They are denying everything on their Twitter @Polyfill_Global lol
Polyfill supply chain attack hits 100K+ sites
161–170 of 387 posts
Re: Polyfill supply chain attack hits 100K+ sites
#162Earlier quoted context omitted.
Directly security-focused products like lastpass are the only things that have any market pressure whatsoever on this, and that's because they're niche products for which the security is the only value-add, marketed to explicitly security-conscious people and not insulated by a whole constellation of lock-in services. The relevant security threats for the overwhelming majority of people and organizations are breaches…
I wouldn’t point to LastPass as an exemplar… https://www.theverge.com/2024/5/1/24146205/lastpass-independ...
I didn't, and my point was exactly that it's not a great one, so I think we largely agree here
Re: Polyfill supply chain attack hits 100K+ sites
#163Earlier quoted context omitted.
I always prefer to self-host my dependencies, but as a developer who prefer to avoid an npm-based webpack/whatever build pipeline it's often WAY harder to do that than I'd like. If you are the developer of an open source JavaScript library, please take the time to offer a downloadable version of it that works without needing to run an "npm install" and then fish the right pieces out of the node_modules folder. jQuery…
> I always prefer to self-host my dependencies Js dependencies should be pretty small compared to images or other resources. Http pipelining should make it fast to load them from your server with the rest The only advantage to using one of those cdn-hosted versions is that it might help with browser caching
nope, browsers silo cache to prevent tracking via cached resources
Re: Polyfill supply chain attack hits 100K+ sites
#164Earlier quoted context omitted.
It's a competence crisis not a complexity one. https://www.palladiummag.com/2023/06/01/complex-systems-wont...
We haven’t gotten smarter or dumber. But we have exceeded our ability to communicate the ideas and concepts, let alone the instructions of how to build and manage things. Example: a junior Jiffy Lube high school dropout in 1960 could work hard and eventually own that store. Everything he would ever need to know about ICE engines was simple enough to understand over time… but now? There are 400 oil types, there are cl…
Boeing is a kickbacks company in a really strange way. They get contracts based on including agreements to source partly from the contracties local area. Adding complexity for contracts and management bonus sake, not efficiency, not redundancy, not expertise. Add onto that a non-existent safety culture and a non-manufacturing/non-aerospace focused management philosophy grafting on from a company that failed and had to be merged into Boeing replacing the previous Boeing management philosophy. Enshitifaction in every area of the company. Heck they moved headquarters from Seattle to Chicago, and now from Chicago to DC. Prioritizing being where the grift is over, you know, being where the functions of the company are so that management has a daily understanding of what the company does. Because to management what the company does is win contracts, not build aerospace products. 'Someone else' takes care of that detail, according to Boeing management. Building those products in now secondary/tertiary to management.
I did ERP/MPR/EBOM/MBOM/BOM systems for aerospace. We have that stuff down. We have systems for this kind of communication down really well. We can build within a small window an airplane with thousands of parts with lead times from 1 day to 3 months to over a year for certain custom config options, with each parts design/FAA approval/manufacturing/installation tracked and audited. Boeing's issue is culture, not humanity's ability to make complex systems.
But I do agree that there is a complexity issue in society in general, and a lot of systems are coasting on the efforts of those that originally put them in place/designed them. A lot of government seems to be this way too. There's also a lot of overhead for overheads sake, but little process auditing/iterative improvement style management.
Re: Polyfill supply chain attack hits 100K+ sites
#165The phrase "supply chain attack" makes it sound like it's some big, hard to avoid problem. But almost always, it's just developer negligence: 1. Developer allows some organization to inject arbitrary code in the developer's system 2. Organization injects malicious code 3. Developer acts all surprised and calls it an "attack" Maybe don't trust 3rd parties so much? There's technical means to avoid it. Calling this situ…
In this case, the developer sold the user account & repository for money (no ownership change to monitor).. so if you were not privy to that transaction, you really couldn't "easily" avoid this without e.g. forking every repo you depend on and bringing it in house or some other likely painful defense mechanism to implement
Re: Polyfill supply chain attack hits 100K+ sites
#166Important context given by the author of polyfill: > If your website uses http://polyfill.io , remove it IMMEDIATELY. I created the polyfill service project but I have never owned the domain name and I have had no influence over its sale. (1) Although I wonder how the GitHub account ownership was transferred. (1) https://x.com/triblondon/status/1761852117579427975
Does this person telling us not to use polyfill.io, and the guy who sold polyfill.io to the chinese company both work at Fastly? If so, that's kind of awkward...
It appears both currently do work for Fastly. I am pleased the Fastly developer advocate warned us, and announced a fork and alternative hosting service:
[1] https://community.fastly.com/t/new-options-for-polyfill-io-u...
But it leaves me with an uneasy feeling about Fastly.
Re: Polyfill supply chain attack hits 100K+ sites
#167Earlier quoted context omitted.
It seems when proprietary resources get infected it's because hackers are the problem, but when open source resources get infected its a problem with open source. But there isn't any particular reason why a paid/proprietary host couldn't just as easily end up being taken over / sold to a party intending to inject malware. It happens all the time really.
agreed, but if a company is making millions for the security of software, the incentive is to keep it secure so customers stick with it. Remember the lastpass debacle, big leak and lost many customers...
I think for some reason some people still buy cisco products, so this reasoning doesn't seem to be applicable to the real world.
Re: Polyfill supply chain attack hits 100K+ sites
#168Earlier quoted context omitted.
> I guess my question is why your employer or any other org would not follow the model above? When you look at Artifactory pricing you ask yourself 'why should I pay them a metric truckload of money again?' And then dockerhub goes down. Or npm. Or pypi. Or github... or, worst case, this thread happens.
I just gave Artifactory as an example. What about GHE, self-hosted GitLab, or your own in-house Git? Edit: was thinking - would be a pain in the butt to manage. That tracks, but every org ik has some corporate versioning system that also has an upsell for source scanning. (Not being facetious btw - genuinely curious)
I've been a part of a team which had to manage a set of geodistributed Artifactory clusters and it was a pain in the butt to manage, too - but these were self-hosted. At a certain scale you have to pick the least worst solution though, Artifactory seems to be that.
Re: Polyfill supply chain attack hits 100K+ sites
#169Name and shame the sports betting site
Name and shame people who put unwarranted trust in third parties to save 2ms on their requests.
Re: Polyfill supply chain attack hits 100K+ sites
#170Earlier quoted context omitted.
I'm so glad to find some sane voices here! I mean, sure, if you're really serving a lot of traffic to Mombasa, akamai will reduce latency. You could also try to avoid multi megabyte downloads for a simple page.
Content: 50KB Images: 1MB Javascript: 35MB Fonts: 200KB Someone who is good at the internet please help me budget this. My bounce rate is dying.
What's all that JavaScript for?