cross-posted from: https://programming.dev/post/16106778

Contrary to what is stated on the polyfill.io website, Cloudflare has never recommended the polyfill.io service or authorized their use of Cloudflare’s name on their website. We have asked them to remove the false statement, and they have, so far, ignored our requests. This is yet another warning sign that they cannot be trusted.

  • Avid Amoeba@lemmy.ca
    link
    fedilink
    arrow-up
    1
    arrow-down
    1
    ·
    4 months ago

    Perfect. This is consistent with what I was thinking and that Cloudflare’s changes won’t fix any recent bundles that might include malicious code.

    • i_am_not_a_robot@discuss.tchncs.de
      link
      fedilink
      English
      arrow-up
      2
      arrow-down
      1
      ·
      4 months ago

      Built bundles are not affected. The service is supposed to figure out which polyfills are required by a particular browser and serve different scripts. Because it’s serving different scripts, the scripts cannot be bundled or secured using SRI. That would defeat the purpose of the service.