Live data from Hacker News

Polyfill supply chain attack hits 100K+ sites

sansec.io

291–300 of 387 posts

Re: Polyfill supply chain attack hits 100K+ sites

#291

The fact two Fastly employees are involved does immense damage for its brand. Had it not been for the greed of Fastly's employee, this whole thing could've been avoided.

> Had it not been for the greed of Fastly's employee

I don't think he had anything to do with the sale.

Re: Polyfill supply chain attack hits 100K+ sites

#295

I checked, and here are the top domains that are still using Polyfill.io as of today: https://pastila.nl/?00008b47/8a0d821be418cdd5003a2d620d76589... However, theguardian.com is using it from its own domain, which is safe. But most of the other 5000 websites don't.

Many .gov websites seen on this list.

Re: Polyfill supply chain attack hits 100K+ sites

#296
I really wish we didn't have to trust the websites we go to. This exploit is a good example of the problem. I go to a website and something in the content of the website forces you to go to an entirely different place. I didn't click on a link, it can just do this based on any criteria it wants to apply.

Re: Polyfill supply chain attack hits 100K+ sites

#297

I checked, and here are the top domains that are still using Polyfill.io as of today: https://pastila.nl/?00008b47/8a0d821be418cdd5003a2d620d76589... However, theguardian.com is using it from its own domain, which is safe. But most of the other 5000 websites don't.

The number of websites is decreasing, which is good:

    clickhouse-cloud :) SELECT date, count() FROM minicrawl_processed WHERE arrayExists(x -> x LIKE '%polyfill.io%', external_scripts_domains) AND date >= now() - INTERVAL 5 DAY GROUP BY date ORDER BY date

       ┌───────date─┬─count()─┐
    1. │ 2024-06-22 │    6401 │
    2. │ 2024-06-23 │    6398 │
    3. │ 2024-06-24 │    6381 │
    4. │ 2024-06-25 │    6325 │
    5. │ 2024-06-26 │    5426 │
       └────────────┴─────────┘

    5 rows in set. Elapsed: 0.204 sec. Processed 15.70 million rows, 584.74 MB (76.87 million rows/s., 2.86 GB/s.)
    Peak memory usage: 70.38 MiB.
PS. If you want to know about this dataset, check https://github.com/ClickHouse/ClickHouse/issues/18842

Re: Polyfill supply chain attack hits 100K+ sites

#298

I think JS (well, ES6) has a ton of positive qualities, and I think it's a great fit for many of its current applications. However, this is a pretty good example of what bothers me about the way many people use it. I see a lot of folks, in the name of pragmatism, adopt a ton of existing libraries and services so they don't have to think about more complex parts of the problem they're solving. Great! No need to reinve…

This is the end-stage of having third-party packaging systems without maintainers. This happens vanishingly infrequently for things like apt repositories, because the people maintaining packages are not necessarily the people writing them, and there's a bit of a barrier to entry. Who knew yanking random code from random domains and executing it was a bad idea? Oh yeah, everyone.

Re: Polyfill supply chain attack hits 100K+ sites

#299

One of these days we're going to learn our lesson and just write our own damned code.

Or just use subresource integrity

Subresource integrity wouldn't work with Polyfill.io scripts, since they dynamically changed based on user agent.
Post reply on HN