One Script Tag Just Pwn'd Over 100,000 Websites

[@bluepilkinton-ching3335]

New idea for an ad blocker: Injecting Polyfill script tags into site

[@chriss3404]

from the producers of "pretending to be a malware analysis environment"!

[@qlx-i]

@@chriss3404 "pretending to be a VM", I actually saw that thing implemented somewhere, I don't remember where tho

[@fennadikketetten1990]

Dunno if this was a joke, but uMatrix allows you to block ALL third party JS. Which in this day and age is something you should definitely be doing by default.

[@J1Jordy]

Million dollar idea

[@DccToon]

PolyBlocker sounds so cool now that i think about it

[@BobKane-g6x]

"Isn't NPM the same? There are a million who-knows-whats in my module directory. It took 30 minutes just to delete dependencies that depend on dependencies, a million times over.

[@asagiai4965]

I wonder about it too.

[@anthonybarnes]

This is a good question

[@B20C0]

It is and supply chain attacks to npm aren't new either. It's a shitshow.

[@secret8squirrel316]

I think this happened with npm already. They have protections against it.

[@masterflitzer]

@@secret8squirrel316 not nearly enought, protection on npm is like closing the door unlocked instead of letting it open completely

[@Mitch-xo1rd]

15:45 the reason they didn't pin it to a specific hash is the most dangerous thing about pollyfill, it changes based on user agent. Each user may be served a different js file, so you can't pin the script to a specific hash. They give full control of what may be PAYMENT PAGES to a script that randomly changes BY DESIGN! Don't embed things like pollyfill, even if you don't have evidence of it being compromised.

[@chriss3404]

if I want to use a less popular js package, I have to make myself to read it or else I can't sit with the idea of deploying it. I can't imagine dropping a script tag into a project of mine without an integrity attribute... terrifying.

[@KyleTen2]

I thought the subresource integrity spec allows multiple hashes. In theory one could have enumerated all the user agents the cdn would see and hashed the expected polyfills

[@KellyThomas9]

​@@KyleTen2enumerating all the user agents sounds hard. Easy to capture all the ones you have seen in the past but impossible to comprehensive coverage of the future.

[@chriss3404]

@@KyleTen2 I thought this too, but looking through the MDN at a cursory glance, it's at the very least not common knowledge. It makes a ton of sense as an enhancement though. Dynamic content without the risk would be pretty awesome.

[@privacyvalued4134]

This is why payment systems like Stripe, by default, use s to host the actual credit card fields. That approach makes compromising a credit card much harder to do. All the attacker can get is a useless opaque payment identifier that can only be used with the Stripe account's secret API key, which they don't have. Stripe would prefer everyone use their Checkout system, which is far more secure than anything the average dev can churn out, but that's an unrealistic perspective because Stripe Checkout has some pretty significant limitations.

[@ankiy]

Working in one of the largest bank of Australia. I told my manager about this polyfill thing he was still not convinced after your tweet . Now sharing this video to him. Reason being i am having 2 yrs if experience while he is industry for last 15 yrs.

[@elhamnazif]

Your comment made it sound like you decided to show your boss a tweet/video from some tech KZbinr instead of a more authoritative source like Cloudflare or the Polyfill maintainer(s)...

[@toast_dev]

@@elhamnazifthis is a much better approach! although Theo is a good source of tech news, to convey the message to a “professional” use the damn direct original source lol

[@tonygluk1]

Yes, when you cite a tweet by a hipster-looking youtuber as the most convincing evidence of 100k wide attack, you look like an inexperienced impressionable fanboy. No hate to Theo, but to anyone who isn't familiar with him he's just a random influencer with no credibility. You should've cited Cloudflare.

[@aqua-bery]

15 years and he can't see the issue with polyfill?? Crazy, bro must've been sleeping for at least 10 of those years

[@nwylynko]

As an Australian that uses banks, I’d love to know which bank your talking about

[@Sandromatic]

Its wild that they got the github repo too? Like idk that seems weird.

[@baldierot]

exactly. they deleted the github issue where people were asking if they got bought by a chinese company, and some completely empty account closed it before the deletion happened and said "polyfill not managed by chinese company, by us based cdn company.".

[@baldierot]

exactly. they deleted the github issue that was asking whether they got bought out by a chinese company and some completely empty account closed the issue before the deletion saying, "please provide full url with version that is not working, we will clear it from cdn cache." then "polyfill not managed by chinese company, by us based cdn company."

[@ITAC85]

Damn. I had no idea. Terrifying knowing how when repos like Polyfill are bought by different companies, they can do what they please with what they own, whether for the good or not. In most cases, the company that takes over has good intentions, but in the case of Polyfill, it's clear that this wasn't the case.

[@everythingpony]

He didn't own it

[@Mitch-xo1rd]

​@@everythingponyyes he did, then he sold it

[@gabriellevesque2185]

​@@Mitch-xo1rd So he didn't own it... when the bad things happened.

[@ShayBlez]

You passed over nintendo in that list, holy f u c k

[@nathan22211]

actually that might mean the switch's Eshop was compromised as well

[@nordern1]

Using non-checksumable external libraries is a terrible idea? Who would have thought!

[@shapelessed]

It's such a basic knowledge, I don't understand how anybody would even omit it. It's like using installing NPM modules, without specifying a static version. The next dev that's gonna touch it may unknowingly change the entire build' package or even introduce some nasty garbage simply because "npm install" went for the newest thing...

[@nordern1]

@@shapelessed It's not that they omited it, polyfill io by design could not be checksummed. It generates JS dynamically to polyfill based of the browsers UA-string and a given set of features you need. So the file was always different. The entire sales pitch is that, if the browser is up-to-date, you can skip downloading the polyfill. That's probably what made it a valuable attack target in the first place. But it's still a pretty bad idea regardless. You are trading that little JS overhead for complete trust in the provider of the script. Even with the cloudflare mirror that's not a good idea, and possibly a GDPR violation

[@tablettablete186]

People should vet their dependencies before adding them. Insted they just go NPM install

[@limbo3545]

@@shapelessed regular dev with deadline pressure be like: insert external libs to get shit done go brrrr

[@bernardoj54]

@@nordern1 What to do for supporting old browsers instead? I need it for my company

[@owenwexler7214]

Moral of the story: self-host everything, don’t rely on anything external. Even for something as harmless and innocuous as a CDN like JSDelivr, there are implications. What if JSDelivr is down the day your site goes viral, to name one example?

[@bernardoj54]

Big companies can't do that. Especially is the big company is not one big provider like google or something.

[@theairaccumulator7144]

Those are additional costs that many people can't foot.

[@Skylord12345]

I struggle watching content where the person is just reading lines from an article. It's like the most lazy form of content generation ever. This entire video could have been summed up in 60 seconds or less.

[@cipher01]

It's your choice

[@timseguine2]

To be fair: even before Chrome, Firefox had already put significant pressure on Internet Explorer, Safari and Opera to embrace standards (although to be really fair, IE was the only real problem child). Chrome was just doing what Firefox already started but with the leverage of better UX and more marketshare. I am glad they killed the old web.

[@AdamScottPersonnel]

Exactly. Firefox was always praised for following the standards.

[@qlx-i]

> Chrome was just doing what Firefox already started but with the leverage of better UX and more marketshare And more monopoly and more webp and less jpegxl

[@4kleidisc]

if only the old web had a matching standard cause it just looked SO GOOD

[@timseguine2]

@@4kleidisc That's just design sensibilities. If you still want to make websites that look like that nothing is stopping you, and with modern web standards it's actually even easier now than it was back then.

[@4kleidisc]

@@timseguine2 true, and i am a sucker for good design haha, even if my taste isnt the best

[@Cyanide300]

And this is why I never deploy production code that calls a third-party CDN. If you're doing that, you are trusting that third party to send you the script you're expecting every time someone loads the page. But they absolutely could send you literally whatever they want instead.

[@ThePCJohnson]

I would expect the Cloudflare status page to be running outside of their CDN infrastructure to keep it available during outages so it isn't entirely surprising that they came up with an easy way to avoid the issue and forgot to apply it to that separate part of their systems. It should definitely be on a bunch of checklists now though so that nobody will forget about it for a while.

[@BattyBest]

6:15 I love the TOS going "Oopsies, we may give you a virus, we cant know for sure!!,1!! Plz check urself for any viruses we may or may not have put on your website!!!111!,"

[@insylogo]

I love how the thing says JSTOR is being affected by the polyfill hack and you're like "cool, let me go open that right now".

[@wlockuz4467]

Not a risk unless you actually have an account singed in on that website.

[@CapeSkill]

he's probably not using it, so he's not compromised.

[@jeffreyblack666]

It is fairly trivial to disable javascript, which can allow you to go to any site that is compromised without issue.

[@BattyBest]

Plain js cant do much to your host os anyway, most it can do is spam you with alert();. The problem is because the js can just yoink whatever info you put on the website or redirect you to a phishing page, as long as you are just inspecting the website without entering info, though, its fine.

[@jeffreyblack666]

@@BattyBest Unless you are logged in, in which case it can also do extra fun stuff like potentially hijack your account, and do loads of things on the site on your behalf.

[@paultapping9510]

so as a new new dev I'd been wondering for a while about the security of CDNs and cross-site linking which, back in the day was almost exclusively an attack method, that I keep being instructed to use. Is the benefit of not serving a 20kb css or js file yourself really worth it?

[@t3dotgg]

Your intuition is correct, this is very dumb to do

[@RedStone576]

6:20 are they suggesting developers to embed an antivirus on their website?

[@bernardoj54]

I also didn't get that part

[@RivadoEdah]

Where does Theo gets his shirts? They look terrific

[@irumidesu9236]

That looks like a batik. Originated from Indonesia

[@pushyoch.8252]

@@irumidesu9236 obligatory SEA/Nusantara heritage mention. Indonesia AND Malaysia (also Brunei and Singapore)

[@t3dotgg]

This one was Topman pre-acquisition, they’ve fallen apart since Used to love Express as well but they’re collapsing atm Will let people know when I find a good shirt source 🙃🙃

[@toast_dev]

@@t3dotggyou should try Rhoback! i know you’re fashionable so would love to hear about your thoughts

[@XxZeldaxXXxLinkxX]

Using polyfill and other libs like unpkg and jsdelivr has always been really distasteful to me. Literally bundling arbitrary code that can be swapped out during prod. Of course there are mitigations, but just bake in the libraries you need into your own application...

[@bruwyvn]

Imagine if this happens with a UI library that uses external scripts, like Bootstrap, Semantic UI, etc.

[@thekwoka4707]

Yeah, it always has been awful. And many seem to think it's okay. Yeah, for a little "lets just slap this in and try it out" sure, but the moment it's more than "hmm thats interesting" you need to be serving it yourself. It's more performant and safer. And easy.

[@neothermic1]

@@bruwyvn bootstrap has almost always suggested to use an integrity attribute if you're just nabbing it via a script tag (and they link out to jsdelivr for it, not self-hosted). But yes, this is why you don't link to anything that doesn't have an integrity attribute to lock it down, and why pollyfil is difficult/impossible to secure; it changes delivery based on UA, so you can't give it a single integrity attribute.

[@asdfghyter]

if you use the integrity attribute on the script tag, you can guarantee that they can’t change it, so the worst case scenario is a DOS attack by just not serving the file

[@thekwoka4707]

What? You mean just tossing in the cdn script isn't the best idea?!?!?!

[@CharlesBallowe]

For the cloud flare status page, I'm assuming they can't serve that page using their caching/rewriting layer - if there's a problem with the core service and the status page is proxied by it, nobody would be able to view the status.

[@t3dotgg]

They could have updated the HTML for the page though lol That said, they are using Atlassian’s status page service so they would have to pressure them to fix it

[@CharlesBallowe]

@@t3dotgg agree that they could have manually fixed jt. Didn't dig deep into how they served it, just that it would be easy to miss the page that is handled differently from everything else. "Ok... We pushed a fix that mitigates the immediate threat, no longer a critical bug to address all of the pages individually." ... "Oh... Missed a spot"

[@VKD007]

I was visiting few sites last month and i was being redirected to a betting site. I thought I clicked some ad 😮

[@Aera223]

wow, same (I think, not sure what site redirected me to a betting site)

[@MZZenyl]

Don't name your project/library something that would be a valid web domain. Especially not if you don't even own said web domain.

[@tabsc3489]

The way I snickered when you @'d hulu.... that is rich lol

[@binaryguru]

I thought it was obvious to NOT load scripts from external sites for security reasons, guess I was wrong.

[@user-pw5do6tu7i]

If i throw the polyfill url into my adblocker I should be fine right? like if my client refuses to fetch it, then surely I am protected? Too bad Chrome Manifest V3 is going to kill this functionality

[@tablettablete186]

You cloud vlock it at DNS level

[@SuperLlama88888]

SRI integrity hashes should be used when loading all external scripts.

[@X85283]

I can't believe these huge sites are using dynamic content delivery like that. I know its a thing but for like an actual production site it seems insane to just be like "yeah go get whatever javascript comes from this link". Nuts not to pin a version and send it from your own server...

[@syrus3k]

I've been saying this for years but nobody cares. This is the same with pretty much all popular programming languages. Unless every package is carefully vetted, which it isn't

[@H8KU]

Malicious companies do the same thing with browser extensions. They give the original team a ridiculous amount of money to buy the extension, then sever malware through it.

[@thegrumpydeveloper]

The only good thing about this is that it could have been much much worse and gone undetected for even longer.

[@Cixelsyd32]

Crap like this is why I run the NoScript browser add-on and only selectively allow JS to run on my browsers.

[@maxijonson]

Me watching this with Hulu paused on the side: 👁👄👁

[@oleksandrpopovych4841]

well, this is the second attack of such scale on open source community from chinese and affiliated parties

[@skyjumper4097]

what was the first one

[@ChrisWijtmans]

@@skyjumper4097 I think he is refering to Agent 77 (Jia Tan). Where there is no proof as far as i know that agent 77 is chinese.

[@Goat488]

XZ Backdoor ​@@skyjumper4097

[@suou7938]

@@skyjumper4097attack on XZ was found few weeks ago. probably there are more that don't come to mind immediately

[@nathan22211]

@@skyjumper4097 the xz backdoor probably, but it was never confirmed that the assailant was chinese

[@BarakaAndrew]

Whenever I run "npm install" my heart skips like 10 beats. You could pull malware at any given time and let's be honest it's almost impossible to know.

[@dealloc]

Not unique to npm, but yes that is a valid concern and is why a lot of companies, who care about security and have the resources, invest those resources in maintaining their own internal mirrors and vet any dependency being mirrored. This is unfortunately not so easy for majority of small companies to do, so they would have to trust a third-party anyway.

[@juliansoto2651]

It's not like you can't check the code

[@codewithdrew]

@@juliansoto2651best of luck manually analysing 5k packages everytime you npm install

[@dustee2680]

@@juliansoto2651 Oh yes ofcourse, let me just go through a couple million lines of code in the libraries in my dependency graph, and re-check at every update. Why didnt i think of that?

[@erentr7167]

@@juliansoto2651 "It's not like you can't check the code" when you have like 100 dependencies, they will most probably have 1000 of unique dependencies itself, imagine putting a one liner backdoor in one of the backone packages, image like "is-odd" package, its simple, its everywhere. the thing the package does is simple, so adding one more line and jank code will most probably trigger some people, but if you manage to do it in a way that the code seems legit, you are good to go

[@acf2802]

This is why the script tag has an integrity attribute if you are smart enough to know how to use it.

[@Mitch-xo1rd]

The reason they didn't pin it to a specific hash is the most dangerous thing about pollyfill, it changes based on user agent. Each user may be served a different js file, so you can't pin the script to a specific hash. They give full control of what may be PAYMENT PAGES to a script that randomly changes BY DESIGN!

[@OliverPlummer905]

Or using a strict Content Security Policy. The script could run and read whatever they want but nothing could be sent out.

[@XxZeldaxXXxLinkxX]

@@OliverPlummer905 CSP is only used for loading resources like images and js though, not for outgoing connections.

[@dealloc]

@@OliverPlummer905 CSP isn't going to help, the script served from the URL is already "trusted" by the website, otherwise it wouldn't work in the first place. There's no way to specify CSP policy that says "if this resource's contents changes, then deny access to it".

[@wlockuz4467]

​@@dealloc You can do it using the integrity attribute, it's generally a hash of the script, so any time the script changes and the hash doesn't, it fails to load the script. However in this case it's impossible to do because the script changes based on the user's browser so you can't know the hash in advance.

[@tablettablete186]

Supply chain problem... people adding 500 dependencies to their program. Life going as normal LMAO

[@shapelessed]

Many of such supply chain attacks are often avoided by using a specific, static version of an NPM dependency. But I guess, in this case, the theoretical use case for that "tool" didn't allow for that too much.

[@crazy_hardcore_gaming]

Chat GPT is using this Library. I tweeted at them please complain to to them too.

[@neutronstar03]

I use theos videos to know the news and then search another, more succint video to actually see the content how can a great creator reach this trash

[@adtc]

We should just copy the script and put it in our own repository.

[@xorxpert]

that’s why i host my own CDN.

[@gregmurdoch3264]

Never remote load a resources where you don't solely own the remote host. If you need to use a remote resource, download it, and upload it to your own CDN. You must, must, verify the libraries you use.

[@Kenionatus]

"Trustworthy alternatives" Lists two US companies. Yeahhh... I wouldn't call any company that can be court ordered to spy on me trustworthy.

[@juliansoto2651]

As if you could fully trust a company from anywhere else

[@EwanMarshall]

This is why I don't use polyfill, this is why I block polyfill via no-script... But seriously, a lot of web developers need to learn IE9 does not exist anymore.

[@asdfghyter]

It’s crucial that you use the integrity attribute with a hash of the JS code on all your external script tags to protect against attacks like this! You still need to verify the safety whenever you add or update any external dependencies, but at least this prevents malicious third parties from changing the code under you.

[@Brixster]

polyfill's service did not work with checksum hashes because it served a completely different JS file with different patches based on the user agent of the browser. You had to entirely trust that the content they were distributing was safe, and clearly that turned out to be a terrible idea

[@asdfghyter]

@@Brixster I agree, so that's a reason to avoid it! You should always use the integrity attribute, so you can't use such a service

[@ItsJbirdJustin1]

The real question is who is the person that sold it to this Chinese company?

[@infodusha]

Shouldn’t browsers block polyfill domain at that print?

[@R0CK3T_DEV_]

As soon as I saw "pwn'd" I thought of roblox I hate myself

[@TurboGFF]

I'm not seeing this get asked anywhere, so maybe my ignorance is showing. If the URLs where the scripts are being loaded from are the domain in question, and the polyfil project people say they never owned the domain nor were responsible for it's sale - How was it even being used to source files from? How would the A record -> IP address link work if they didn't have ownership of the domain in the first place? And if it were never owned by them, why use a domain they didn't own, in their scripts?

[@voidkid420]

Making websites work in IE7 is very important ... imagine the revenue and wisdom this demographic has to offer!

[@MattHudsonAtx]

I actually abandoned a person for running windows 98 in 2012

[@voidkid420]

@@MattHudsonAtx Thank you for your service! o7

[@username7763]

IE7 need isn't very common, but there are lots of corporate webapps. I had to support IE6 long after it was replaced. When you have 10 companies using your products, just having one of them refuse to upgrade is enough to require having to support them. Web apps are used for a lot more than public internet websites.

[@voidkid420]

@@username7763 and all of them use the inherent non-security to work :)

[@Mempler]

Should've rewritten it in rust.... wait, the service is already written in rust. Doesn't that mean rust is insecure? /j

[@tablettablete186]

Rookie mistake, should've used C! /j

[@privacyvalued4134]

Why are people so dumb? Yes, let's just make remote web requests from our website to another website with this magical script tag. Nothing could _ever_ go wrong with that! I just ran a quick code search and found ZERO usages in my code. That's because I have a policy of first-party hosting of any third-party libraries but I also tend to just write my own code, so I would probably never use this trash in the first place. I also vet the code I use by looking at it first instead of just blindly using something that sounds good/looks cool. Everyone who got pwnd here deserve what they get for being LAZY developers. Learn how to develop software correctly and this won't ever happen to you.

[@Maxjoker98]

Let's be real here, the entire JS ecosystem(and Python and a lot of other languages as well) is horrible for this exact reason: They don't make it easy to program without trusting many, many (untrustworthy) people. This is mostly due to the developers not wanting to write simple, common functions, and instead rely on external third parties. Have fun with your millions of lines of code and hundreds of people in your TCB for a f'ing UI library or whatever that you don't even need, just to not implement a few very simple functions. Did you know computer double in performance every so often? You can't tell? Well, you can't tell because the average developers get worse at the same rate.

[@gm42069]

Morale of the story... If you actually care about open source, and the internet don't sell off your dead project to a chinese developer

[@ismail-devland]

Hell shit balls, I got hacked 1 year ago because of the same shit; I report it i didn't know it will go viral lol

[@mrrfyW]

Not to offend you but do you ever get comments that you look like Jerry Attricks from Scott the Woz in your thumbnails

[@EnderCrypt]

okay, but heres a question.. you say these sites pointed to the cdn polyfill domain but if this domain DIDNT exist before, why did they add the domain to their page?

[@lukafireman]

Wait, a dude created a service, and all of a sudden he's not the owner? I understand it was most likely a group effort, albeit that should be noted in the repo for such cases where a threat actor could obtain a github account and the domain. This just seems like a weird way to go about this.

[@susangoaway]

4:18 Oh no... how terrible.... Oh no. That one's probably a useful feature. "Academic research", my ass.

[@arbitervildred8999]

imagine doing web dev where your tetris depends on 60 other packets that you have no power over it... and then call yourself a developer XD couldn't be me

[@fgregerfeaxcwfeffece]

I still have to leave before I get an aneurysm...

[@nickross4059]

I’m so done with js

[@ChrisWijtmans]

javascript was a huge mistake. we need HTML patch jobs, like json patches. instead of AJAX.

[@WalterSamuels]

Why do any of these companies load scripts directly from random cdns instead of self-hosting to begin with? Idiotic.

[@andr101]

But what does this do to the end user?

[@shallowfrost]

I think a more secure method of using third-party scripts would be to first redirect them to a "center-point," which is essentially a file on your website that serves as an import for the scripts. You can then link that file to all of your pages instead of directly linking to the script. This way, if you notice any security breaches, you can simply remove or replace the single import file rather than spending a lot of time changing it on every page.

[@stavros222]

Why those guy are doimg everything to violate the worlds privacy? I swear most of the times they are behind those

[@m4rt_]

Couldn't you use something like a Pi-hole to block all traffic to the Polyfill website on your network to protect yourself? I think you could do this with the hostfile too, but you would need to do that on every device.

[@geomorillo]

Thats why i allways self host this scripts

[@rainmannoodles]

The ability of a website to load a script from anything it does not directly control was always going to get us into trouble. Just look at how many 3rd parties are accessed by a typical website. It's insane... and web developers and frameworks that encourage this model are at fault. Unfortunately fixing the problem is going to be very hard. Unscrupulous ad companies are even starting to force websites to add cname records so their scripts can "appear" to come from the first party! The only solution here is to make things much stricter: - Restrict script tags such that they must be served *from the same IP* as the primary page. No exceptions. No DNS bypasses. *SAME ORIGIN BY IP* or your script is blocked. - The HTML must embed a hash of the script it is going to load, and that hash must match or the script will be blocked. - If a website communicates with a 3rd party domain, each individual domain will be presented to the user in a list to be approved. Will this break a *ton* of sites? Yes. Do they deserve it? Absolutely yes. Is this proposal practical? Of course not, but anyone who is honest about the state of the internet will agree that what we're doing now can't continue.

[@philodox13]

So this is all Jake Champion's fault. I wonder how much he sold for?

[@SeRoShadow]

Simply put, once one adds a tag to a 3rd party , it has full control over that website Since Javascript can modify everything with DOM manipulation and by Overriding/Overloading Event Listeners One may use 3rd party scripts to speed up development, local copies of said script if possible. Then, later on, drop those dependencies one by one. If not, they will eventually turn into vulnerabilities that create security and service issues.

[@cod3r1337]

For Christ's sake. If you really think it's a great idea to depend on scripts (or any other resource) from an external CDN, at LEAST use checksum validation! Everybody and their mum knows that.

[@Orinslayer]

Every day theres some new fuck up in the web dev sector. Its time to reset this twisted game.

[@henrischomacker6097]

People that include resources from servers they don't own in their websites actually don't deserve better. No mercy! I the EU it's actually forbidden by law unless you explicitly mention that in a disclaimer AND the visitor of the website has actively opted-in because you also send the website's visitor's IP to that third-party server.

[@mister_c6005]

Ive always thought running turing complete code in browser was a mistake. Can you imagine going back though? I gladly would, but it aint gonna happen. Itd be the death or upheaval of entire industries. In my mind, itd be worth it. I mean, we might lose social media, and a lot of addictive algorithms. Oh the humanity.

[@valseedian]

rule #0 of importing 3rd party libraries: download a snapshot and use your own distribution rather than the 3rd party link. sure, I still sometimes use jquery. but I downloaded the source that worked when I wrote it. breaking changes and security risks avoided

[@nicolaicornelis2853]

Cloudflare's polyfill is unfortunately slow. Fastly's hosted version is a lot faster. And with Cloudflare's latest nightmare PR I'd probably steer clear of them.

[@mestoris]

It’s worse than Theo suggests. Thanks to the same-origin policy, third-party scripts can crawl any URL on your server as the authenticated user.

[@bernardoj54]

Can someone please give me tips on how to change this library on my project?

[@TheJobCompany]

Could it be that Cloudflare Status was explicitly not using the Cloudflare-hosted library, so that it is still available during Cloudflare's downtime?

[@polyscopes]

The real question is who owned the domain and sold it to the chinese governement?

[@ahsookee]

Hes in the video, i think, unless im misinterpreting his tweet

[@Mitch-xo1rd]

The original creator, guess he didn't do his due diligence.

[@dan-bz7dz]

Nobody sold it to the Chinese government. They do have criminal organizations and hackers in China as well. That I have to point that out. Jesus. Don't reproduce.

[@jalil2985]

Could have sold it to someone else beforehand. Of course not owning the domain was a big screw up

[@jeffreyblack666]

This is why you should never embed an external package, ever. Instead, if you need the script for what you are doing, host it yourself.

[@vitasomething]

this just feels like xz again. random thing everybody uses but nobody cares abt or pays attention to gets compromised, chaos ensues.

[@Hexcede]

Except this one is actually affecting a lot of stuff unlike xz

[@CaptainToadUK]

I always thought that using scripts from an external source was a bad idea. if you want to use the script, host it yourself. At least then you can scan the code and pin yourself to a specific version

[@darknetworld]

What about those third party sites as well fake google analytics name? and the free host paste pin for codes.... I feel sad...

[@sub-harmonik]

did he disable javascript before visiting hulu?

[@sun3k]

I don't think the script can do anything meaningful without a logged in account etc. Nothing to steal there.

[@landsman737]

Who was using remote CDN for thing like this is just stupid. Use package manager omg.

[@kwicklaunch]

ad networks put js on your site that comes from whoever has paid enough for a designated consumer profile.

[@cethien]

one of the reasons I import the libs i wanna use and bundle them. never sat right with me to use cdn for my sites functionality

[@suou7938]

CDNs are fine, as long as you use the integrity attribute in your tag (at least for now...)

[@Cognitoman]

What’s that do ?

[@Hexcede]

You can't because it updates dynamically

[@rossjennings4755]

​@@Cognitoman Provides a hash of the file that should be served by the CDN as part of the HTML, so that if JS the user gets isn't identical to the JS that you (the developer) intended them to get, it fails to load. It works as long as you control the HTML and don't expect the JS to "auto-update" in the background, which many people do, despite how dangerous it is if you can't 100% trust the CDN.

[@DefCantGame]

Can confirm they are still using polyfill

[@the_ktb]

Same shit happened with Faker for PHP, if you generate in image, the domain changed owner.

[@DogesArePros]

wait this was a month ago? are all of the sites still compromised?

[@abramhunsberger3511]

Just another reason to use an adblocker like ublock origin.

[@codeChuck]

Hey, you need to say 'nerds' at the end! Do not be so lazy! :)

[@ChrisWijtmans]

its probably too late already and they got a bunch of info.

[@leonardomoraes1658]

So now companies from China are doing the same thing as the companies from US, things are getting interesting.

[@Jojor11]

This is terrifying… I guess I know the first thing I’ll do at work today (check if we have it even if I think we don’t)