4 ms·
> Not broken at this version, broken on August 19. This is why I'm terrified of putting anything on the web. It is a dark scary place where runtime dependency o
by scottlamb 2y ago
> Not broken at this version, broken on August 19. This is why I'm terrified of putting anything on the web. It is a dark scary place where runtime dependency on servers that you don't control is considered normal.
Yeah, that is terrifying. In a nearby comment [1], a PostHog co-founder wrote this affected sites which "did not have a specific version of the JS library pinned and deployed a new version, or were using the snippet". I gather from that is it possible to pin the version, and this incident highlights the value of doing so.
[1] https://news.ycombinator.com/item?id=41301008 https://news.ycombinator.com/item?id=41301008
- __MatrixMan__ 2y agoI'd prefer a something where such references are resolved by cryptographic hash so that there's never any ambiguity re: what you're actually getting. Unison does this I believe.