Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Polyfill supply chain attack hits 100K+ sites

sansec.io

Post reply on HN
Print view View original

371–380 of 387 posts

Re: Polyfill supply chain attack hits 100K+ sites

#371

Post by ttyprintk »

alephnerd wrote: post #119
ttyprintk wrote: post #89

Earlier quoted context omitted.

Would an unwisely-configured site template or generator explain the scale here? Or, a malicious site template or generator purposefully sprinkling potential backdoors for later?

But wouldn't some sort of SCA/SAST/DAST catch that? Like if I'm importing a site template, ideally I'd be verifying either it's source or it's source code as well. (Not being facetious btw - genuinely curious)

I was hoping ongoing coverage would answer that; it sounds like a perfect example. I heard that the tampered code redirects traffic to a sports betting site.

Re: Polyfill supply chain attack hits 100K+ sites

#372

Post by antifa »

can16358p wrote: post #8
jstanley wrote: post #3

Always host your dependencies yourself, it's easy to do & even in the absence of a supply chain attack it helps to protect your users' privacy.

But if the dependency from a CDN is already cached, it will skip an extra resource and site will load faster. I agree with the points though.

This theory gets parroted endlessly, but nearly never actually happens in reality.

Re: Polyfill supply chain attack hits 100K+ sites

#374

Post by astrange »

PaulHoule wrote: post #153
UweSchmidt wrote: post #121

Earlier quoted context omitted.

A more fundamental reason is that society is no longer interested in pushing forward at all cost. It's the arrival at an economical and technological equilibrium where people are comfortable enough, along with the end of the belief in progress as an ideology, or way to salvation somewhere during the 20th century. If you look closely, a certain kind of relaxation has replaced a quest for efficiency everywhere. Is that…

My own interpretation of the business cycle is that growth cause externalities that stop growth. Sometimes you get time periods like the 1970s where efforts to control externalities themselves would cause more problems than they solved, at least some of the time. (e.g. see the trash 1974 model year of automobiles where they hadn’t figured out how to make emission controls work.) I’d credit the success of Reagan in th…

> My own interpretation of the business cycle is that growth cause externalities that stop growth.

The evidence seems to be against this.

https://eml.berkeley.edu/~enakamura/papers/plucking.pdf

Re: Polyfill supply chain attack hits 100K+ sites

#375

Post by astrange »

rytor718 wrote: post #187
irskep wrote: post #81

Earlier quoted context omitted.

I'm predisposed to agree with the diagnosis that incompetence is ruining a lot of things, but the article boils down to "diversity hiring is destroying society" and seems to attribute a lot of the decline to the Civil Rights Act of 1964. Just in case anybody's wondering what they would get from this article. > By the 1960s, the systematic selection for competence came into direct conflict with the political imperativ…

Thank you for summarizing (I actually read the whole article before seeing your reply and might have posted similar thoughts). I get the appeal of romanticizing our past as a country, looking back at the post-war era, especially the space race with a nostalgia that makes us imagine it was a world where the most competent were at the helm. But it just wasn't so, and still isn't. Many don't understand that the Civil Ri…

The word "meritocracy" was invented for a book about how it's a bad idea that can't work, so I'd recommend not trying to have one. "Merit" doesn't work because of Goodhart's law.

I also feel like you'd never hire junior engineers or interns if you were optimizing for it, and then you're either Netflix or you don't have any senior engineers.

Re: Polyfill supply chain attack hits 100K+ sites

#376

Post by defrost »

astrange wrote: post #375
rytor718 wrote: post #187

Earlier quoted context omitted.

Thank you for summarizing (I actually read the whole article before seeing your reply and might have posted similar thoughts). I get the appeal of romanticizing our past as a country, looking back at the post-war era, especially the space race with a nostalgia that makes us imagine it was a world where the most competent were at the helm. But it just wasn't so, and still isn't. Many don't understand that the Civil Ri…

The word "meritocracy" was invented for a book about how it's a bad idea that can't work, so I'd recommend not trying to have one. "Merit" doesn't work because of Goodhart's law. I also feel like you'd never hire junior engineers or interns if you were optimizing for it, and then you're either Netflix or you don't have any senior engineers.

FWiW Michael Young, Baron Young of Dartington, the author of the 1958 book The Rise of the Meritocracy popularised the term which rapidly lost the negative connotations he put upon it.

He didn't invent the term though, he lifted it from an earlier essay by another British sociologist Alan Fox who apparently coined it two years earlier in a 1956 essay.

https://en.wikipedia.org/wiki/The_Rise_of_the_Meritocracy

Re: Polyfill supply chain attack hits 100K+ sites

#377

Post by tentacleuno »

ok123456 wrote: post #23
fkyoureadthedoc wrote: post #16

Earlier quoted context omitted.

yes you just put integrity="sha384-whatever" and you're good to go

Can't do that with this one because it generates the polyfill based on the user agent.

Why not? The `integrity` attribute accepts more than one value[0].

This would technically be feasible, if my understanding of the service is correct. Hashes could be recorded for each combination of feature -- you could then give those list of hashes to the user to insert into the attribute.

Of course, the main difficulty here would be the management of individual hashes. Hmm, definitely interesting stuff.

[0]: https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

Re: Polyfill supply chain attack hits 100K+ sites

#378

Post by delfinom »

tentacleuno wrote: post #377
ok123456 wrote: post #23

Earlier quoted context omitted.

Can't do that with this one because it generates the polyfill based on the user agent.

Why not? The `integrity` attribute accepts more than one value[0]. This would technically be feasible, if my understanding of the service is correct. Hashes could be recorded for each combination of feature -- you could then give those list of hashes to the user to insert into the attribute. Of course, the main difficulty here would be the management of individual hashes. Hmm, definitely interesting stuff. [0]: https…

We are talking potentially hundreds of hashes because of how the polyfills service worked.

Re: Polyfill supply chain attack hits 100K+ sites

#380

Post by tentacleuno »

delfinom wrote: post #378
tentacleuno wrote: post #377

Earlier quoted context omitted.

Why not? The `integrity` attribute accepts more than one value[0]. This would technically be feasible, if my understanding of the service is correct. Hashes could be recorded for each combination of feature -- you could then give those list of hashes to the user to insert into the attribute. Of course, the main difficulty here would be the management of individual hashes. Hmm, definitely interesting stuff. [0]: https…

We are talking potentially hundreds of hashes because of how the polyfills service worked.

That depends on how many polyfills are served via each script.
Post reply on HN