311–320 of 387 posts
Sure, in a true supply chain attack, you wouldn’t be able to trust npm or github or whatever, but atleast you wouldn’t be compromised immediately.
And even outside of security concerns, why would you ever allow someone else to deploy code to your site without testing it first?
Quite the CDN, eh? :/
> "If you own a website, loading a script implies an incredible relationship of trust with that third party," he Xeeted at the time. Are people actually calling Tweets "Xeets" now?
How would you even pronounce it?
Earlier quoted context omitted.
Nice: to be secure on the web, you just need to install an add-on which needs to: Access browser tabs Store unlimited amount of client-side data Access browser activity during navigation Access your data for all websites
You don't need an addon for https://safebrowsing.google.com
This is already wrong in my experience. I had a coworker panicking two weeks ago because he googled youtube and clicked the first link. Which turned out to be a fake ransomware page ad designed to get you to call a scam call center.
There is no such thing as a safe ad anymore because no one is policing them appropriately. Especially if something like this can happen when searching a service google themselves owns.
;; QUESTION SECTION:
;cdn.polyfill.io. IN A
;; ANSWER SECTION:
cdn.polyfill.io. 553 IN CNAME cdn.polyfill.io.cdn.cloudflare.net.
cdn.polyfill.io.cdn.cloudflare.net. 253 IN A 172.67.209.56
cdn.polyfill.io.cdn.cloudflare.net. 253 IN A 104.21.23.55
Earlier quoted context omitted.
Only if they have competition. Which long term is not the default state in the market.
> Which long term is not the default state in the market Why not?
Might as well ask why companies like money.
I don’t understand why JS devs treat dependencies the way they do. If you are writing scripts that run on other people’s computers I feel like the dependencies used should be vetted for security constantly, and should be used minimally. Meanwhile most libraries seem to have 80 trillion dependencies written by random github accounts called “xihonghua” or something with no other projects on their account.
I’ve worked with many JS devs who also have broader experience and are more than aware of issues like these, so it just depends I guess.
The bigger issue may just be the lack of a culture that vendors their code locally and always relies on the 3rd party infrastructure (npm or cdn).
It’s somewhat similar but any Rust project I’m building, I wind up vendoring the crates I pull in locally and reviewing them. I thought it would be more annoying but it’s really not that bad in the grand scheme of things - and there should be some automated things you could set up to catch obvious issues, though I defer to someone with more knowledge to chime in here.
This may be an extra level of headache with the JS ecosystem due to the sheer layers involved.
I think JS (well, ES6) has a ton of positive qualities, and I think it's a great fit for many of its current applications. However, this is a pretty good example of what bothers me about the way many people use it. I see a lot of folks, in the name of pragmatism, adopt a ton of existing libraries and services so they don't have to think about more complex parts of the problem they're solving. Great! No need to reinve…
I do vendor my JS, but only for things like PDF processing, 3D graphics, and barcode scanning.
I've been through the framework gauntlet. Angular, RiotJS, React, Blazor, AspNetCore MVC, you name it. There was a time where I really needed some kind of structure to get conceptually bootstrapped. After a while, these things begin to get in the way. Why can't I have the framework exactly my way? Just give me the goddamn HttpContext and get off my lawn. I don't need a babysitter to explain to me how to interpolate my business into an html document string anymore.
I also now understand why a lot of shops insist on separation between frontend and backend. It seems to me that you have to be willing to dedicate much of your conscious existence to honing your skills if you want to be a competent full stack developer. It can't just be your 9-5 job unless you are already highly experienced and have a set of proven patterns to work with. Getting someone off the street to that level can be incredibly expensive and risky. Once you know how to do the whole thing, you could just quit and build for yourself.
One of these days we're going to learn our lesson and just write our own damned code.
One has to admit the game of cat and mouse that the web browser brought about has been quite valuable for advancing security as a field, unfortunately this sort of thing seems like we have to get burned to learn the pan is hot and mother warning us is not enough. Pay your security teams more, people.