Cloudflare automatically fixes Polyfill.io for free sites

I totally get the intention behind this and the final outcome is definitely a safer internet. It's also somewhat justified considering the author has mentioned they never controlled its domain, yet the library has been distributed through that domain, correct? This is a reflection of the extremely poor security practices in the web development world.

At the same time, there is a wrongness in Cloudflare being able to overwrite content and changing the 'truth'. I'm like that larry david gif, I just don't know how to process this.

One more thing to note, if you go to the polyfill repo, they've also mentioned they're using Cloudflare to distribute the library.

https://github.com/polyfillpolyfill/polyfill-service/commit/...

> We have taken the exceptional step of using our ability to modify HTML on the fly to replace references to the polyfill.io CDN in our customers’ websites with links to our own, safe, mirror created back in February.

I get that they want to do a good thing, but is this something you agree to when you sign up as a Cloudflare customer? If so, that’s kind of crazy.

edit: I am talking about both free and paid users. A toggle does not discount my question whatsoever, especially if this is on by default for free users. I am asking specifically about terms of service.

This post includes a link to an earlier blog post on "reduce your supply chain risk" in 2024-02-29:

https://blog.cloudflare.com/polyfill-io-now-available-on-cdn...

In the earlier thread, there was a link to triblondon's post on 2024-02-25 where he urges users to remove that dependency:

https://x.com/triblondon/status/1761852117579427975

Unfortunately, neither of these early warnings seem to have gotten much attention. I wonder if there is some news site or service that would make suspicious ownership transfers of this sort more noticeable? Or maybe this type of supply chain changes actually happen all the time and we just got used to them?

It doesn't matter anymore, Namecheap has taken down polyfill[.]io: https://x.com/malwrhunterteam/status/1806074377383121148

In other words, Cloudflare is man in the middling their customers and hijacking delivery to customer CDNs? This time it was beneficial...

Setting a dangerous precedent, especially doing this by default (no opt-in) needed.

But then again, if the people who carelessly include 3rd party dependencies (i.e. playing with fire) are those who use CF... they probably won't object to it :-)

CloudFlare is "fixing" all websites using their proxy automatically, meanwhile polyfill.io is using CloudFlare as a CDN. That's funny.

Today cloudflare are re-writing payloads to remove malware.

Some grim future who knows if cloudflare will be the ones under new owners re-writing payloads to serve adverts (or worse).

edit: I think my comment is being misunderstood, I'm not saying this will happen, there's just a neat symmetry between exploit and mitigation.

I understand all the negativity, but to me CF has provided a least bad immediate solution.

More discussion on the attack: https://news.ycombinator.com/item?id=40791829

Related:

uBlock origin blocks Polyfill.io https://news.ycombinator.com/item?id=40802393

Polyfill supply chain attack: https://news.ycombinator.com/item?id=40791829

While I appreciate their intention and their transparency on what they're doing, I'll echo other comments here in that I, too, feel a bit uneasy that a 3rd party is rewriting my content.

The good news is that a (strict) CSP can help with that - and they do mention it in their blog post that they don't rewrite anything if there's a CSP header.

It's also worth noting that a (strict) CSP also prevents them from injecting their analytics JS from being injected to your site.

I'm curious as to how Fastly can defend their choice to keep Jake Champion in their employ after the damage he caused by transferring polyfill.io to Funnull[1], triggering this entire incident.

The warning signs should have been obvious. There's no profit to be had in this kind of free CDN.

1. https://x.com/JFSIII/status/1761385341951361182

Looks like it is down at the .io registry level, I am not getting any NS records for polyfill.io

At this point, shouldn't all includes use SRI?

One obvious issue to me is that we have over-centralized the internet on Cloudflare.

That's great they are fixing it on free sites though.

> We have not outright blocked the domain through any of the mechanisms we have because we are concerned it could cause widespread web outages given how broadly polyfill.io is used with some estimates indicating usage on nearly 4% of all websites.

Frankly I find this to be a weak argument. "We'll continue serving malware because broken websites are worse than infected ones" is not a good argument. I'm a cloudflare customer and I think this is a very bad look, even if it does mean websites keep "working."