Namecheap Takes Down Polyfill.io Service Following Supply Chain Attack | Hacker News Reader

Namecheap Takes Down Polyfill.io Service Following Supply Chain Attack

socket.dev

42 pointsfeross9 comments

They criticize Namecheap for being slow, but is 1 day slow? Who here would pull the plug on a domain relied on by hundreds of thousands of sites faster than that? I get the desire to shut it down instantly, but do we really want registrars taking domains offline in less than a day?

There’s got to be significant liability concerns when you’re doing something that could impact hundreds of thousands of sites. It’s kind of a tough spot to be in, isn’t it?

Definitely not slow, also as we speak the "googie-anaiytics" registered with Godaddy is still active.

As long as GD is getting paid their fees I think they DGAF.

For what it's worth, that's just a tweet embedded on the page, not written by the author of the article. Inflammatory remarks like that are par the course for Twitter.

This is why Mozilla should stop bothering with the ESR version of Firefox. Too many features of it have to be polyfilled. The ESR cycle made sense when XUL was a thing, but now the extension APIs have been overhauled it should be easier for everyone to use the same browser version and tell outdated browsers to upgrade instead of having to backport features. Microsoft is also to blame here by making new versions of Windows abusive so people stick with outdated OS versions which only have ESR browsers. I just hope someone finds an unpatchable flaw in MS accounts so Microsoft is forced to go back to local accounts in Windows 12.

Out of curiosity, does anyone know of any other cases of registrars taking down domains for serving malware? Is this a common practice?

Namecheap does it a ton, probably the most responsive registrar when it comes to abuse.

Typically with registrars I just get told to take it up with the hosting provider instead. I've also been told by registrars they just won't act without a warrant.

I assume it happens all the time for investigations; for example, those headed by Microsoft’s anti-malware team, which posts often enough about such takedowns. Domain registrars do have terms of service that can be enforced against malware sites.

> Namecheap expressly reserves the right to deny, cancel, terminate, suspend, lock, or modify access to (or control of) any account or any Services (including the right to cancel or transfer any domain name registration) for any reason (as determined by Namecheap in its sole and absolute discretion

> Polyfill.io has been serving malware for months via its CDN, after the project's open source maintainer sold the service to a company based in China.

Nobody could have predicted this /s

Reply on news.ycombinator.com