Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

From the PR:

> fetch() broken on August 19: TypeError: ...

Not broken at this version, broken on August 19. This is why I'm terrified of putting anything on the web. It is a dark scary place where runtime dependency on servers that you don't control is considered normal.

One day I'll start my own p2p thing with just a bunch of TUI's and I'll only manage to convince six people to use it each for less than a month and then I'll have to go get a real job again but at least I won't have been at the mercy of PostHog.



> Not broken at this version, broken on August 19. This is why I'm terrified of putting anything on the web. It is a dark scary place where runtime dependency on servers that you don't control is considered normal.

Yeah, that is terrifying. In a nearby comment [1], a PostHog co-founder wrote this affected sites which "did not have a specific version of the JS library pinned and deployed a new version, or were using the snippet". I gather from that is it possible to pin the version, and this incident highlights the value of doing so.

[1] https://news.ycombinator.com/item?id=41301008


I'd prefer a something where such references are resolved by cryptographic hash so that there's never any ambiguity re: what you're actually getting.

Unison does this I believe.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: