Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Polyfill supply chain attack hits 100K+ sites

sansec.io

Post reply on HN
Print view View original

201–210 of 387 posts

Re: Polyfill supply chain attack hits 100K+ sites

#201

Post by bawolff »

josephg wrote: post #152
progmetaldev wrote: post #140

Earlier quoted context omitted.

In my experience, it was more about beating metrics in PageSpeed Insights and Pingdom, rather than actually thinking about the cost/risk ratio for end users. Often the people that were pushing for CDN usage were SEO/marketing people believing their website would rank higher for taking steps like these (rather than working with devs and having an open conversation about trade-offs, but maybe that's just my perspective…

I don’t think it ever even improved page load speeds, because it introduces another dns request, another tls handshake, and several network round trips just to what? Save a few kb on your js bundle size? That’s not a good deal! Just bundle small polyfills directly. At these sizes, network latency dominates download time for almost all users.

> I don’t think it ever even improved page load speeds, because it introduces another dns request, another tls handshake, and several network round trips just to what?

I think the original use case, was when every site on the internet was using jquery, and on a js based site this blocked display (this was also pre fancy things like HTTP/2 and TLS 0-RTT). Before cache partitioning you could reuse jquery js requested from a totally different site currently in cache as long as the js file had same url, which almost all clients already had since jquery was so popular.

So it made sense at one point but that was long ago and the world is different now.

Re: Polyfill supply chain attack hits 100K+ sites

#202

Post by out-of-ideas »

benregenspan wrote: post #151
jacobsenscott wrote: post #138

Earlier quoted context omitted.

polyfilling and minification both belong on the ash heap of js development technologies.

I would agree with you if minification delivered marginal gains, but it will generally roughly halve the size of a large bundle or major JS library (compared to just gzip'ing it alone), and this is leaving aside further benefits you can get from advanced minification with dead code removal and tree-shaking. That means less network transfer time and less parse time. At least for my use-cases, this will always justify…

I really miss the days of minimal/no use of JS in websites (not that I want java-applets and Flash LOL). Kind of depressing that so much of the current webdesign is walled behind javascript.

Re: Polyfill supply chain attack hits 100K+ sites

#203

Post by yesimahuman »

linclark wrote: post #198
yesimahuman wrote: post #32

Earlier quoted context omitted.

Does this person telling us not to use polyfill.io, and the guy who sold polyfill.io to the chinese company both work at Fastly? If so, that's kind of awkward...

Neither of them had ownership of the project, so neither of them were responsible for the sale or benefited from it. They both simply dedicated a lot of time, care and skill to the project. It's really a shame to see what they spent so much time building and maintaining now being used as a platform to exploit people. I'm sure its extremely disappointing to both of them.

https://web.archive.org/web/20240229113710/https://github.co...

Is JakeChampion not the one who sold the project? His bio says he currently works at Fastly

Re: Polyfill supply chain attack hits 100K+ sites

#204

Post by spankalee »

silverwind wrote: post #111
simonw wrote: post #52

Earlier quoted context omitted.

I always prefer to self-host my dependencies, but as a developer who prefer to avoid an npm-based webpack/whatever build pipeline it's often WAY harder to do that than I'd like. If you are the developer of an open source JavaScript library, please take the time to offer a downloadable version of it that works without needing to run an "npm install" and then fish the right pieces out of the node_modules folder. jQuery…

The assumption of many npm packages is that you have a bundler and I think rightly so because that leaves all options open regarding polyfilling, minification and actual bundling.

The assumption shouldn't be that you have a bundler, but that your tools and runtimes support standard semantics, so you can bundle if you want to, or not bundle if you don't want to.

Re: Polyfill supply chain attack hits 100K+ sites

#205

Post by advael »

the8472 wrote: post #176
advael wrote: post #137

Earlier quoted context omitted.

Directly security-focused products like lastpass are the only things that have any market pressure whatsoever on this, and that's because they're niche products for which the security is the only value-add, marketed to explicitly security-conscious people and not insulated by a whole constellation of lock-in services. The relevant security threats for the overwhelming majority of people and organizations are breaches…

Even for security-related products the incentives are murky. If they're not actually selling you security but a box on the compliance bingo then it's more likely that they actually increase your attack surface because they want to get their fingers into everything so they can show nice charts about all the things they're monitoring.

Aye. My internal mythological idiolect's trickster deity mostly serves to personify the game-theoretic arms race of deception and is in a near-constant state of cackling derisively at the efficient market hypothesis

Re: Polyfill supply chain attack hits 100K+ sites

#206

Post by simonw »

bonestamp2 wrote: post #157
simonw wrote: post #52

Earlier quoted context omitted.

I always prefer to self-host my dependencies, but as a developer who prefer to avoid an npm-based webpack/whatever build pipeline it's often WAY harder to do that than I'd like. If you are the developer of an open source JavaScript library, please take the time to offer a downloadable version of it that works without needing to run an "npm install" and then fish the right pieces out of the node_modules folder. jQuery…

> prefer to avoid an npm-based webpack/whatever build pipeline What kind of build pipeline do you prefer, or are you saying that you don't want any build pipeline at all?

I don't want a build pipeline. I want to write some HTML with a script type=module tag in it with some JavaScript, and I want that JavaScript to load the ES modules it depends on using import statements (or dynamic import function calls for lazy loading).

Re: Polyfill supply chain attack hits 100K+ sites

#207

Post by [deleted] »

josephg wrote: post #133
pcthrowaway wrote: post #104

Earlier quoted context omitted.

This supply chain attack had nothing to do with npm afaict. The dependency in question seems to be (or claim to be) a lazy loader that determines browser support for various capabilities and selectively pulls in just the necessary polyfills; in theory this should make the frontend assets leaner. But the CDN used for the polyfills was injecting malicious code.

Sounds like a bad idea to me. I would expect latency (network round trip time) to make this entire exercise worthless. Most polyfills are 1kb or less. Splitting polyfill code amongst a bunch of small subresources that are loaded from a 3rd party domain sounds like it would be a net loss to performance. Especially since your page won’t be interactive until those resources have downloaded. Your page will almost certain…

[deleted]

Re: Polyfill supply chain attack hits 100K+ sites

#208

Post by [deleted] »

causal wrote: post #58
program_whiz wrote: post #14

Game theory at work? Someone needs to maintain legacy code for free that hosts thousands of sites and gets nothing but trouble (pride?) in return. Meanwhile the forces of the world present riches and power in return to turn to the dark side (or maybe just letting your domain lapse and doing something else). If security means every maintainer of every OSS package you use has to be scrupulous, tireless, and not screw u…

It seems when proprietary resources get infected it's because hackers are the problem, but when open source resources get infected its a problem with open source. But there isn't any particular reason why a paid/proprietary host couldn't just as easily end up being taken over / sold to a party intending to inject malware. It happens all the time really.

[deleted]

Re: Polyfill supply chain attack hits 100K+ sites

#209

Post by can16358p »

pityJuke wrote: post #10
can16358p wrote: post #8

Earlier quoted context omitted.

But if the dependency from a CDN is already cached, it will skip an extra resource and site will load faster. I agree with the points though.

That’s not been true since Site Isolation IIRC e: Not sure it’s Site Isolation specifically, but it’s definitely still not true anymore: https://news.ycombinator.com/item?id=24745748 e2: listen to the commenter below, its Cache Partitioning: https://developer.chrome.com/blog/http-cache-partitioning

Didn't know that. Then why are we (I mean, many web devs) still using it?

Just an old convention, simplicity, or saving bandwidth?

Re: Polyfill supply chain attack hits 100K+ sites

#210

Post by wadadadad »

chrisweekly wrote: post #68
program_whiz wrote: post #43

Earlier quoted context omitted.

in a strange way, this almost makes the behavior of hopping onto every new framework rational. The older and less relevant the framework, the more the owner's starry-eyed enthusiasm wears off. The hope that bigcorp will pay $X million for the work starts to fade. The tedium of bug fixes and maintenance wears on, the game theory takes it's toll. The only rational choice for library users is to jump ship once the numbe…

Good point. What's often (and sometimes fairly) derided as "chasing the new shiny" has a lot of other benefits too: increased exposure to new (and at least sometimes demonstrably better) ways of doing things; ~inevitable refactoring along the way (otherwise much more likely neglected); use of generally faster, leaner, less dependency-bloated packages; and an increased real-world userbase for innovators. FWIW, my pers…

Would you consider yourself as to have "chased the new shiny"? If you don't mind, how many changes (overhauls?) would you say you've made?
Post reply on HN