Conversation

Notices

1. Beko Pharm (bekopharm@social.tchncs.de)'s status on Wednesday, 11-May-2022 05:45:52 UTC Beko Pharm

   @Johann150 yes, that's true. It made it into ECMAScript 5.1

   Now if you've for _some_ weird reason a system that requries some _older_ build target you get a polyfill.

   That was provided by packages like this and should be helluvEOL nowadays. There are better suited and highly automated polyfills.

   Anyway, the issue is very real. This happened before and will happen again.

   It's also the very same for most language depending package managers out there and this is why version pinning is a thing.

   • Santa Claes 🇸🇪🇭🇰🎅 likes this.
   • Beko Pharm (bekopharm@social.tchncs.de)'s status on Wednesday, 11-May-2022 05:46:14 UTC Beko Pharm

     in reply to

     • Ryuno-Ki

     @RyunoKi …and browser extensions and game mods. Heck, whatever allows to regain access to an account via mail basically.

     No 2FA on your Google Dev account? Too bad 🙃

     Santa Claes 🇸🇪🇭🇰🎅 likes this.
   • Ryuno-Ki (ryunoki@layer8.space)'s status on Wednesday, 11-May-2022 05:46:15 UTC Ryuno-Ki

     in reply to

     @bekopharm
     So it could happen to PyPI (Python), RubyGems (Ruby), Crates (Rust), … too :-(
     @Johann150

     Santa Claes 🇸🇪🇭🇰🎅 likes this.
   • valhalla (valhalla@social.gl-como.it)'s status on Friday, 13-May-2022 00:45:08 UTC valhalla

     in reply to

     • Ryuno-Ki
     @bekopharm @Johann150 @RyunoKi Attacks on PyPI (the one I know best) and the others based on the fact that anybody can upload a new package have already happened and will keep happening.
     
     With npn it happens more often because of the higher visibility, of the culture of tiny libraries that multiplies the attack surface by a few orders of magnitude and other social factors.
     Santa Claes 🇸🇪🇭🇰🎅 likes this.