/optout.php Is the place to download the cookie for all ISPs that are now usign NebuAD.

Re:CenturyTel is doing the same thing.

[Skapare]

I know that even a lot of geeks don't have this ability (yet). But if you have a dedicated server, or even a remote shell account with significant bandwidth rights, you can pipe all your web surfing that way (so it doesn't become web "serfing"). The OpenSSH client has a -D option, or DynamicForward in the config file, which tells it to listen locally on a port and use the SOCKS protocol with whatever connects to make a connection through the SSH session that will come out from that server. Then just configure your browser to use that SSH forwarded port as a local proxy, and SOCKS as the proxy protocol. The server hosting company could spy on you, now, but not your cable/telco provider. There are some cheap virtual dedicated server hosting (as in, your server is a virtual machine under VMware, Xen, or such) plans many companies offer that may be good enough. You may be able to use almost any shell account access that has SSH access (who doesn't anymore) and sufficient bandwidth for your web ser^H^Hurfing.

BTW, if you set up a dedicated server for this purpose, I suggest starting a 2nd SSH server on port 993 or 995 and use that one for forwarded web access. That way it will just look like you are reading email (a lot of it).

Re:CenturyTel is doing the same thing.

[Stedly]

Ive actually considered this as one of the options. But paying for a remote dedicated shell may not be economically feasible for just web browsing.

Re:Open-source technological solutions....

[Kjella]

Honestly, how damn hard can it be. Wrap the whole thing in something that'll send the desired host, STARTTLS and negotiate the SSL connection, then send the HTTP request once the SSL layer is established? This sounds like s SoC project to do on apache, firefox and konqueror and hopefully the rest would follow.

Some things for Charter to think about

[Todd Knarr]

• What about services like Windows Update? As complex as the pages need to be, I can see any messing with them easily breaking them.
• What about things that use HTTP as a transport but the client isn't a Web browser? It can't opt-out since it doesn't do cookies, and messing with what it expects can cause major breakage.
• How does Charter think copyright's going to play into this? I own the copyright on my Web pages. If Charter modifies them before presenting them to a browser, they've just created and distributed an unauthorized derivative work. I'm pretty sure I can present a court with a long list of rulings supporting that. And what happens if the RIAA get their three-strikes law or worse? It'd be fun to see Charter's Internet connection cut off... :)

Charter also messing with DNS.

[Gideon Fubar]

Saw this yesterday on hackaday. Looks like they're making a lot of friends.

Re:Charter also messing with DNS.

[Skapare]

I can understand their thinking that this enhances the user experience. Browsers alone have typically provided a poor description of problems when there is a DNS lookup failure. It's adequate, and quite technically correct, for us geeks. But for the masses, it does leave them confused. For similar reasons, mail servers send back elaborate bounce messages for non-deliverable email, rather than just give a standard SMTP rejection code with a text string (which then leads to so much backscatter). The fix for the mail server is for the sender's server that gets the SMTP rejection to be more descriptive in a dumbed-down way for the average user (while still including the exact string received, and the DNS lookup chain to get there, for us geeks). The fix for web site access failures is for the browser, or the proxy server in the case of access through a proxy that you (or your admin at work) chose to access, to provide a more descriptive result page explaining what happened, links to pages that explain the technology (like "what's this?" for "DNS"), and even a comparison for similar domain names in your browsing history (did you mean "slashdot.org" when you typed in "sllashdot.org"). It could even correct common misspellings and typos and offer those as links.

I can't see the result from Charter (and I guess it's not yet deployed). I'm curious if it will be helpful in ways described above.

I'm also curious if they will affect subdomain/hostnames of domains that otherwise do exist, but give an NXDOMAIN result. If so, then they can really get into hot water because there would be an identifiable owner of the non-existant name. But they might well blindly do this by substituting any NXDOMAIN result with the A record pointing to their site.

And ... using cookies is a STUPID way to opt out. Lots of people already block cookies on all sites by default, and only allow them on specific sites. That would be asking them to make their web surfing LESS secure, and thus a DEGRADED experience. Us geeks know how to change the DNS servers we do lookups through (and if they intercept that traffic, that's more hot water for them). Web browsers should provide a way to change what DNS servers it uses, too, overriding the configuration on the machine (what the ISP provided in many cases).

Re:Charter also messing with DNS.

[mysidia]

As a charter subscriber, I can confirm this. Jedi:~ root# dig -t A dsafjwekofakl.google.com ;; ANSWER SECTION: dsafjwekofakl.google.com. 60 IN A 64.158.56.56 dsafjwekofakl.google.com. 60 IN A 63.251.179.56 ;; AUTHORITY SECTION: dsafjwekofakl.google.com. 65535 IN NS WSC2.JOMAX.NET. dsafjwekofakl.google.com. 65535 IN NS WSC1.JOMAX.NET.

Re:A threat to every publisher who uses AdSense, e

[scoove]

With the "deep packet inspection" technologies, conceivably ISPs can just replace, in real-time, our Google AdSense pubisher IDs with their own.

Increasingly, I'd expect https sessions will be necessary for sites with any form of confidential information - not just sites with more sensitive financial, social security or other higher sensitivity levels. Consider that the ISPs are leveraging confidential session information to exploit the web sessions elsewhere. ISPs are also harvesting web traffic data and selling it to others for data mining utility. As a visitor to google, yahoo, whatever, my identity and usage is confidential information of financial value. It's time encapsulation and encryption be utilized by these firms to protect that information - otherwise they'll see further encroachment and loss of revenue due to this technique.

I do find it reprehensible that any ISP would violate the integrity of traffic I've requested from its source. It's a sense of forgery through a MITM activity I have not consented to (oh I'm sure they'll put that language in my contract so that I do consent, but you get the point).

Re:Open-source technological solutions....

[Beryllium Sphere(tm)]

Server Name Identification in RFC 3546 is supposed to help with this, if it ever gets adopted.

It's not web surfing anymore

[Skapare]

Now it's web serfing.

Re:Get out the DMCA hammer!

[Skapare]

That depends.

What may be going on is that the substituted ads only appear on web sites that contract with NebuAD to do this. The advantage to those web sites is they can make the ads more focused on your interests, which lets them get more ad clicks, and they split some of that increased revenue with NebuAD, which in turn splits some of it with your ISP for their part in doing the tracking of your interests. It's the tracking that goes beyond the web sites using NebuAD. Otherwise they would not need to get your local ISP into the act. Without your local ISP involved, they can still track you to some degree by having the NebuAD partner web sites share the data about your visits within their site. But to track all of your web serfing, they have to do DPI via your ISP (or by the previous methods which involved spyware on your computer).

I don't know if they plan to go beyond that and actually insert or modify ads on other web sites. If they do, then we do need to get the DMCA hammer out and use it hard. Cable companies are already aware of Mona's hammer :-)

It might still be useful to use the DMCA on the privacy invasion aspect of this. Any content acquired through DPI, if passed on to another party, does represent real copying of that content. It would be a hard case to argue, but maybe a really skilled lawyer could make the case stick. Note that while what you send to a web site could be copyrighted by you (and imply a licensed to the web site you send it to, to use it to deliver requested results), what that web site sends back can be copyrighted by them. So they may need to be in on the legal case.

One possibility is that a web site that uses another service for ads may end up having more focused ads (instead of having them inserted by your ISP) simply by that ad provider partnering with NebuAD. What is important is for us to come to understand exactly what is going on with all of this.

Copyright violation?

[RichMan]

They are going to have to do this carefully. Should they cause any variation in the rendering of a site I would assume it would be pretty easy for any site to file a copyright violation against this service.

1. set up site. Take local image of screen.
2. load site in a web browser on the ISP network.
3. If browsed image does not match the local image. File and sue the ISP provider for violating the copyright of the original site. IE they took all of the original site, reproduced it but with some ads replaced.

They've been doing this for awhile.

[Rod Beauvex]

I'vegone to ebay to look at weird random crap, and then seen ads for it Elswhere. One was Nissan Maximas, can't remember what the other thing was.

Wiretapping

[Ravenscall]

My ISP (Wide Open West) started doing this last week. They say they have no permanent opt-out, but I continue to pursue with them.

What I am curious about, since I use VOIP, are they breaking the law? Since they are are deeply inspecting the packets, they have access to all of the data being transmitted in my phone calls. Does this break federal wiretapping regulations?

Alternatives in FW?

[Laur]

Anyone know of any decent alternatives to Charter in the Fort Worth area? The only other one I know of is at&t for DSL, and after the whole illegal wiretapping / spying thing I'm not eager to give them my money either. Is there (gasp!) a viable third option that I am unaware of?

A big thank you to Paul Allen

[Hans Lehmann]

Who's the chairman of Charter? Paul G. Allen, of Microsoft fame. here's his picture. If any of your out there work in food service and Paul Allen happens to come into your establishment, remember to spit in his food. Strictly for "enhanced user experience", of course.

Re:A big thank you to Paul Allen

[riondluz]

Interesting factoid, considering pallen's connection to M$
in conjunction w/last month's networkworld report
www.networkworld.com/news/2008/043008-microsoft-helps-law-enforcement-get.html?fsrc=rss-security
to quote:
Microsoft helps law enforcement get around encryption
By Nancy Gohring , IDG News Service , 04/30/2008 ....has led Microsoft to develop a set of tools that law enforcement agents can use to get around the software, executives at the company said. ....Microsoft first released the toolset, called the Computer Online Forensic Evidence Extractor (COFEE), to law enforcement last June and it's now being used by about 2,000 agents around the world, said Anthony Fung, senior regional manager for Asia Pacific in Microsoft's Internet Safety and Anti-Counterfeiting group.

So, is it possible that microsofts foray into the 'information industrial complex' trough is to 'reachout' to the ISP's w/a
DPI solution owned by them via a proxy that adds COFEE as a bag
on the side but through which LEA gets to peek into the business
of the ISP clients (you-n-me-n-everyone-else)

I guess microsoft would become the darth vadar of the evil empire!

Interesting suggestion

[Burz]

Websites could setup certs based on keys that are very low-strength (and hence easier to process). It would be enough to stop these advertising snoops and forgers.

Opt-out?

[SanityInAnarchy]

JUST SAY NO to isp's that do this shit to you and don't give you at least an opt-out from it. "Just saying no" may not be enough. This is a bit like the pharmaceutical industry -- nothing is stopping you from selling whatever herbal remedies you like, but at the very least, you have to include an FDA warning that it's not really medicine.

Oh, and they do offer an "opt-out" -- in the form of a website that you have to visit in the clear (no https), and fill in your information, resulting in... a cookie.

Which means that you now have to make sure to opt-out in every browser you ever use, including wget and lynx. Anything which doesn't support cookies is fucked. In particular, not everyone uses XML for AJAX -- some people use XHTML for their web services. And not all web service clients are browsers that you can stick cookies in.

And, for that matter, how are they checking the cookie? Only way I can think of would be to insert some sort of hidden iframe on every page, linking to their domain, which can then check the cookie. Therefore, even if the cookie is present in every appropriate HTTP request, they're still having to fuck with most of the internet to even be able to check that cookie.

So, to summarize: They offer "opt-out", but not really. And support net neutrality legislation.

Re:Double-Standard. WHAT?

[SanityInAnarchy]

Well, that, and the fact that the issue is often confused by people calling it "theft". It can be a bad thing without being the same as theft.

And the fact that they prosecute entirely the wrong people, with pretty close to zero evidence. It is troubling that they probably could just pick someone out of the phone book at random and find that they're sharing files, but we're supposed to have something called "due process".

Re:Open-source technological solutions....

[SanityInAnarchy]

It is impossible to use virtual hosts with separate certs via https on the same IP address. Fixed it for you.

This has pretty significant ramifications in terms of the number of additional IP addresses it would require for everyone to switch to https. Use IPv6. Problem solved.

Oh, and there is a spec to allow multiple vhosts on the same address with SSL enabled. I can't help but wonder if that's really more likely to get universal adoption than ipv6, though.

But really, how hard is it to simply use the same domain? I generally see vhosts as multiple addresses for the same company -- mail.google.com, images.google.com, etc. And when they are, there's no good technological reason they can't simply move those subdomains into suburls -- google.com/mail, or google.com/images.

Well, alright, there is a good reason -- in the case of Google, those are likely different IP addresses -- but that completely negates the whole virtual host problem anyway.

Not to mention

[keirre23hu]

Many websites do not have SSL Certificates, they are not cheap or free (most of the time). Trying to browse this site on https bounces you back to the unecrypted version. And, it wont prevent you from getting ads, just from get targetted ads.

Can't we foil them with SSL

[anorlunda]

It seems like everyone has surplus CPU cycles coming out of their ears. Why can't the servers just all start using SSL as standard on all URLs? Wouldn't that pretty much foil the spys?

Re:Open-source technological solutions....

[PybusJ]

This is not really true. There are multiple standards to solve this problem.

One is the TLS server name indication (SNI) in RFC 3546. This allows the browser to specify which VHOST it wants as it's setting up the TLS connection allowing the web server to give it the right cert.

Another approach is TLS-upgrade (RFC 2817). This allows a browser to make an unencrypted HTTP connection then upgrade to secure TLS (in the same way that encrypted SNMP and other protocols work without requiring 2 different ports). This will allow secure or insecure both over port 80.

The problem is lack of browser support (and to a degree lack of server support, but people would extend/upgrade their apache/IIS/etc installs for the added functionality *if* the browsers supported it). FF2+ and IE7+ support RFC 3546, and FF3 will introduce support for RFC2817, but it'll be many years before browser share is high enough for public web sites to consider using it.

John

Tor as blocker?

[Twitchie]

Would Tor assist is blocking this type of intrusion?

No longer common carriers

[haapi]

"Common Carrier" status is something the ISP's want, so they don't have to be held responsible for subscribers' actions. If they demonstrate the capability and willingness to monitor subscribers' actions, they abandon any safe-harbor provisions the law now gives them.

If I was the legal eagle of an ISP, I would grasp the Marketing Steph-equivalent in my claws and squeeze until he admitted this is a bad idea.

Not sure if I agree with that.

[RingDev]

If my web page has hand picked adds on it that I get revenue from for click throughs, and Charter inserts adds into my page that offer similar or competing brands, I, as the website owner, can suffer financially. If Charter inserts adds that my visitors find offensive and they decide against using my service, I can suffer financially. If Charter inserts adds into my website and I have a contractual obligation to provide my users with an advertisement free environment, I could be liable (even if I could pass the buck in court, it would require a significant investment to do so).

If Charter wants to advertise on my website, they can contact me about licensing. To do anything else would be infringing on my rights. Although, I am not a lawyer, I do not know exactly what rights those are, but someone, somewhere has to have run into a similar situation and created some precedence in the US.

-Rick

Poison their data

[Westech]

How about Charter customers in these markets running programs during their computers' idle cycles that search for random keywords and visit random sites? If enough people do this the data they're collecting won't be very useful. Maybe this could be packaged as a Firefox plugin or a SETI@home style screensaver?

Charter business not inserting or poisoning.

[professorguy]

We use Charter Business (Vermont) for our fibre drop. As of today, it does neither DNS poisoning for unresolvable domains nor ad insertion.

It may be they save that for residential customers. I would definitely have a problem with ad insertion for web pages viewed in our hospital.

HTTPS anyone?

[Kili]

HTTPS anyone? Yes its more overhead. But privacy always costs something.

Re:Open-source technological solutions....

[dgatwood]

Fixed it for you.

I would have thought that part was obvious without needing to be said. After all, even if Apache didn't support it, you could just bind a separate instance of Apache to each IP address. AFAIK, the most common use of VHOST records is handling multiple server instances on one IP number. If you're going to provide separate IPs, you might as well use separate Apache instances and give each user full control over their Apache config file. Your users will certainly be a lot happier that way.

The point is that most smaller domains use VHOSTs because their hosting provider puts them and twelve other domains on the same server with the same IP. Using the same domain instead of subdomains can help solve the problem for big companies, though it means that instead of being able to distribute load through subdomains, you have to distribute it with load balancers and beefier server infrastructure. It doesn't work at all for randomfoo.org (or whatever) sharing an IP number with joebobsblog.net.

Re:Open-source technological solutions....

[dgatwood]

Oh, and I also thought my intended meaning was obvious from the very next sentence that said that this has important ramifications in terms of the number of additional IP numbers that would be needed....

Re:Open-source technological solutions....

[SanityInAnarchy]

The point is that most smaller domains use VHOSTs because their hosting provider puts them and twelve other domains on the same server with the same IP. That's the part I wasn't assuming. Interesting.

Using the same domain instead of subdomains can help solve the problem for big companies, though it means that instead of being able to distribute load through subdomains, you have to distribute it with load balancers and beefier server infrastructure. No, it doesn't, for the very simple reason that if you've split something off into a subdomain to "distribute load", it's going to be on a separate IP address anyway. Otherwise, you're not "distributing load", at least not by making it a subdomain.

Only exception would be if load balancers are somehow cheaper if they only look at the hostname, and not the URL. Certainly, software balancers like nginx are trivial to configure either way, so that foo.com/mail/ goes to a separate cluster than foo.com/forum/, and so on.

Re:Breach of contract

[SanityInAnarchy]

Far as I would understand it, this constitutes a breach of contract on their part, giving you immediate termination rights. Which, depending on where you live, may mean you go back to the wonderful world of dialup, or the strange new world of satellite.

No, if I was in that situation, I wouldn't want termination rights. I'd want damages, and/or actually forcing reasonable service out of them.