Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Polyfill supply chain attack hits 100K+ sites

sansec.io

Post reply on HN
Print view View original

341–350 of 387 posts

Re: Polyfill supply chain attack hits 100K+ sites

#341

Post by bawolff »

progmetaldev wrote: post #142
hinkley wrote: post #107

Earlier quoted context omitted.

Aren't we also moving toward not even letting cross-origin scripts having very little access to information about the page? I read some stuff a couple years ago that gave me a very strong impression that running 3rd party scripts was quickly becoming an evolutionary dead end.

Definitely for browser extensions. It's become more difficult with needing to set up CORS, but like with most things that are difficult, you end up with developers that "open the floodgates" and allow as much as possible to get the job done without understanding the implications.

CORS is not required to run third party scripts. Cors is about reading data from third parties not executing scripts from third parties.

(Unless you set a Cross-Origin Resource Policy header, but that is fairly obscure)

Re: Polyfill supply chain attack hits 100K+ sites

#342

Post by aragonite »

aragonite wrote: post #332

Is there any evidence that whoever is currently behind polyfill.io is a "Chinese company," as most reports claim? The company known as "Funnull" appears to be based in the Philippines. The phone number associated with their WhatsApp and WeChat accounts has country code +63. Also they appear to be based at 30th Street, 14th Floor, Net Cube Center, E-Square Zone, Metro Manila, Taguig, Philippines at least if the inform…

Update: The Register has updated their article to be less committal. See the diff at https://www.diffchecker.com/W3wmc71w/

Re: Polyfill supply chain attack hits 100K+ sites

#343

Post by conartist6 »

ykonstant wrote: post #73
willcipriano wrote: post #65

Earlier quoted context omitted.

It's a competence crisis not a complexity one. https://www.palladiummag.com/2023/06/01/complex-systems-wont...

I see both, incentivized by the cowboy developer attitude.

Ironically I think you got that almost exactly wrong.

Avoiding "cowboyism" has instead lead to the rise of heuristics for avoiding trouble that are more religion than science. The person who is most competent is also likely to be the person who has learned lessons the hard way the most times, not the person who has been very careful to avoid taking risks.

And let me just say that there are VERY few articles so poorly written that I literally can't get past the first paragraph, and an article that cherry-picks disasters to claim generalized incompetence scores my very top marks for statistically incompetent disingenuous bullshit. There will always be a long tail of "bad stuff that happens" and cherry-picking all the most sensational disasters is not a way of proving anything.

Re: Polyfill supply chain attack hits 100K+ sites

#344

Post by robertlagrant »

lucianbr wrote: post #317
robertlagrant wrote: post #261

Earlier quoted context omitted.

> Which long term is not the default state in the market Why not?

Why did Facebook buy Instagram and Whatsapp? Why did Google buy Waze? Why did Volkswagen buy Audi and Skoda and Seat and Bentley and so on? Might as well ask why companies like money.

Sure, but the car industry is pretty old and there's plenty of competition still.

Re: Polyfill supply chain attack hits 100K+ sites

#345

Post by aembleton »

nneonneo wrote: post #263
aembleton wrote: post #251

Earlier quoted context omitted.

Why would the Chinese government use this to load a gambling website? I'm sure there are many better uses that would be more subtle that they could come up with this opportunity.

The problem is that they have a CDN that can serve up custom JS depending on the headers and IP of the visitor, which enables remarkably precise targeting. No reason why they couldn’t, for example, send a targeted payload to people in a specific geographic area (by IP) and/or a specific language (by Accept-Language header). The sports betting stuff could be diversion in that case. Of course, I don’t personally believ…

> No reason why they couldn’t, for example, send a targeted payload to people in a specific geographic area (by IP) and/or a specific language (by Accept-Language header). The sports betting stuff could be diversion in that case.

What I don't understand is why blow it sending people to a gambling site? They could have kept it going and sent payloads to specific targets making use of zero day browser bugs. Now they can still do that but to far fewer sites.

Re: Polyfill supply chain attack hits 100K+ sites

#346

Post by commandlinefan »

creshal wrote: post #285
commandlinefan wrote: post #269

One of these days we're going to learn our lesson and just write our own damned code.

Or just ship local copies of your dependencies. It's not that hard.

... and all of _their_ dependencies. And read through them all to make sure that the local copy that you shipped didn't actually include a deliberately obfuscated exfiltration routine.

Re: Polyfill supply chain attack hits 100K+ sites

#347

Post by vikramkr »

ChrisMarshallNY wrote: post #282
hyperhopper wrote: post #275

Earlier quoted context omitted.

Then you get to write 10x the vulnerabilities yourself and not have nearly the same chance of any of them getting disclosed to you!

That argument doesn't seem to be aging well. I'd say that good [emphasis on " good "] coders can write very secure code. There's fundamental stuff, like encryption algos, that should be sourced from common (well-known and trusted) sources, but when we load in 100K of JS, so we can animate a disclosure triangle, I think it might not be a bad time to consider learning to do that, ourselves.

It's impossible to tell how that argument is aging since we don't have the counterfactual.

Re: Polyfill supply chain attack hits 100K+ sites

#348

Post by Sephr »

linclark wrote: post #198
yesimahuman wrote: post #32

Earlier quoted context omitted.

Does this person telling us not to use polyfill.io, and the guy who sold polyfill.io to the chinese company both work at Fastly? If so, that's kind of awkward...

Neither of them had ownership of the project, so neither of them were responsible for the sale or benefited from it. They both simply dedicated a lot of time, care and skill to the project. It's really a shame to see what they spent so much time building and maintaining now being used as a platform to exploit people. I'm sure its extremely disappointing to both of them.

Funnull claims that Jake Champion owned the project and transferred it to them as part of an acquisition agreement[1].

1. https://x.com/JFSIII/status/1761385341951361182

Re: Polyfill supply chain attack hits 100K+ sites

#349

Post by sofixa »

trekz wrote: post #260
program_whiz wrote: post #43

Earlier quoted context omitted.

in a strange way, this almost makes the behavior of hopping onto every new framework rational. The older and less relevant the framework, the more the owner's starry-eyed enthusiasm wears off. The hope that bigcorp will pay $X million for the work starts to fade. The tedium of bug fixes and maintenance wears on, the game theory takes it's toll. The only rational choice for library users is to jump ship once the numbe…

> in a strange way, this almost makes the behavior of hopping onto every new framework rational. Or maybe not doing that and just using native browser APIs? Many of these frameworks are overkill and having so many "new" ones just makes the situation worse.

Many of them predate those native browser APIs. Pollyfills, the topic at hand, were literally created to add modern APIs to all browsers equally (most notably old Safaris, Internet Explorers, etc.).

Re: Polyfill supply chain attack hits 100K+ sites

#350

Post by nullc »

peanut_worm wrote: post #306

I don’t understand why JS devs treat dependencies the way they do. If you are writing scripts that run on other people’s computers I feel like the dependencies used should be vetted for security constantly, and should be used minimally. Meanwhile most libraries seem to have 80 trillion dependencies written by random github accounts called “xihonghua” or something with no other projects on their account.

and Meanwhile Meanwhile, years after it was well known that the JS dependency model was an utter security disaster the rust ecosystem went on to copy it.
Post reply on HN