News for hackers. Stuff that matters.
Re:Polyfill supply chain attack hits 100K+ sites by yesimahuman on Tuesday June 25, 2024 @03:07PM (#40792303)
Does this person telling us not to use polyfill.io, and the guy who sold polyfill.io to the chinese company both work at Fastly? If so, that's kind of awkward...
Re:Polyfill supply chain attack hits 100K+ sites by rafram on Tuesday June 25, 2024 @03:31PM (#40792611)
Seems like it. I hope the money was worth it.
Re:Polyfill supply chain attack hits 100K+ sites by teruakohatu on Tuesday June 25, 2024 @05:15PM (#40793697)
It appears both currently do work for Fastly. I am pleased the Fastly developer advocate warned us, and announced a fork and alternative hosting service:

[1] https://community.fastly.com/t/new-options-for-polyfill-io-u...

But it leaves me with an uneasy feeling about Fastly.

Re:Polyfill supply chain attack hits 100K+ sites by localfirst on Tuesday June 25, 2024 @09:30PM (#40795571)
literally went from cloudflare to fastly and now this stuff happpens....

can't catch a break

Re:Polyfill supply chain attack hits 100K+ sites by linclark on Tuesday June 25, 2024 @06:23PM (#40794354)
Neither of them had ownership of the project, so neither of them were responsible for the sale or benefited from it.

They both simply dedicated a lot of time, care and skill to the project. It's really a shame to see what they spent so much time building and maintaining now being used as a platform to exploit people. I'm sure its extremely disappointing to both of them.

Re:Polyfill supply chain attack hits 100K+ sites by yesimahuman on Tuesday June 25, 2024 @06:33PM (#40794457)
https://web.archive.org/web/20240229113710/https://github.co...

Is JakeChampion not the one who sold the project? His bio says he currently works at Fastly

Re:Polyfill supply chain attack hits 100K+ sites by Sephr on Wednesday June 26, 2024 @04:27PM (#40804254)
Funnull claims that Jake Champion owned the project and transferred it to them as part of an acquisition agreement[1].

1. https://x.com/JFSIII/status/1761385341951361182

Re:Polyfill supply chain attack hits 100K+ sites by shaldengeki on Wednesday June 26, 2024 @05:28PM (#40804803)
The Internet Archive shows the progression of events pretty clearly.

- In ~May 2023, the FT transferred it to Jake Champion: https://web.archive.org/web/20230505112634/https://polyfill....

- In mid-Oct, the site stated it was "Proudly sponsored by Fastly": https://web.archive.org/web/20231011015804/https://polyfill....

- In November 2023, this was dropped: https://web.archive.org/web/20231101040617/https://polyfill....

- In December 2023, JakeChampion made a sequence of edits removing his name from the repo and pointing to "Polyfill.io maintainers": https://github.com/polyfillpolyfill/polyfill-service/commit/... https://github.com/polyfillpolyfill/polyfill-service/commit/...

- In mid-February 2024, the polyfillpolyfill account was created on Github, and took ownership over the repo.

So I think sometime between October 2023 and February 2024, JakeChampion decided to sell the site to Funnull. I think the evidence is consistent with him having made a decision to sell the site to _somebody_ in December 2023, and the deal with Funnull closing sometime early February 2024.