Polyfill supply chain attack hits 100K+ sites

Re:Polyfill supply chain attack hits 100K+ sites by Cthulhu_ on Tuesday June 25, 2024 @03:55PM (#40792860)

If you have hundreds of millions of pageviews, go with a trusted party - someone you actually pay money to - like Cloudflare, Akamai, or any major hosting / cloud party. But not to increase cache hit rate (what CDNs were originally intended for), but to reduce latency and move resources to the edge.

[ Parent | on HN ]

Re:Polyfill supply chain attack hits 100K+ sites by bawolff on Tuesday June 25, 2024 @04:01PM (#40792940)

Does it even reduce latency that much (unless you have already squeezed latency out of everything else that you can)?

Presumably your backend at this point is not ultra optimized. If you send a link header and using http/2 the browser will download the js file while your backend is doing its thing. I'm doubtful that moving js to the edge would help that much in such a situation unless the client is on the literal other side of the world.

There of course comes a point where it does matter, i just think the cross over point is way later than people expect.

[ Parent | on HN ]

Re:Polyfill supply chain attack hits 100K+ sites by smaudet on Tuesday June 25, 2024 @04:06PM (#40792982)

> Does it even reduce latency that much

Absolutely:

https://wondernetwork.com/pings/

Stockholm <-> Tokyo is at least 400ms here, anytime you have multi-national sites having a CDN is important. For your local city, not so much (and of course you won't even see it locally).

[ Parent | on HN ]

Re:Polyfill supply chain attack hits 100K+ sites by bawolff on Tuesday June 25, 2024 @06:22PM (#40794350)

I understand that ping times are different when geolocated. My point was that in fairly typical scenarios (worst cases are going to be worse) it would be hidden by backend latency since the fetch could be concurrent with link headers or http 103. Devil in details of course.

[ Parent | on HN ]

Re:Polyfill supply chain attack hits 100K+ sites by a2800276 on Tuesday June 25, 2024 @04:22PM (#40793149)

I'm so glad to find some sane voices here! I mean, sure, if you're really serving a lot of traffic to Mombasa, akamai will reduce latency. You could also try to avoid multi megabyte downloads for a simple page.

[ Parent | on HN ]

Re:Polyfill supply chain attack hits 100K+ sites by jsheard on Tuesday June 25, 2024 @04:34PM (#40793271)

Content: 50KB

Images: 1MB

Javascript: 35MB

Fonts: 200KB

Someone who is good at the internet please help me budget this. My bounce rate is dying.

[ Parent | on HN ]

Re:Polyfill supply chain attack hits 100K+ sites by bawolff on Tuesday June 25, 2024 @06:25PM (#40794380)

While there are lots of bad examples out there - keep in mind its not quite that straight forward as it can make a big difference whether those resources are on the critical path that blocks first paint or not.

[ Parent | on HN ]

Re:Polyfill supply chain attack hits 100K+ sites by jenadine on Tuesday June 25, 2024 @05:21PM (#40793765)

What's all that JavaScript for?

[ Parent | on HN ]

Re:Polyfill supply chain attack hits 100K+ sites by ozzcer on Tuesday June 25, 2024 @06:04PM (#40794205)

Cookie banner

[ Parent | on HN ]

Re:Polyfill supply chain attack hits 100K+ sites by josephg on Tuesday June 25, 2024 @04:52PM (#40793456)

It’s not an either or thing. Do both. Good sites are small and download locally. The CDN will work better (and be cheaper to use!) if you slim down your assets as well.

[ Parent | on HN ]

Re:Polyfill supply chain attack hits 100K+ sites by akira2501 on Tuesday June 25, 2024 @05:57PM (#40794136)

> But not to increase cache hit rate (what CDNs were originally intended for)

Was it really cache hit rate of the client or cache hit rate against the backend?

[ Parent | on HN ]

Re:Polyfill supply chain attack hits 100K+ sites by matsur on Wednesday June 26, 2024 @11:33AM (#40801215)

Both.

[ Parent | on HN ]