Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Polyfill supply chain attack hits 100K+ sites

sansec.io

Post reply on HN
Print view View original

351–360 of 387 posts

Re: Polyfill supply chain attack hits 100K+ sites

#351

Post by shaldengeki »

Sephr wrote: post #348
linclark wrote: post #198

Earlier quoted context omitted.

Neither of them had ownership of the project, so neither of them were responsible for the sale or benefited from it. They both simply dedicated a lot of time, care and skill to the project. It's really a shame to see what they spent so much time building and maintaining now being used as a platform to exploit people. I'm sure its extremely disappointing to both of them.

Funnull claims that Jake Champion owned the project and transferred it to them as part of an acquisition agreement[1]. 1. https://x.com/JFSIII/status/1761385341951361182

The Internet Archive shows the progression of events pretty clearly.

- In ~May 2023, the FT transferred it to Jake Champion: https://web.archive.org/web/20230505112634/https://polyfill....

- In mid-Oct, the site stated it was "Proudly sponsored by Fastly": https://web.archive.org/web/20231011015804/https://polyfill....

- In November 2023, this was dropped: https://web.archive.org/web/20231101040617/https://polyfill....

- In December 2023, JakeChampion made a sequence of edits removing his name from the repo and pointing to "Polyfill.io maintainers": https://github.com/polyfillpolyfill/polyfill-service/commit/... https://github.com/polyfillpolyfill/polyfill-service/commit/...

- In mid-February 2024, the polyfillpolyfill account was created on Github, and took ownership over the repo.

So I think sometime between October 2023 and February 2024, JakeChampion decided to sell the site to Funnull. I think the evidence is consistent with him having made a decision to sell the site to _somebody_ in December 2023, and the deal with Funnull closing sometime early February 2024.

Re: Polyfill supply chain attack hits 100K+ sites

#352

Post by bonestamp2 »

simonw wrote: post #206
bonestamp2 wrote: post #157

Earlier quoted context omitted.

> prefer to avoid an npm-based webpack/whatever build pipeline What kind of build pipeline do you prefer, or are you saying that you don't want any build pipeline at all?

I don't want a build pipeline. I want to write some HTML with a script type=module tag in it with some JavaScript, and I want that JavaScript to load the ES modules it depends on using import statements (or dynamic import function calls for lazy loading).

Do you not use CSS preprocessors or remote map files or anything like that... or do you just deal with all of that stuff manually instead of automating it?

Re: Polyfill supply chain attack hits 100K+ sites

#353

Post by BandButcher »

ravenstine wrote: post #125
program_whiz wrote: post #76

Earlier quoted context omitted.

I'm afraid this is hitting on the other end of inviolable game theory laws. Dev who is paid for features and business value wants to read line-by-line random package that is upgrading from version 0.3.12 to 0.3.13 in a cryptography or date lib that they likely don't understand? And this should be done for every change of every library for all software, by all devs who will always be responsible, not lazy, and very at…

Correct. I don't think I have ever seen sound engimeering decisions being rewarded at any business I have worked for. The only reason any sound decisions are made is that some programmers take the initiative, but said initiative rarely comes with a payoff and always means fighting with other programmers who have a fetish for complexity. If only programmers had to take an ethics oath so they have an excuse not to just…

lmao you jogged a memory in my brain... in my senior final semester in college, our professor had us agree to the IEEE Code of Ethics:

https://www.computer.org/education/code-of-ethics

In retrospect I can say I've held up for the most part, but in some cases have had to quit certain jobs due to overwhelming and accelerating nonsense.

usually its best for your mental well to just shut up and get paid ;)

Re: Polyfill supply chain attack hits 100K+ sites

#354

Post by BandButcher »

hannob wrote: post #39
stusmall wrote: post #6

I'm surprised there is no mention of subresource integrity in the article. It's a low effort, high quality mitigation for almost any JS packages hosted by a CDN. EDIT: Oh, it's because they are selling something. I don't know anything about their offerings, but SRI is made for this and is extremely effective.

In all cases where you can use SRI, there's a better mitigation: Just host a copy of the file yourself.

I would still (and do) do both, in the case that your site (for whatever reason) is still under/or simply accessible to HTTP, then a man in the middle attack could still happen and replace your script with another.

For self hosted dynamic scripts, I just add a task in my build process to calc the sha and add it to the

Otherwise just calc it and hardcode it once for 3rd party, legacy scripts...

Re: Polyfill supply chain attack hits 100K+ sites

#355

Post by BandButcher »

insane_dreamer wrote: post #266

> However, in February this year, a Chinese company bought the domain and the Github account. Github accounts of open source software are now for sale?

sadly everyone has a price, its pretty much tech real estate

many js devs have used that on their resumes/portfolio - "I own a 10-line library downloaded over 1 billion times!"

^^ pretty easy target to poach github accounts for mass malware spreading.

Re: Polyfill supply chain attack hits 100K+ sites

#356

Post by remram »

tracker1 wrote: post #101
baobabKoodaa wrote: post #86

Earlier quoted context omitted.

I'm genuinely puzzled that a group with the ability to hijack 100k+ websites can think of nothing more lucrative to do than this.

Even with low rates, my first thought would probably be crypto mining via wasm. I'd never do it, but would have been less noticeable.

Or DDoS, residential proxy, product reviews... one would really think there'd be something more lucrative to sell.

Re: Polyfill supply chain attack hits 100K+ sites

#357

Post by chefandy »

dr_kiszonka wrote: post #309
chefandy wrote: post #274

I think JS (well, ES6) has a ton of positive qualities, and I think it's a great fit for many of its current applications. However, this is a pretty good example of what bothers me about the way many people use it. I see a lot of folks, in the name of pragmatism, adopt a ton of existing libraries and services so they don't have to think about more complex parts of the problem they're solving. Great! No need to reinve…

I wonder if anyone would be willing to pay for a service that vets and hosts (a very small subset) of popular JS libraries.

Maybe! Add in package management that isn't a complete clusterfustrum and that could be pretty attractive. Cloudron basically does something similar with FOSS server apps.

Re: Polyfill supply chain attack hits 100K+ sites

#358

Post by fragmede »

bob1029 wrote: post #319
chefandy wrote: post #274

I think JS (well, ES6) has a ton of positive qualities, and I think it's a great fit for many of its current applications. However, this is a pretty good example of what bothers me about the way many people use it. I see a lot of folks, in the name of pragmatism, adopt a ton of existing libraries and services so they don't have to think about more complex parts of the problem they're solving. Great! No need to reinve…

I have been full stack for the last decade. Vanilla JS and server-side rendering is about all I can tolerate these days. I will reach for Ajax or websockets if needed, but 90%+ of all interactions I've ever had to deal with are aptly handled with a multipart form post. I do vendor my JS, but only for things like PDF processing, 3D graphics, and barcode scanning. I've been through the framework gauntlet. Angular, Riot…

Build what? Sell to whom? What, write my own subscription/billing module, on top of full stack development which, as you said, takes a lot of time just to be competent at. on top of building it, do sales and marketing and accounting and all that other business stuff? I mean, I guess

Re: Polyfill supply chain attack hits 100K+ sites

#359

Post by chefandy »

treflop wrote: post #321
chefandy wrote: post #274

I think JS (well, ES6) has a ton of positive qualities, and I think it's a great fit for many of its current applications. However, this is a pretty good example of what bothers me about the way many people use it. I see a lot of folks, in the name of pragmatism, adopt a ton of existing libraries and services so they don't have to think about more complex parts of the problem they're solving. Great! No need to reinve…

I remember Google suggesting that everyone use common libraries hosted by a shared CDN and then suggesting de-ranking slow websites and I think that’s what led to widespread adoption of this pattern. The only reason I stopped using third-party hosted libraries was because it wasn’t worth the trouble. Using subresource integrity makes it safe but it was part of the trouble.

Sure... Though while I hate to say it, I don't blame people for trusting Google's hosted copy of something. For better or worse, they are more trustworthy than some "as seen on a million janky tutorials" whatever.io. A very privacy-focused employer precluded that possibility during peak adoption, but with what many sites load up, that's the least of your worries.

Re: Polyfill supply chain attack hits 100K+ sites

#360

Post by [deleted] »

fragmede wrote: post #358
bob1029 wrote: post #319

Earlier quoted context omitted.

I have been full stack for the last decade. Vanilla JS and server-side rendering is about all I can tolerate these days. I will reach for Ajax or websockets if needed, but 90%+ of all interactions I've ever had to deal with are aptly handled with a multipart form post. I do vendor my JS, but only for things like PDF processing, 3D graphics, and barcode scanning. I've been through the framework gauntlet. Angular, Riot…

Build what? Sell to whom? What, write my own subscription/billing module, on top of full stack development which, as you said, takes a lot of time just to be competent at. on top of building it, do sales and marketing and accounting and all that other business stuff? I mean, I guess

[deleted]
Post reply on HN