<story><title>Polyfill supply chain attack hits 100K+ sites</title><url>https://sansec.io/research/polyfill-supply-chain-attack</url></story><parent_chain><item><author>program_whiz</author><text>Game theory at work?  Someone needs to maintain legacy code for free that hosts thousands of sites and gets nothing but trouble (pride?) in return.  Meanwhile the forces of the world present riches and power in return to turn to the dark side (or maybe just letting your domain lapse and doing something else).&lt;p&gt;If security means every maintainer of every OSS package you use has to be scrupulous, tireless, and not screw up for life, not sure what to say when this kind of thing happens other than &amp;quot;isn&amp;#x27;t that the only possible outcome given the system and incentives on a long enough timeline?&amp;quot;&lt;p&gt;Kind of like the &amp;quot;why is my favorite company monetizing now and using dark patterns?&amp;quot;  Well, on an infinite timeline did you think service would remain high quality, free, well supported, and run by tireless, unselfish, unambitious benevolent dictators for the rest of your life? Or was it a foregone question that was only a matter of &amp;quot;when&amp;quot; not &amp;quot;if&amp;quot;?</text></item></parent_chain><comment><author>causal</author><text>It seems when proprietary resources get infected it&amp;#x27;s because hackers are the problem, but when open source resources get infected its a problem with open source.&lt;p&gt;But there isn&amp;#x27;t any particular reason why a paid&amp;#x2F;proprietary host couldn&amp;#x27;t just as easily end up being taken over &amp;#x2F; sold to a party intending to inject malware. It happens all the time really.</text></comment>
<story><title>Polyfill supply chain attack hits 100K+ sites</title><url>https://sansec.io/research/polyfill-supply-chain-attack</url></story><parent_chain><item><author>program_whiz</author><text>Game theory at work?  Someone needs to maintain legacy code for free that hosts thousands of sites and gets nothing but trouble (pride?) in return.  Meanwhile the forces of the world present riches and power in return to turn to the dark side (or maybe just letting your domain lapse and doing something else).&lt;p&gt;If security means every maintainer of every OSS package you use has to be scrupulous, tireless, and not screw up for life, not sure what to say when this kind of thing happens other than &amp;quot;isn&amp;#x27;t that the only possible outcome given the system and incentives on a long enough timeline?&amp;quot;&lt;p&gt;Kind of like the &amp;quot;why is my favorite company monetizing now and using dark patterns?&amp;quot;  Well, on an infinite timeline did you think service would remain high quality, free, well supported, and run by tireless, unselfish, unambitious benevolent dictators for the rest of your life? Or was it a foregone question that was only a matter of &amp;quot;when&amp;quot; not &amp;quot;if&amp;quot;?</text></item></parent_chain><comment><author>program_whiz</author><text>in a strange way, this almost makes the behavior of hopping onto every new framework rational.  The older and less relevant the framework, the more the owner&amp;#x27;s starry-eyed enthusiasm wears off.  The hope that bigcorp will pay $X million for the work starts to fade.  The tedium of bug fixes and maintenance wears on, the game theory takes it&amp;#x27;s toll.  The only rational choice for library users is to jump ship once the number of commits and hype starts to fall -- that&amp;#x27;s when the owner is most vulnerable to the vicissitudes of Moloch.</text></comment>