3 ms·
It seems that PostHog just always loads the latest version of this piece of itself: https://github.com/PostHog/posthog/issues/24471#issuecomment-2298298849 htt
by roywiggins 2y ago
It seems that PostHog just always loads the latest version of this piece of itself:
https://github.com/PostHog/posthog/issues/24471#issuecomment-2298298849 https://github.com/PostHog/posthog/issues/24471#issuecomment...
Though you can opt to bundle it yourself:
https://github.com/PostHog/posthog/issues/24471#issuecomment-2298786491 https://github.com/PostHog/posthog/issues/24471#issuecomment...
- slashdave 2y ago> I definitely want to figure out in detail what happened here so I can add a test to prevent a similar change in future! Whoa! Good idea! Could have been worse. At least the change didn't expose a hidden exploit.
- deleted 2y ago[deleted]
- ricardobeat 2y agoOuch. That just adds insult to injury.
- phkahler 2y ago>> It seems that PostHog just always loads the latest version of this piece of itself: Now there's a supply chain attack vector...
- philsnow 2y agoYears ago, IT at the company I was working at force-pushed a browser extension that did this same trick, but the extension vendor in question didn't even bother loading over https. Edit: the extension's manifest gave it nearly every permission, on every web site, including internal ones