Automatically replacing polyfill.io links with Cloudflare’s mirror for a safer Internet
blog.cloudflare.com
polyfill.io, a popular JavaScript library service, can no longer be trusted and should be removed from websites

cross-posted from: https://programming.dev/post/16106778

Contrary to what is stated on the polyfill.io website, Cloudflare has never recommended the polyfill.io service or authorized their use of Cloudflare’s name on their website. We have asked them to remove the false statement, and they have, so far, ignored our requests. This is yet another warning sign that they cannot be trusted.

  • i_am_not_a_robotEnglish
    21·
    4 months ago

    Built bundles are not affected. The service is supposed to figure out which polyfills are required by a particular browser and serve different scripts. Because it’s serving different scripts, the scripts cannot be bundled or secured using SRI. That would defeat the purpose of the service.