Cloudflare's recent blog regarding polyfill shows that Cloudflare never authorized Polyfill to use their name in their product
Cloudflare's recent blog regarding polyfill shows that Cloudflare never authorized Polyfill to use their name in their product
polyfill.io, a popular JavaScript library service, can no longer be trusted and should be removed from websites
cross-posted from: https://programming.dev/post/16106778
Contrary to what is stated on the polyfill.io website, Cloudflare has never recommended the polyfill.io service or authorized their use of Cloudflare’s name on their website. We have asked them to remove the false statement, and they have, so far, ignored our requests. This is yet another warning sign that they cannot be trusted.
Whenever I see those "All the companies that use us" banner, I shrug.
If I was a scammer, why wouldn't I include a dozen companies?
Nice. Unfortunately this won't tackle the mountains of sites that use bundlers.
Direct linking via a specific CDN was the problem. This is solved by bundlers, not caused by it.
The polyfill.js is a popular open source library to support older browsers. 100K+ sites embed it using the cdn.polyfill.io domain. ... However, in February this year, a Chinese company bought the domain and the Github account. Since then, this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io.
I read the story and specifically the bit about the Github account. Isn't this the Polyfill lib's Github account? Because if that's the case, how would a bundler solve the issue? The new owners could modify the original source, then the CICD jobs would happily publish that to registries and from there down into the bundles. Is it a different Github account they're talking about?