OUTBREAK: index-sw-9a4c43b4b4778e7d1ca619eaaf5ac1db.js

on YouTube ↗25m

" summary

A production release of index-sw-9a4c43b4b4778e7d1ca619eaaf5ac1db.js contains a typo that lets broken scripts install as zombie ServiceWorkers, infecting tens of thousands of clients and triggering more than 2,000 error reports in 24 hours. Root cause: cache API missing in Chrome <46 combined with a swallowed promise rejection so broken installs persist. Remediations shown: never rename the file, check response.ok, avoid globals, and deploy a suicide service worker or use SW test / SW tester to verify fixes.

AI-written summary · about

" chapters (9)

1. 0:00Start
2. 4:56ACT 6
3. 9:14SERVICEWORKER, WHAT'S THE STORY?
4. 13:06SERVICEWORKER LIFECYCLE
5. 13:17SERVICEWORKER REGISTRATION
6. 13:59SERVICE WORKER REGISTRATION
7. 15:54SERVICEWORKER INSTALLATION
8. 18:30SERVICEWORKER ACTIVATION
9. 19:13SERVICEWORKER RUNNING

" related talks

• 23mOUTBREAK: index-sw-9a4c43b4b4778e7d1ca619eaaf5ac1db.jsAlexander Pope · JS Kongress 2017
• 01h 04mJavaScript's Most WantedTodd H. Gardner · NDC Sydney 2016
• 30mWeb Service Workers - Breaking The Web Because It Would Be A Sh...Eduardo Vela Nava · OWASP AppSec Research (AppSecEU) 2015
• 33mService WorkersPatrick Kettner · NDC Sydney 2017
• 42mHow Do Service Workers Even?Abraham Williams, Pearl Latteier · Mobile Era 2018
• 29mService Workers: understand and useStepan Suvorov · angularday 2022
• 35mTame your service worker [...]Maxim Salnikov · Best of Web 2018
• 41mThe Insecurity Caused By Trusting Your Client-Side StorageBen Stock, Marius Steffens · OWASP Global AppSec Amsterdam 2019