903
submitted 4 months ago* (last edited 4 months ago) by 0x815@feddit.org to c/technology@lemmy.world

Archived link

The polyfill.js is a popular open source library to support older browsers. 100K+ sites embed it using the cdn.polyfill.io domain. Notable users are JSTOR, Intuit and World Economic Forum. However, in February this year, a Chinese company bought the domain and the Github account. Since then, this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io. Any complaints were quickly removed (archive here) from the Github repository.

you are viewing a single comment's thread
view the rest of the comments
[-] douglasg14b@lemmy.world 2 points 4 months ago* (last edited 4 months ago)

I'm not sure if this is just a rhetorical question or a real one?

Because I didn't claim it isn't negligence. It is negligent, however, it is not a problem solvable by just pointing fingers. It's a problem that solvable through more strict regulation and compliance.

Cyber security is almost exactly the same as safety in other industries. It takes the same mindset, it manifests in the same ways under the same conditions, it tends to only be resolved and enforced through regulations....etc

And we all know that safety is not something solvable by pointing fingers, and saying "Well Joe Smo shouldn't have had his hand in there then". You develop processes to avoid predictable outcomes.

That's the key word here, predictable outcomes, these are predictable situations with predictable consequences.


The comment above mine is effectively victim blaming, it's just dismissing the problem entirely instead of looking at solutions for it. Just like an industry worker being harmed on the job because of the negligence of their job site, there are an incredibly large number of websites compromised due to the negligence of our industry.

Just like the job site worker who doesn't understand the complex mechanics of the machine they are using to perform their work, the website owner or maintainer does not understand the complex mechanics of the dependency chains their services or sites rely on.

Just like a job site worker may not have a good understanding of risk and risk mitigation, a software engineer does not have a good understanding of cybersecurity risk and risk mitigation.

In a job site this is up to a regulatory body to define, utilizing the expertise of many, and to enforce this in job sites. On job sites workers will go through regular training and exercises that educate them about safety on their site. For software engineers there is no regulatory body that performs enforcement. And for the most part software engineers do not go through regular training that informs them of cybersecurity safety.

[-] oce@jlai.lu 1 points 4 months ago* (last edited 4 months ago)

I'm not blaming the single person who did a mistake, I'm blaming the negligence of the companies that cut corners for profit, so most of them.

Your first comment read as if organizations where this happens couldn't have bad consequences. Your new comment explains what you meant better, and I agree.

this post was submitted on 26 Jun 2024
903 points (98.9% liked)

Technology

59169 readers
2967 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS