Polyfill supply chain attack hits 100K+ sites
1–10 of 387 posts
Re: Polyfill supply chain attack hits 100K+ sites
#2But Microsoft Azure for GitHub ScanningPoint 2024 is SOC2 compliant. How could this happen?
Re: Polyfill supply chain attack hits 100K+ sites
#3Always host your dependencies yourself, it's easy to do & even in the absence of a supply chain attack it helps to protect your users' privacy.
Re: Polyfill supply chain attack hits 100K+ sites
#4Software supply chains feel like one of the Internet's last remaining high-trust spaces, and I don't think that's going to last long. A tidal wave of this is coming. I'm kind of surprised it's taken this long given how unbelievably soft this underbelly is.
Re: Polyfill supply chain attack hits 100K+ sites
#5Software supply chains feel like one of the Internet's last remaining high-trust spaces, and I don't think that's going to last long. A tidal wave of this is coming. I'm kind of surprised it's taken this long given how unbelievably soft this underbelly is.
going back to rolling it yourself, or relying on a few high quality stdlib providers that you likely have to pay for.
Re: Polyfill supply chain attack hits 100K+ sites
#6I'm surprised there is no mention of subresource integrity in the article. It's a low effort, high quality mitigation for almost any JS packages hosted by a CDN.
EDIT: Oh, it's because they are selling something. I don't know anything about their offerings, but SRI is made for this and is extremely effective.
Re: Polyfill supply chain attack hits 100K+ sites
#7Important context given by the author of polyfill:
> If your website uses http://polyfill.io, remove it IMMEDIATELY.
I created the polyfill service project but I have never owned the domain name and I have had no influence over its sale. (1)
Although I wonder how the GitHub account ownership was transferred.
Re: Polyfill supply chain attack hits 100K+ sites
#8Always host your dependencies yourself, it's easy to do & even in the absence of a supply chain attack it helps to protect your users' privacy.
But if the dependency from a CDN is already cached, it will skip an extra resource and site will load faster.
I agree with the points though.
Re: Polyfill supply chain attack hits 100K+ sites
#9I had this conversation countless times with developers: are you really ok if someone hijacks the CDN for the code you're including? They almost always seem to be fine with it, simply because everyone else is doing it like this. At the same time they put up with countless 2FAs in the most mundane places.
The follow up of "you know that the random packages you're including could have malware" is even more hopeless.
Re: Polyfill supply chain attack hits 100K+ sites
#10Always host your dependencies yourself, it's easy to do & even in the absence of a supply chain attack it helps to protect your users' privacy.
But if the dependency from a CDN is already cached, it will skip an extra resource and site will load faster. I agree with the points though.
That’s not been true since Site Isolation IIRC
e: Not sure it’s Site Isolation specifically, but it’s definitely still not true anymore: https://news.ycombinator.com/item?id=24745748
e2: listen to the commenter below, its Cache Partitioning: https://developer.chrome.com/blog/http-cache-partitioning