cross-posted from: https://programming.dev/post/16106778
Contrary to what is stated on the polyfill.io website, Cloudflare has never recommended the polyfill.io service or authorized their use of Cloudflare’s name on their website. We have asked them to remove the false statement, and they have, so far, ignored our requests. This is yet another warning sign that they cannot be trusted.
Whenever I see those “All the companies that use us” banner, I shrug.
If I was a scammer, why wouldn’t I include a dozen companies?
It’s always a danger when a malicious company purchases a famous open source project.
Like that israeli adware company that bought simple mobile tools
Reminds me, I should donate to Fossify
I donated to the Tibor guy and I feel betrayed for how he managed the situation
I feel for the guy. Had health issues and needed money fast. I kinda don’t blame him. Like I get its disappointing and I also won’t blame people being mad at him, but I’m more mad at the overall system of how things get funding
I’d also have accepted the money if I were him but at least I would have wrote a blog post explaining the situation, that now the apps are dead and controlled by a bad actor and need to get uninstalled as soon as possible.
Not almost denying it while continuing to get money on his Patreon from unaware users
Nice. Unfortunately this won’t tackle the mountains of sites that use bundlers.
Direct linking via a specific CDN was the problem. This is solved by bundlers, not caused by it.
The polyfill.js is a popular open source library to support older browsers. 100K+ sites embed it using the cdn.polyfill.io domain. … However, in February this year, a Chinese company bought the domain and the Github account. Since then, this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io.
I read the story and specifically the bit about the Github account. Isn’t this the Polyfill lib’s Github account? Because if that’s the case, how would a bundler solve the issue? The new owners could modify the original source, then the CICD jobs would happily publish that to registries and from there down into the bundles. Is it a different Github account they’re talking about?
Code pulled from GitHub or NPM can be audited and it behaves consistently after it has been copied. If the code has a high reputation and gets incorporated into bundles, the code in the bundles doesn’t change. If the project becomes malicious, only recently created bundles are affected. This code is pulled from polyfill.io every time somebody visits the page and recently polyfill.io has been hijacked to sometimes send malicious code instead. Websites that have been up for years can be affected by this.
Perfect. This is consistent with what I was thinking and that Cloudflare’s changes won’t fix any recent bundles that might include malicious code.
Built bundles are not affected. The service is supposed to figure out which polyfills are required by a particular browser and serve different scripts. Because it’s serving different scripts, the scripts cannot be bundled or secured using SRI. That would defeat the purpose of the service.
