Automatically replacing polyfill.io links with Cloudflare’s mirror for a safer Internet
blog.cloudflare.com
polyfill.io, a popular JavaScript library service, can no longer be trusted and should be removed from websites

cross-posted from: https://programming.dev/post/16106778

Contrary to what is stated on the polyfill.io website, Cloudflare has never recommended the polyfill.io service or authorized their use of Cloudflare’s name on their website. We have asked them to remove the false statement, and they have, so far, ignored our requests. This is yet another warning sign that they cannot be trusted.

  • Avid Amoeba@lemmy.ca
    1·
    5 months ago

    Perfect. This is consistent with what I was thinking and that Cloudflare’s changes won’t fix any recent bundles that might include malicious code.

    • i_am_not_a_robot@discuss.tchncs.deEnglish
      2·
      5 months ago

      Built bundles are not affected. The service is supposed to figure out which polyfills are required by a particular browser and serve different scripts. Because it’s serving different scripts, the scripts cannot be bundled or secured using SRI. That would defeat the purpose of the service.