Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Polyfill supply chain attack hits 100K+ sites

sansec.io

Post reply on HN
Print view View original

281–290 of 387 posts

Re: Polyfill supply chain attack hits 100K+ sites

#281

Post by Jakob »

globalise83 wrote: post #270
sneak wrote: post #268

Clientside mitigation: install noscript. https://addons.mozilla.org/en-US/firefox/addon/noscript/ You can’t expect to remain secure on the modern web while running arbitrary javascript from anyone and everyone.

Nice: to be secure on the web, you just need to install an add-on which needs to: Access browser tabs Store unlimited amount of client-side data Access browser activity during navigation Access your data for all websites

Yes that is unfortunate. Safari had the option to toggle JavaScript via Shortcut until recently, but it was removed. The only browser I know which can easily toggle JavaScript now is Brave.

But uBlock Origin has that functionality, too, and I guess most people who would care about JavaScript have that already enabled anyways.

The web is so much nicer without JavaScript but easily activating it (via cmd-J) once it seems necessary without reloading.

Re: Polyfill supply chain attack hits 100K+ sites

#282

Post by ChrisMarshallNY »

hyperhopper wrote: post #275
commandlinefan wrote: post #269

One of these days we're going to learn our lesson and just write our own damned code.

Then you get to write 10x the vulnerabilities yourself and not have nearly the same chance of any of them getting disclosed to you!

That argument doesn't seem to be aging well.

I'd say that good [emphasis on "good"] coders can write very secure code. There's fundamental stuff, like encryption algos, that should be sourced from common (well-known and trusted) sources, but when we load in 100K of JS, so we can animate a disclosure triangle, I think it might not be a bad time to consider learning to do that, ourselves.

Re: Polyfill supply chain attack hits 100K+ sites

#283

Post by AndyMcConachie »

commandlinefan wrote: post #269

One of these days we're going to learn our lesson and just write our own damned code.

How hard is it to download your includes and host them on your own domain?

I know sometimes it's not possible, but whenever I can I always do this. If only because it means that if the remote version changes to a new version it doesn't break my code.

Re: Polyfill supply chain attack hits 100K+ sites

#286

Post by BlueTemplar »

rob74 wrote: post #279
helsinkiandrew wrote: post #272

> "If you own a website, loading a script implies an incredible relationship of trust with that third party," he Xeeted at the time. Are people actually calling Tweets "Xeets" now?

I propose "X-crete" as the new verb and "X-cretion" for the final product.

I was thinking about "Xitting out", but yours is better.

Re: Polyfill supply chain attack hits 100K+ sites

#287

Post by localfirst »

helsinkiandrew wrote: post #272

> "If you own a website, loading a script implies an incredible relationship of trust with that third party," he Xeeted at the time. Are people actually calling Tweets "Xeets" now?

Xeet in the hip hop industry means something completely different.

Re: Polyfill supply chain attack hits 100K+ sites

#288

Post by tslocum »

When you are selling an open source project, what outcome do you expect? People who are interested in the project non-financially will demonstrate their value in other ways (PRs, reviews, docs, etc) leading to the more common succession of maintainers without exchanging money. I don't think it's reasonable for software authors, who take the route of giving their projects to buyers rather than top contributors, to act surprised when the consequences roll in.

Re: Polyfill supply chain attack hits 100K+ sites

#289

Post by brunoqc »

globalise83 wrote: post #270
sneak wrote: post #268

Clientside mitigation: install noscript. https://addons.mozilla.org/en-US/firefox/addon/noscript/ You can’t expect to remain secure on the modern web while running arbitrary javascript from anyone and everyone.

Nice: to be secure on the web, you just need to install an add-on which needs to: Access browser tabs Store unlimited amount of client-side data Access browser activity during navigation Access your data for all websites

You don't need an addon for https://safebrowsing.google.com

Re: Polyfill supply chain attack hits 100K+ sites

#290

Post by globalise83 »

zuminator wrote: post #278
globalise83 wrote: post #270

Earlier quoted context omitted.

Nice: to be secure on the web, you just need to install an add-on which needs to: Access browser tabs Store unlimited amount of client-side data Access browser activity during navigation Access your data for all websites

Unless you design your own silicon, build your own pc and peripherals, and write all your own software, there's always going to be a level of trust involved. But at least NoScript is FOSS so you can in theory examine the source code yourself. https://github.com/hackademix

So is polyfill https://github.com/polyfillpolyfill/polyfill-service
Post reply on HN