<story><title>Cloudflare automatically fixes Polyfill.io for free sites</title><url>https://blog.cloudflare.com/automatically-replacing-polyfill-io-links-with-cloudflares-mirror-for-a-safer-internet</url></story><parent_chain><item><author>politelemon</author><text>I totally get the intention behind this and the final outcome is definitely a safer internet. It&amp;#x27;s also somewhat justified considering the author has mentioned they never controlled its domain, yet the library has been distributed through that domain, correct? This is a reflection of the extremely poor security practices in the web development world.&lt;p&gt;At the same time, there is a wrongness in Cloudflare being able to overwrite content and changing the &amp;#x27;truth&amp;#x27;. I&amp;#x27;m like that larry david gif, I just don&amp;#x27;t know how to process this.&lt;p&gt;One more thing to note, if you go to the polyfill repo, they&amp;#x27;ve also mentioned they&amp;#x27;re using Cloudflare to distribute the library.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;polyfillpolyfill&amp;#x2F;polyfill-service&amp;#x2F;commit&amp;#x2F;2ba06045ce67295f622ee79f6fa6b43c13e37d27&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;polyfillpolyfill&amp;#x2F;polyfill-service&amp;#x2F;commit&amp;#x2F;...&lt;/a&gt;</text></item></parent_chain><comment><author>mdasen</author><text>For me, this is why it makes sense: customers on Cloudflare signup (at least in part) for Cloudflare to protect them against attacks.&lt;p&gt;Cloudflare is all about changing the &amp;quot;truth&amp;quot;. When your site is behind Cloudflare, they block many requests to your site. The lock in the browser can be lies. Cloudflare is decrypting that content - and if the site owner hasn&amp;#x27;t setup TLS between Cloudflare and the backend, it&amp;#x27;s being re-transmitted over the internet unencrypted. On paid plans, Cloudflare will compress images and swap in their version. Cloudflare will compress an uncompressed response before returning it. Cloudflare will take the HTML returned by your backend and obfuscate any email addresses in that HTML before sending it along to the browser.&lt;p&gt;Your server returns a page with evil-polyfill&amp;#x2F;bad.js and Cloudflare inspects the HTML and rewrites it to say good-polyfill&amp;#x2F;good.js&lt;p&gt;You might not want this behavior and you can shut it off in Cloudflare, but it seems like a reasonable default given that customers have signed up for a product meant to protect them against attacks. Cloudflare has never been about passing back the raw HTML it receives from the backend or passing along the raw requests it receives from browsers.</text></comment>
<story><title>Cloudflare automatically fixes Polyfill.io for free sites</title><url>https://blog.cloudflare.com/automatically-replacing-polyfill-io-links-with-cloudflares-mirror-for-a-safer-internet</url></story><parent_chain><item><author>politelemon</author><text>I totally get the intention behind this and the final outcome is definitely a safer internet. It&amp;#x27;s also somewhat justified considering the author has mentioned they never controlled its domain, yet the library has been distributed through that domain, correct? This is a reflection of the extremely poor security practices in the web development world.&lt;p&gt;At the same time, there is a wrongness in Cloudflare being able to overwrite content and changing the &amp;#x27;truth&amp;#x27;. I&amp;#x27;m like that larry david gif, I just don&amp;#x27;t know how to process this.&lt;p&gt;One more thing to note, if you go to the polyfill repo, they&amp;#x27;ve also mentioned they&amp;#x27;re using Cloudflare to distribute the library.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;polyfillpolyfill&amp;#x2F;polyfill-service&amp;#x2F;commit&amp;#x2F;2ba06045ce67295f622ee79f6fa6b43c13e37d27&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;polyfillpolyfill&amp;#x2F;polyfill-service&amp;#x2F;commit&amp;#x2F;...&lt;/a&gt;</text></item></parent_chain><comment><author>madeofpalk</author><text>&amp;gt; At the same time, there is a wrongness in Cloudflare being able to overwrite content and changing the &amp;#x27;truth&amp;#x27;.&lt;p&gt;This is one of the many features of Clouldflare though, that you can enable additional features that modify your website in various ways - whether it&amp;#x27;s image resizing or analytics or security scanning.&lt;p&gt;If you don&amp;#x27;t trust Cloudflare to deliver your website, then you shouldn&amp;#x27;t use Cloudflare.</text></comment>