cross-posted from: https://programming.dev/post/16106778

Contrary to what is stated on the polyfill.io website, Cloudflare has never recommended the polyfill.io service or authorized their use of Cloudflare’s name on their website. We have asked them to remove the false statement, and they have, so far, ignored our requests. This is yet another warning sign that they cannot be trusted.

  • Moonrise2473@feddit.it
    link
    fedilink
    arrow-up
    6
    ·
    4 months ago

    It’s always a danger when a malicious company purchases a famous open source project.

    Like that israeli adware company that bought simple mobile tools

        • The Cuuuuube@beehaw.org
          link
          fedilink
          English
          arrow-up
          2
          ·
          4 months ago

          I feel for the guy. Had health issues and needed money fast. I kinda don’t blame him. Like I get its disappointing and I also won’t blame people being mad at him, but I’m more mad at the overall system of how things get funding

          • Moonrise2473@feddit.it
            link
            fedilink
            arrow-up
            3
            ·
            4 months ago

            I’d also have accepted the money if I were him but at least I would have wrote a blog post explaining the situation, that now the apps are dead and controlled by a bad actor and need to get uninstalled as soon as possible.

            Not almost denying it while continuing to get money on his Patreon from unaware users

  • Avid Amoeba@lemmy.ca
    link
    fedilink
    arrow-up
    5
    arrow-down
    3
    ·
    4 months ago

    Nice. Unfortunately this won’t tackle the mountains of sites that use bundlers.

    • valaramech@fedia.io
      link
      fedilink
      arrow-up
      11
      ·
      4 months ago

      Direct linking via a specific CDN was the problem. This is solved by bundlers, not caused by it.

      The polyfill.js is a popular open source library to support older browsers. 100K+ sites embed it using the cdn.polyfill.io domain. … However, in February this year, a Chinese company bought the domain and the Github account. Since then, this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io.

      • Avid Amoeba@lemmy.ca
        link
        fedilink
        arrow-up
        3
        arrow-down
        1
        ·
        edit-2
        4 months ago

        I read the story and specifically the bit about the Github account. Isn’t this the Polyfill lib’s Github account? Because if that’s the case, how would a bundler solve the issue? The new owners could modify the original source, then the CICD jobs would happily publish that to registries and from there down into the bundles. Is it a different Github account they’re talking about?

        • i_am_not_a_robot@discuss.tchncs.de
          link
          fedilink
          English
          arrow-up
          4
          ·
          4 months ago

          Code pulled from GitHub or NPM can be audited and it behaves consistently after it has been copied. If the code has a high reputation and gets incorporated into bundles, the code in the bundles doesn’t change. If the project becomes malicious, only recently created bundles are affected. This code is pulled from polyfill.io every time somebody visits the page and recently polyfill.io has been hijacked to sometimes send malicious code instead. Websites that have been up for years can be affected by this.

          • Avid Amoeba@lemmy.ca
            link
            fedilink
            arrow-up
            1
            arrow-down
            1
            ·
            4 months ago

            Perfect. This is consistent with what I was thinking and that Cloudflare’s changes won’t fix any recent bundles that might include malicious code.

            • i_am_not_a_robot@discuss.tchncs.de
              link
              fedilink
              English
              arrow-up
              2
              arrow-down
              1
              ·
              4 months ago

              Built bundles are not affected. The service is supposed to figure out which polyfills are required by a particular browser and serve different scripts. Because it’s serving different scripts, the scripts cannot be bundled or secured using SRI. That would defeat the purpose of the service.