Polyfill supply chain attack hits 100K+ sites

Re:Polyfill supply chain attack hits 100K+ sites by baq on Tuesday June 25, 2024 @04:00PM (#40792919)

> I guess my question is why your employer or any other org would not follow the model above?

When you look at Artifactory pricing you ask yourself 'why should I pay them a metric truckload of money again?'

And then dockerhub goes down. Or npm. Or pypi. Or github... or, worst case, this thread happens.

[ Parent | on HN ]

Re:Polyfill supply chain attack hits 100K+ sites by alephnerd on Tuesday June 25, 2024 @04:21PM (#40793146)

I just gave Artifactory as an example. What about GHE, self-hosted GitLab, or your own in-house Git?

Edit: was thinking - would be a pain in the butt to manage. That tracks, but every org ik has some corporate versioning system that also has an upsell for source scanning.

(Not being facetious btw - genuinely curious)

[ Parent | on HN ]

Re:Polyfill supply chain attack hits 100K+ sites by baq on Tuesday June 25, 2024 @05:15PM (#40793700)

I've been a part of a team which had to manage a set of geodistributed Artifactory clusters and it was a pain in the butt to manage, too - but these were self-hosted. At a certain scale you have to pick the least worst solution though, Artifactory seems to be that.

[ Parent | on HN ]

Re:Polyfill supply chain attack hits 100K+ sites by mrighele on Tuesday June 25, 2024 @05:28PM (#40793842)

There are cheaper or free alternatives to Artifactory. Yes they may not have all of the features but we are talking about a company that is fine with using a random CDN instead.

Or, in the case of javascript, you could just vendor your dependencies or do a nice "git add node_modules".

[ Parent | on HN ]