Re:Polyfill supply chain attack hits 100K+ sites
by silverwind on Tuesday June 25, 2024 @04:16PM
(#40793086)
The assumption of many npm packages is that you have a bundler and I think rightly so because that leaves all options open regarding polyfilling, minification and actual bundling.
[ Parent
| on HN ]
Re:Polyfill supply chain attack hits 100K+ sites
by jacobsenscott on Tuesday June 25, 2024 @04:40PM
(#40793332)
polyfilling and minification both belong on the ash heap of js development technologies.
Re:Polyfill supply chain attack hits 100K+ sites
by benregenspan on Tuesday June 25, 2024 @04:53PM
(#40793469)
I would agree with you if minification delivered marginal gains, but it will generally roughly halve the size of a large bundle or major JS library (compared to just gzip'ing it alone), and this is leaving aside further benefits you can get from advanced minification with dead code removal and tree-shaking. That means less network transfer time and less parse time. At least for my use-cases, this will always justify the extra build step.
Re:Polyfill supply chain attack hits 100K+ sites
by out-of-ideas on Tuesday June 25, 2024 @06:33PM
(#40794453)
I really miss the days of minimal/no use of JS in websites (not that I want java-applets and Flash LOL). Kind of depressing that so much of the current webdesign is walled behind javascript.
Re:Polyfill supply chain attack hits 100K+ sites
by brianwawok on Tuesday June 25, 2024 @07:40PM
(#40794954)
I don’t. Always Craigslist and hacker news to give that 2004 UX.
Re:Polyfill supply chain attack hits 100K+ sites
by sandwitches on Tuesday June 25, 2024 @09:56PM
(#40795685)
Cool, I can download 20 MB of JavaScript instead of 40. Everyone uses minification, and "web apps" still spin up my laptop fans. Maybe we've lost the plot.
Re:Polyfill supply chain attack hits 100K+ sites
by girvo on Tuesday June 25, 2024 @08:00PM
(#40795096)
I wish. When our bundles are being deployed globally and regularly opened on out of date phones and desktops, it can't be avoided yet.
Re:Polyfill supply chain attack hits 100K+ sites
by lostmsu on Wednesday June 26, 2024 @02:55AM
(#40797121)
There might be a negative incentive in play: you may be compressing packages, but having your dependencies available at the tip of *pm install bloats overall size and complexity beyond what lack of bundling would give you.