3 ms·

Namecheap Takes Down Polyfill.io Service Following Supply Chain Attack

42 points by feross 2y ago

arresin 2y ago
> Polyfill.io has been serving malware for months via its CDN, after the project's open source maintainer sold the service to a company based in China. Nobody could have predicted this /s
gary_0 2y ago
Out of curiosity, does anyone know of any other cases of registrars taking down domains for serving malware? Is this a common practice?
- KomoD 2y ago
  Namecheap does it a ton, probably the most responsive registrar when it comes to abuse. Typically with registrars I just get told to take it up with the hosting provider instead. I've also been told by registrars they just won't act without a warrant.
- altairprime 2y ago
  I assume it happens all the time for investigations; for example, those headed by Microsoft’s anti-malware team, which posts often enough about such takedowns. Domain registrars do have terms of service that can be enforced against malware sites. > Namecheap expressly reserves the right to deny, cancel, terminate, suspend, lock, or modify access to (or control of) any account or any Services (including the right to cancel or transfer any domain name registration) for any reason (as determined by Namecheap in its sole and absolute discretion
ryan29 2y ago
They criticize Namecheap for being slow, but is 1 day slow? Who here would pull the plug on a domain relied on by hundreds of thousands of sites faster than that? I get the desire to shut it down instantly, but do we really want registrars taking domains offline in less than a day? There’s got to be significant liability concerns when you’re doing something that could impact hundreds of thousands of sites. It’s kind of a tough spot to be in, isn’t it?
- KomoD 2y ago
  Definitely not slow, also as we speak the "googie-anaiytics" registered with Godaddy is still active.
  - riiii 2y ago
    As long as GD is getting paid their fees I think they DGAF.
- poikroequ 2y ago
  For what it's worth, that's just a tweet embedded on the page, not written by the author of the article. Inflammatory remarks like that are par the course for Twitter.
xacky 2y ago
This is why Mozilla should stop bothering with the ESR version of Firefox. Too many features of it have to be polyfilled. The ESR cycle made sense when XUL was a thing, but now the extension APIs have been overhauled it should be easier for everyone to use the same browser version and tell outdated browsers to upgrade instead of having to backport features. Microsoft is also to blame here by making new versions of Windows abusive so people stick with outdated OS versions which only have ESR browsers. I just hope someone finds an unpatchable flaw in MS accounts so Microsoft is forced to go back to local accounts in Windows 12.

42 points by feross 2y ago

> Polyfill.io has been serving malware for months via its CDN, after the project's open source maintainer sold the service to a company based in China. Nobody could have predicted this /s

gary_0 2y ago

Out of curiosity, does anyone know of any other cases of registrars taking down domains for serving malware? Is this a common practice?

KomoD 2y ago
Namecheap does it a ton, probably the most responsive registrar when it comes to abuse. Typically with registrars I just get told to take it up with the hosting provider instead. I've also been told by registrars they just won't act without a warrant.
altairprime 2y ago
I assume it happens all the time for investigations; for example, those headed by Microsoft’s anti-malware team, which posts often enough about such takedowns. Domain registrars do have terms of service that can be enforced against malware sites. > Namecheap expressly reserves the right to deny, cancel, terminate, suspend, lock, or modify access to (or control of) any account or any Services (including the right to cancel or transfer any domain name registration) for any reason (as determined by Namecheap in its sole and absolute discretion

ryan29 2y ago

They criticize Namecheap for being slow, but is 1 day slow? Who here would pull the plug on a domain relied on by hundreds of thousands of sites faster than that? I get the desire to shut it down instantly, but do we really want registrars taking domains offline in less than a day? There’s got to be significant liability concerns when you’re doing something that could impact hundreds of thousands of sites. It’s kind of a tough spot to be in, isn’t it?

KomoD 2y ago
Definitely not slow, also as we speak the "googie-anaiytics" registered with Godaddy is still active.
- riiii 2y ago
  As long as GD is getting paid their fees I think they DGAF.
poikroequ 2y ago
For what it's worth, that's just a tweet embedded on the page, not written by the author of the article. Inflammatory remarks like that are par the course for Twitter.

xacky 2y ago

This is why Mozilla should stop bothering with the ESR version of Firefox. Too many features of it have to be polyfilled. The ESR cycle made sense when XUL was a thing, but now the extension APIs have been overhauled it should be easier for everyone to use the same browser version and tell outdated browsers to upgrade instead of having to backport features. Microsoft is also to blame here by making new versions of Windows abusive so people stick with outdated OS versions which only have ESR browsers. I just hope someone finds an unpatchable flaw in MS accounts so Microsoft is forced to go back to local accounts in Windows 12.