[ NNSquad ] Re: Google Hijacked -- Major ISP to Intercept and Modify Web Pages

[Sean Donelan <sean@donelan.com>]

On Sun, 9 Dec 2007, Lauren Weinstein wrote:
> Now, for the sake of the argument, if one wishes to suggest that the
> *only* effective mechanism an ISP has to reach users with account
> information is through their Web browsers, then ISPs could choose
> to simply display a click-through splash page once at the beginning
> of a session, much as pay Wifi hotspots do for user logins.

I've noticed a pattern to this discussions.  It seems to swing back
and forth that ISPs are doing X which we decide is "bad" and we want them 
to do Y instead.  A little while later someone discovers an ISP doing Y, 
and a different set of people start saying that Y is "bad" and the ISP
should be doing X instead.  Rinse, lather, repeat.

The proposed alternatives seem to involve just as much hackery.

What is the beginning of a "session" for an "always-on" residential 
connection?  Each time a user boots their computer?  Establishes a PPPOE 
connection? Every 24 hours at midnight? At whatever time they use up their 
pre-paid account balance?

The hot-spot login re-direct page is a bit of a hack created by 
ISPs because 801.1x/DHCP/PPPOE/etc standards didn't seem to evolve fast 
enough.  They probably violate several RFCs, and still aren't 
standardized.  While some folks seem to consider web login redirects 
acceptable hacks, other people don't.

Instead of saying everything is bad, would it be more useful to propose 
some protocols for how it should be done instead?

     [ A protocol for displaying an unobtrusive "ISP Message Waiting" alert
	flag on browsers -- under user control of course -- would be an
	interesting development.
                               -- Lauren Weinstein
                                  NNSquad Moderator ]