Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Polyfill supply chain attack hits 100K+ sites

sansec.io

Post reply on HN
Print view View original

381–387 of 387 posts

Re: Polyfill supply chain attack hits 100K+ sites

#381

Post by creatonez »

delegate wrote: post #304

I don't think most people understand that although '100k+ sites are infected', the actual malware code runs on the visitors (our) machines, the servers themselves are fine ! I read the news yesterday and was 'yeah, that's too bad', but only later did it dawn on me that I'm the one that's potentially going to have to deal with the consequences. This needs to be mitigated client side, not rely on the good will of the a…

uBlock Origin had filters available within only a few hours of the discovery.

And most browsers already have a builtin domain blacklist via's google safe browsing list, but it's mostly for phishing pages rather than covering every single possibility.

Re: Polyfill supply chain attack hits 100K+ sites

#382

Post by Hightleyez »

peanut_worm wrote: post #306

I don’t understand why JS devs treat dependencies the way they do. If you are writing scripts that run on other people’s computers I feel like the dependencies used should be vetted for security constantly, and should be used minimally. Meanwhile most libraries seem to have 80 trillion dependencies written by random github accounts called “xihonghua” or something with no other projects on their account.

Combine that with electron and auto update everything

I've seen dev include scripts from templates when the app was for banks internal users and intranet only. They are clueless

Re: Polyfill supply chain attack hits 100K+ sites

#383

Post by skydhash »

prewett wrote: post #326
SV_BubbleTime wrote: post #53

Earlier quoted context omitted.

Real solution? We’re in a complexity crisis and almost no one sees it. It’s not just software dependencies of course. It’s everything almost everywhere. No joke, the Amish have a point. They were just a few hundred years too early.

Well, on the web side, it'd be a lot less complex if we weren't trying to write applications using a tool designed to create documents. If people compiled Qt to WASM (for instance), or for a little lighter weight, my in-development UI library [1] compiled to WASM, I think they'd find creating applications a lot more straightforward. [1] https://github.com/eightbrains/uitk

Most apps don’t need to be on the web. And the ones that need to be can be done with the document model instead of the app model. We added bundles of complexity to an already complex platform (the browser).

Re: Polyfill supply chain attack hits 100K+ sites

#384

Post by skydhash »

j1elo wrote: post #132
bryanlarsen wrote: post #113

Earlier quoted context omitted.

We've seen a lot more attacks succeed because somebody has vendored an old vulnerable library than supply chain attacks. Doing vendoring badly is worse than relying on upstream. Vendoring is part of the solution, but it isn't the solution by itself.

Not alone, no. That's how CI bots help a lot, such as Dependabot. Althought it's also worrying how we seemingly need more technologies on top of technologies just to keep a project alive. It used to be just including the system's patched header & libs, now we need extra bots surveying everything... Maybe a linux-distro-style of community dependency management would make sense. Keep a small group of maintainers busy w…

In the old ways, you mostly rely on a few libraries that each solve a complete problem and is backed by a proper community. The odd dependency is usually small and vendored properly. Security was mostly the environment concern (the OS) as the data is either client side or some properly managed enterprise infrastructure). Now we have npm with its microscopic and numerous packages, everyone wants to be on the web, and they all want your data.

Re: Polyfill supply chain attack hits 100K+ sites

#385

Post by skydhash »

ldoughty wrote: post #165
diego_sandoval wrote: post #158

The phrase "supply chain attack" makes it sound like it's some big, hard to avoid problem. But almost always, it's just developer negligence: 1. Developer allows some organization to inject arbitrary code in the developer's system 2. Organization injects malicious code 3. Developer acts all surprised and calls it an "attack" Maybe don't trust 3rd parties so much? There's technical means to avoid it. Calling this situ…

In this case, the developer sold the user account & repository for money (no ownership change to monitor).. so if you were not privy to that transaction, you really couldn't "easily" avoid this without e.g. forking every repo you depend on and bringing it in house or some other likely painful defense mechanism to implement

That’s why businesses pay Redhat, Qt, Unity,… Clear contracts that reduces the risk of compromised dependencies. Or you vet your dependencies (it helps when you don’t have a lot)

Re: Polyfill supply chain attack hits 100K+ sites

#386

Post by hatenberg »

robertlagrant wrote: post #344
lucianbr wrote: post #317

Earlier quoted context omitted.

Why did Facebook buy Instagram and Whatsapp? Why did Google buy Waze? Why did Volkswagen buy Audi and Skoda and Seat and Bentley and so on? Might as well ask why companies like money.

Sure, but the car industry is pretty old and there's plenty of competition still.

I’m not sure about plenty when you actually look at it, but in any case it’s because of government intervention.
Post reply on HN