72
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 27 Jun 2024
72 points (97.4% liked)
Technology
33579 readers
239 users here now
This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.
Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.
Rules:
1: All Lemmy rules apply
2: Do not post low effort posts
3: NEVER post naziped*gore stuff
4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.
5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)
6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist
7: crypto related posts, unless essential, are disallowed
founded 5 years ago
MODERATORS
Nice. Unfortunately this won't tackle the mountains of sites that use bundlers.
Direct linking via a specific CDN was the problem. This is solved by bundlers, not caused by it.
I read the story and specifically the bit about the Github account. Isn't this the Polyfill lib's Github account? Because if that's the case, how would a bundler solve the issue? The new owners could modify the original source, then the CICD jobs would happily publish that to registries and from there down into the bundles. Is it a different Github account they're talking about?
Code pulled from GitHub or NPM can be audited and it behaves consistently after it has been copied. If the code has a high reputation and gets incorporated into bundles, the code in the bundles doesn't change. If the project becomes malicious, only recently created bundles are affected. This code is pulled from polyfill.io every time somebody visits the page and recently polyfill.io has been hijacked to sometimes send malicious code instead. Websites that have been up for years can be affected by this.
Perfect. This is consistent with what I was thinking and that Cloudflare's changes won't fix any recent bundles that might include malicious code.
Built bundles are not affected. The service is supposed to figure out which polyfills are required by a particular browser and serve different scripts. Because it's serving different scripts, the scripts cannot be bundled or secured using SRI. That would defeat the purpose of the service.