3 ms·

If you're using Polyfill.io code on your site – remove it immediately

131 points by moose44 2y ago

Crespyl 2y ago
Other discussion: https://news.ycombinator.com/item?id=40791829 https://news.ycombinator.com/item?id=40791829
- dang 2y ago
  Comments moved thither. Thanks!
ChrisArchitect 2y ago
[dupe] Lots of discussion: https://news.ycombinator.com/item?id=40791829 https://news.ycombinator.com/item?id=40791829
- gunapologist99 2y ago
  It's still an important PSA
  - ChrisArchitect 2y ago
    yep, which many have read and are discussing, over there.
jampekka 2y ago
When the "right way" is harder than the "wrong way", you are guaranteed to get things done the "wrong way". CDNs are used, because not using CDNs is made unnecessarily hard. Want a local version locked copy? Select one of the dozen mutually incompatible package managers. Then select one of the dozen buggy and slow mutually incompatibile build systems. Then rewrite your app for CJS or ESM depending on the library, because ESM was made purposefully incompatible. Want to use a CDN? Copy and paste this one line in your HTML.
- aembleton 2y ago
  Can't you just download the js file and save it next to your html files and then link to it from your html?
  - jampekka 2y ago
    For many assets yes, and it's something I do quite regularly. But many assets (especially CSS) rely on relative files - and we have apparently collectively decided that directories or other bunches or files is somehow a totally different thing than a file and need fundamentaly different logic - so just using the CDN makes you not have to worry about this.
  - rawbot 2y ago
    Yes, of course. I think he means all the to manage a big project's dependencies. For a small or static website, you could manage all of those manually.
spacebanana7 2y ago
>Polyfill.io is used by academic library JSTOR as well as Intuit, World Economic Forum, and tons more. > Since February, "this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io," This kind of attack seems difficult to detect and ruthlessly effective. Imagine how much money they could've made by selling fake Davos tickets.
deleted 2y ago
[deleted]

131 points by moose44 2y ago

Crespyl 2y ago

Other discussion: https://news.ycombinator.com/item?id=40791829 https://news.ycombinator.com/item?id=40791829

dang 2y ago
Comments moved thither. Thanks!

ChrisArchitect 2y ago

[dupe] Lots of discussion: https://news.ycombinator.com/item?id=40791829 https://news.ycombinator.com/item?id=40791829

gunapologist99 2y ago
It's still an important PSA
- ChrisArchitect 2y ago
  yep, which many have read and are discussing, over there.

jampekka 2y ago

When the "right way" is harder than the "wrong way", you are guaranteed to get things done the "wrong way". CDNs are used, because not using CDNs is made unnecessarily hard. Want a local version locked copy? Select one of the dozen mutually incompatible package managers. Then select one of the dozen buggy and slow mutually incompatibile build systems. Then rewrite your app for CJS or ESM depending on the library, because ESM was made purposefully incompatible. Want to use a CDN? Copy and paste this one line in your HTML.

aembleton 2y ago
Can't you just download the js file and save it next to your html files and then link to it from your html?
- jampekka 2y ago
  For many assets yes, and it's something I do quite regularly. But many assets (especially CSS) rely on relative files - and we have apparently collectively decided that directories or other bunches or files is somehow a totally different thing than a file and need fundamentaly different logic - so just using the CDN makes you not have to worry about this.
- rawbot 2y ago
  Yes, of course. I think he means all the to manage a big project's dependencies. For a small or static website, you could manage all of those manually.

spacebanana7 2y ago

>Polyfill.io is used by academic library JSTOR as well as Intuit, World Economic Forum, and tons more. > Since February, "this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io," This kind of attack seems difficult to detect and ruthlessly effective. Imagine how much money they could've made by selling fake Davos tickets.

deleted 2y ago

[deleted]