Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Polyfill supply chain attack hits 100K+ sites

sansec.io

Post reply on HN
Print view View original

211–220 of 387 posts

Re: Polyfill supply chain attack hits 100K+ sites

#211

Post by dspillett »

asddubs wrote: post #163
nephanth wrote: post #146

Earlier quoted context omitted.

> I always prefer to self-host my dependencies Js dependencies should be pretty small compared to images or other resources. Http pipelining should make it fast to load them from your server with the rest The only advantage to using one of those cdn-hosted versions is that it might help with browser caching

nope, browsers silo cache to prevent tracking via cached resources

There is still a caching effect of the CDN for your servers, even if there isn't for the end user: if the CDN serves the file then your server does not have to.

Large CDNs with endpoints in multiple locations internationally also give the advantage of reducing latency: if your static content comes from the PoP closest to me (likely London, This may not be at all important for many well-designed sites, or sites where latency otherwise matters little enough that a few hundred ms a couple of times here or there isn't really going to particularly bother the user, but could be a significant benefit to many bad setups and even a few well-designed ones.

--------

[0] York. The real one. The best one. The one with history and culture. None of that “New” York rebranded New Amsterdam nonsense!

[1] if using HTTPS and you trust the CDN to re-encrypt, or HTTP and have the CDN add HTTPS, neither of which I wouldn't recommend as it is exactly an MitM situation, but both are often done

[2] assuming the CDN also manages your DNS for the whole site, or just a subdomain for the static resources, so the end user sees the benefit of the CDNs anycast DNS arrangement.

Re: Polyfill supply chain attack hits 100K+ sites

#212

Post by brianwawok »

out-of-ideas wrote: post #202
benregenspan wrote: post #151

Earlier quoted context omitted.

I would agree with you if minification delivered marginal gains, but it will generally roughly halve the size of a large bundle or major JS library (compared to just gzip'ing it alone), and this is leaving aside further benefits you can get from advanced minification with dead code removal and tree-shaking. That means less network transfer time and less parse time. At least for my use-cases, this will always justify…

I really miss the days of minimal/no use of JS in websites (not that I want java-applets and Flash LOL). Kind of depressing that so much of the current webdesign is walled behind javascript.

I don’t. Always Craigslist and hacker news to give that 2004 UX.

Re: Polyfill supply chain attack hits 100K+ sites

#214

Post by girvo »

jacobsenscott wrote: post #138
silverwind wrote: post #111

Earlier quoted context omitted.

The assumption of many npm packages is that you have a bundler and I think rightly so because that leaves all options open regarding polyfilling, minification and actual bundling.

polyfilling and minification both belong on the ash heap of js development technologies.

I wish. When our bundles are being deployed globally and regularly opened on out of date phones and desktops, it can't be avoided yet.

Re: Polyfill supply chain attack hits 100K+ sites

#216

Post by triblondon »

baxtr wrote: post #7

Important context given by the author of polyfill: > If your website uses http://polyfill.io , remove it IMMEDIATELY. I created the polyfill service project but I have never owned the domain name and I have had no influence over its sale. (1) Although I wonder how the GitHub account ownership was transferred. (1) https://x.com/triblondon/status/1761852117579427975

Hi, I'm the original author of the polyfill service. I did not own the domain name nor the GitHub account. In recent years I have not been actively involved in the project, and I'm dismayed by what's happened here. Sites using the original polyfill.io should remove it right away and use one of the alternatives or just drop it entirely - in the modern era it really isn't needed anymore.

Re: Polyfill supply chain attack hits 100K+ sites

#217

Post by DaoVeles »

akira2501 wrote: post #189
Animats wrote: post #124

Washington Post home page external content: app.launchdarkly.com cdn.brandmetrics.com chrt.fm clientstream.launchdarkly.com events.launchdarkly.com fastlane.rubiconproject.com fonts.gstatic.com g.3gl.net grid.bidswitch.net hbopenbid.pubmatic.com htlb.casalemedia.com ib.adnxs.com metrics.zeustechnology.com pixel.adsafeprotected.com podcast.washpostpodcasts.com podtrac.com redirect.washpostpodcasts.com rtb.openx.net sc…

"No sir, we have absolutely no idea why anyone would ever use an ad blocker."

No just for mental sanity but online safety.

Re: Polyfill supply chain attack hits 100K+ sites

#219

Post by TacticalCoder »

SV_BubbleTime wrote: post #53
program_whiz wrote: post #14

Game theory at work? Someone needs to maintain legacy code for free that hosts thousands of sites and gets nothing but trouble (pride?) in return. Meanwhile the forces of the world present riches and power in return to turn to the dark side (or maybe just letting your domain lapse and doing something else). If security means every maintainer of every OSS package you use has to be scrupulous, tireless, and not screw u…

Real solution? We’re in a complexity crisis and almost no one sees it. It’s not just software dependencies of course. It’s everything almost everywhere. No joke, the Amish have a point. They were just a few hundred years too early.

> Real solution?

I don't think there's any. Too many luminaries are going to defend the fact that we can have things like "poo emojis" in domain names.

They don't care about the myriad of homograph/homoglyph attacks made possible by such an idiotic decision. But they've got their shiny poo, so at least they're happy idiots.

It's a lost cause.

Re: Polyfill supply chain attack hits 100K+ sites

#220

Post by chmod775 »

swatcoder wrote: post #110
alephnerd wrote: post #74

Earlier quoted context omitted.

> I always prefer to self-host my dependencies Ime this has always been standard practice for production code at all the companies I've worked at and with as a SWE or PM - store dependencies within your own internal Artifactory, have it checked by a vuln scanner, and then called and deployed. That said, I came out of the Enterprise SaaS and Infra space so maybe workflows are different in B2C, but I didn't a differenc…

> I guess my question is why your employer or any other org would not follow the model above? Frankly, it's because many real-world products are pieced together by some ragtag group of bright people who have been made responsible for things they don't really know all that much about. The same thing that makes software engineering inviting to autodidacts and outsiders (no guild or license, pragmatic 'can you deliver'…

Counterpoint: It's not not about being an autodidact or an outsider.

I was unlikely to meet any bad coders at work, due to how likely it is they were filtered by the hiring process, and thus I never met anyone writing truly cringe-worthy code in a professional setting.

That was until I decided to go to university for a bit[1]. This is where, for the first time, I met people writing bad code professionally: professors[2]. "Bad" as in best-practices, the code usually worked. I've also seen research projects that managed to turn less than 1k LOC of python into a barely-maintainable mess[3].

I'll put my faith in an autodidact who had to prove themselves with skills and accomplishments alone over someone who got through the door with a university degree.

An autodidact who doesn't care about their craft is not going to make the cut, or shouldn't. If your hiring process doesn't filter those people, why are you wasting your time at a company that probably doesn't know your value?

[1] Free in my country, so not a big deal to attend some lectures besides work. Well, actually I'm paying for it with my taxes, so I might as well use it.

[2] To be fair, the professors teaching in actual CS subjects were alright. Most fields include a few lectures on basic coding though, which were usually beyond disappointing. The non-CS subject that had the most competent coders was mathematics. Worst was economics. Yes, I meandered through a few subjects.

[3] If you do well on some test you'd usually get job offers from professors, asking you to join their research projects. I showed up to interviews out of interest in the subject matter and professors are usually happy to tell you all about it, but wages for students are fixed at the legal minimum wage, so it couldn't ever be a serious consideration for someone already working on the free market.

Post reply on HN