It's always a danger when a malicious company purchases a famous open source project.
Like that israeli adware company that bought simple mobile tools
this post was submitted on 27 Jun 2024
74 points (97.4% liked)
Technology
34889 readers
505 users here now
This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.
Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.
Rules:
1: All Lemmy rules apply
2: Do not post low effort posts
3: NEVER post naziped*gore stuff
4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.
5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)
6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist
7: crypto related posts, unless essential, are disallowed
founded 5 years ago
MODERATORS
Reminds me, I should donate to Fossify
I donated to the Tibor guy and I feel betrayed for how he managed the situation
I feel for the guy. Had health issues and needed money fast. I kinda don't blame him. Like I get its disappointing and I also won't blame people being mad at him, but I'm more mad at the overall system of how things get funding
I'd also have accepted the money if I were him but at least I would have wrote a blog post explaining the situation, that now the apps are dead and controlled by a bad actor and need to get uninstalled as soon as possible.
Not almost denying it while continuing to get money on his Patreon from unaware users
Whenever I see those "All the companies that use us" banner, I shrug.
If I was a scammer, why wouldn't I include a dozen companies?
Nice. Unfortunately this won't tackle the mountains of sites that use bundlers.
Direct linking via a specific CDN was the problem. This is solved by bundlers, not caused by it.
The polyfill.js is a popular open source library to support older browsers. 100K+ sites embed it using the cdn.polyfill.io domain. ... However, in February this year, a Chinese company bought the domain and the Github account. Since then, this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io.
I read the story and specifically the bit about the Github account. Isn't this the Polyfill lib's Github account? Because if that's the case, how would a bundler solve the issue? The new owners could modify the original source, then the CICD jobs would happily publish that to registries and from there down into the bundles. Is it a different Github account they're talking about?
Code pulled from GitHub or NPM can be audited and it behaves consistently after it has been copied. If the code has a high reputation and gets incorporated into bundles, the code in the bundles doesn't change. If the project becomes malicious, only recently created bundles are affected. This code is pulled from polyfill.io every time somebody visits the page and recently polyfill.io has been hijacked to sometimes send malicious code instead. Websites that have been up for years can be affected by this.
Perfect. This is consistent with what I was thinking and that Cloudflare's changes won't fix any recent bundles that might include malicious code.
Built bundles are not affected. The service is supposed to figure out which polyfills are required by a particular browser and serve different scripts. Because it's serving different scripts, the scripts cannot be bundled or secured using SRI. That would defeat the purpose of the service.