fork status considering what happened to original project

[kapouer]

Hi,

I'm using polyfill-library in a project that doesn't do user-agent recognition, and rather do feature detection.
It works pretty well, however polyfill-library is really nice since it maintains a coordinated library of polyfills.
Since your fork seems to be maintained, it would be nice to show an official statement about why and how it's going to be maintained ?

[romainmenke]

Hi @kapouer,

Thank you for your interest.

I am unsure what such a statement would look like and where we should display this.
I can speak for Mr. Henry and say that polyfills are an integral part to how we build websites and this will continue to be so.
We strongly believe that the web should be open to all, even those on older browser versions.

We might vary in how much time we can allocate to it. Currently we have less time than we would like at Mr. Henry, this will hopefully improve again. But at no point are we considering halting our contributions or no longer hosting this project.

@mhassan1 is also a very active member, helping us maintain this project.

[kapouer]

Well, I guess the spirit would be something like "we are committed to maintain this fork, since the original went away" would be more than enough.
Original project was lagging behind and scarcely approved pull requests, so potential contributors need to be reassured about that, maybe.
Actually any acknowledgement about the fork situation would boost it.

[romainmenke]

A proposal to acknowledge the situation at the bottom of the README.md:

## History

### Financial Times era

The `polyfill-library` and the `polyfill.io` service were originally created within the Financial Times.  
The combination of Internet Explorer lagging behind,  
a wide range of new and polyfillable features  
and the rise of a JavaScript first mindset made this a very successful project.

### Sale of `polyfill.io`

Around 2022 the Financial Times lost interest and the active maintainers inside the company were leaving or already left.  
The Financial Times together with Fastly eventually decided to hand control over to Jake Champion,  
one of the core maintainers who was leaving the Financial Times to go work for Fastly.

Mr. Henry was initially approached to take over but no meetings actually took place.  
We've been told this was blocked by Fastly who did not consider Mr. Henry to be a safe option.

Early 2024 the `polyfill.io` domain and service were sold to Funnull, a Chinese company, by Jake Champion.  
Other maintainers were not aware that a sale was even being considered and this caught everyone by surprise.

We immediately moved to secure the git history of the `polyfill-library`  
and created a hard fork based on a state we could prove was unaltered.

Shortly after we rolled out an `npm` release  
and started clearing the dependency tree of packages that were in any way controlled by Jake Champion.

Mid 2024 reports surfaced that the `polyfill.io` service was injecting malware into polyfill bundles.  
The wider internet community moved to shut down the service.

### Going forwards

Mr. Henry is a web and design agency and the current steward of the `polyfill-library`.
We value long term support and strongly believe that everyone should have access to the web.

We had been contributing to the `polyfill-library` for several years while it was still maintained by the Financial Times.

Continuing the `polyfill-library` project is a good fit for us  
and helps us make sites that work for everyone, even users on older browser versions.

Things we will try to do:
- keep up with maintenance and security issues
- keep the test framework running
- welcome contributions
- welcome new members

Things we will never do:
- monetize this project or create a service around it that could be monetized or sold
- add any form of tracking or metrics
- delete this project

@fd, @mhassan1 I would love to hear your thoughts and ideas on this.

I am not sure if we should name Jake Champion, but on the other hand I also don't like using the "the situation" euphemism.
I think we can factually state what happened and who did what.

If there are no objections I will open a PR with this draft and we can work out the detail there.

[mhassan1]

LGTM

[kapouer]

Any sources for the facts about Jake Champion selling the domain ? It's somewhat legally dangerous not to have some.

[romainmenke]

I have a saved screenshot of these and now it will forever be part of this issue:

I don't think there is any legal risk here.
We are not stating any opinions about Jake, the Chinese company or the nature of the sale.
We are not including any speculation or omitting things that might change how this appears.

[fd]

Looks good to me too.

There are plenty of other sources, Cloudflare etc, documenting the same facts and timeline.

• https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-your-supply-chain-risk/
• https://blog.cloudflare.com/automatically-replacing-polyfill-io-links-with-cloudflares-mirror-for-a-safer-internet/
• https://www.theregister.com/2024/06/25/polyfillio_china_crisis/
• https://sansec.io/research/polyfill-supply-chain-attack

[kapouer]

Yes, but none of them mention Jake Champion. The screenshot above doesn't say he sold the domain either. So the affirmation here is sourceless, making it attackable.

[romainmenke]

It doesn't :)

Jake Champion was the owner, It was his and his alone to sell.
That it was sold means that he sold it.

This was also mentioned on polyfill.io itself by the Financial Times shortly before the transfer from FT to Jake:

https://github.com/polyfillpolyfill/polyfill-service/blob/7f712528d8677834c484405d7f52ac359878e2c7/src/assets/v3/ownership-transfer.njk#L10

We have therefore made the decision to transfer ownership to Jake Champion who, at FT and Fastly, has been the core maintainer for most of the polyfill service’s life.