Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Polyfill supply chain attack hits 100K+ sites

sansec.io

Post reply on HN
Print view View original

241–250 of 387 posts

Re: Polyfill supply chain attack hits 100K+ sites

#241

Post by hatenberg »

program_whiz wrote: post #79
causal wrote: post #58

Earlier quoted context omitted.

It seems when proprietary resources get infected it's because hackers are the problem, but when open source resources get infected its a problem with open source. But there isn't any particular reason why a paid/proprietary host couldn't just as easily end up being taken over / sold to a party intending to inject malware. It happens all the time really.

agreed, but if a company is making millions for the security of software, the incentive is to keep it secure so customers stick with it. Remember the lastpass debacle, big leak and lost many customers...

Only if they have competition. Which long term is not the default state in the market.

Re: Polyfill supply chain attack hits 100K+ sites

#242

Post by diego_sandoval »

cqqxo4zV46cp wrote: post #175
diego_sandoval wrote: post #158

The phrase "supply chain attack" makes it sound like it's some big, hard to avoid problem. But almost always, it's just developer negligence: 1. Developer allows some organization to inject arbitrary code in the developer's system 2. Organization injects malicious code 3. Developer acts all surprised and calls it an "attack" Maybe don't trust 3rd parties so much? There's technical means to avoid it. Calling this situ…

What good does this comment do beside allow you to gloat and put others down? Like, Christ. Are you telling me that you’d ever speak this way to someone in person? I have no doubt that every single person in this thread understands what a supply chain attack is. You are arguing over semantics in an incredibly naive way. Trust relationships exist both in business and in society generally. It’s worth calling out attack…

All other things being equal, a computer system that doesn't depend on trusting some external entity is better than one that does.

Sometimes, trusting is inevitable (e.g. SSL certificate authorities), but in this case, it was very much a choice on part of the developers.

Re: Polyfill supply chain attack hits 100K+ sites

#243

Post by mb2100 »

bobthepanda wrote: post #236
chrisweekly wrote: post #68

Earlier quoted context omitted.

Good point. What's often (and sometimes fairly) derided as "chasing the new shiny" has a lot of other benefits too: increased exposure to new (and at least sometimes demonstrably better) ways of doing things; ~inevitable refactoring along the way (otherwise much more likely neglected); use of generally faster, leaner, less dependency-bloated packages; and an increased real-world userbase for innovators. FWIW, my pers…

to be fair there is a whole spectrum between "chasing every new shiny that gets a blog post" vs. "I haven't changed my stack since 1998." there are certainly ways to get burned by adopting shiny new paradigms too quickly; one big example in web is the masonry layout that Pinterest made popular, which in practice is extremely complicated to the point where no browser has a full implementation of the CSS standard.

CSS Masonry is not even standardized yet. There is a draft spec: https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_grid_la... and ongoing discussion whether it should be part of CSS grid or a new `display` property.

Re: Polyfill supply chain attack hits 100K+ sites

#244

Post by aembleton »

victor9000 wrote: post #37

I added a ublock rule on mobile to exclude this domain ||polyfill.io^ Any other practical steps that mobile users can take?

Its already been blocked by Ublock filters - badware risks: https://github.com/uBlockOrigin/uAssets/blob/master/filters/...

Re: Polyfill supply chain attack hits 100K+ sites

#245

Post by bratbag »

immibis wrote: post #235
TZubiri wrote: post #185

Earlier quoted context omitted.

Yes, the economic problem of reward absence is exclusive to open source and private software does not have it. They may have others, like excess of rewards to hackers in form of crypto ransom to the point that the defense department had to step in and ban payouts.

Private software always wants more rewards, leading to identical symptoms.

Private software already has rewards that may be threatened by certain types of behaviour, leading to reduced symptoms.

Re: Polyfill supply chain attack hits 100K+ sites

#246

Post by SV_BubbleTime »

rytor718 wrote: post #187
irskep wrote: post #81

Earlier quoted context omitted.

I'm predisposed to agree with the diagnosis that incompetence is ruining a lot of things, but the article boils down to "diversity hiring is destroying society" and seems to attribute a lot of the decline to the Civil Rights Act of 1964. Just in case anybody's wondering what they would get from this article. > By the 1960s, the systematic selection for competence came into direct conflict with the political imperativ…

Thank you for summarizing (I actually read the whole article before seeing your reply and might have posted similar thoughts). I get the appeal of romanticizing our past as a country, looking back at the post-war era, especially the space race with a nostalgia that makes us imagine it was a world where the most competent were at the helm. But it just wasn't so, and still isn't. Many don't understand that the Civil Ri…

>Many don't understand that the Civil Rights Act describes the systematic LACK of a meritocracy. It defines the ways in which merit has been ignored (gender, race, class, etc) and demands that merit be the criteria for success

Stealing that. Very good.

Re: Polyfill supply chain attack hits 100K+ sites

#247

Post by lostmsu »

girvo wrote: post #214
jacobsenscott wrote: post #138

Earlier quoted context omitted.

polyfilling and minification both belong on the ash heap of js development technologies.

I wish. When our bundles are being deployed globally and regularly opened on out of date phones and desktops, it can't be avoided yet.

There might be a negative incentive in play: you may be compressing packages, but having your dependencies available at the tip of *pm install bloats overall size and complexity beyond what lack of bundling would give you.

Re: Polyfill supply chain attack hits 100K+ sites

#248

Post by grodriguez100 »

diego_sandoval wrote: post #158

The phrase "supply chain attack" makes it sound like it's some big, hard to avoid problem. But almost always, it's just developer negligence: 1. Developer allows some organization to inject arbitrary code in the developer's system 2. Organization injects malicious code 3. Developer acts all surprised and calls it an "attack" Maybe don't trust 3rd parties so much? There's technical means to avoid it. Calling this situ…

I love the ethanol consumption attack thing :-)

Re: Polyfill supply chain attack hits 100K+ sites

#249

Post by anonzzzies »

program_whiz wrote: post #14

Game theory at work? Someone needs to maintain legacy code for free that hosts thousands of sites and gets nothing but trouble (pride?) in return. Meanwhile the forces of the world present riches and power in return to turn to the dark side (or maybe just letting your domain lapse and doing something else). If security means every maintainer of every OSS package you use has to be scrupulous, tireless, and not screw u…

> did you think service would remain high quality, free, well supported, and run by tireless, unselfish, unambitious benevolent dictators for the rest of your life

I would run some things I run forever free, if once in a while 1 user would be grateful. In reality that doesn’t happen so I usually end up monetising and then selling it off. People whine about everything and get upset if I don’t answer tickets within a working day etc. Mind you; these are free things with no ads. The thing is; they expect me to fuck them over in the end as everyone does, so it becomes a self fulfilling prophecy. Just a single email or chat saying thank you for doing this once in a while would go a long way, but alas; it’s just whining and bug reports and criticism.

Re: Polyfill supply chain attack hits 100K+ sites

#250

Post by bigiain »

bratbag wrote: post #245
immibis wrote: post #235

Earlier quoted context omitted.

Private software always wants more rewards, leading to identical symptoms.

Private software already has rewards that may be threatened by certain types of behaviour, leading to reduced symptoms.

Hasn't stopped Larry Ellison from laughing all the way to the bank.
Post reply on HN