HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
Yaffle
EventSource
JavaScript2011–2023
Yaffle / EventSource

EventSource

a polyfill for http://www.w3.org/TR/eventsource/

17Distinct people
18Mentions
0Explicit recommenders
2.2KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

a polyfill for http://www.w3.org/TR/eventsource/

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:03:16 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year18 dated mentions

Observed mentions: 2011-12-21 16:59:02 UTC to 2023-03-23 01:34:36 UTC.

02462011-01-01 00:00:00 UTC to 2012-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments20112012-01-01 00:00:00 UTC to 2013-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2013-01-01 00:00:00 UTC to 2014-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2014-01-01 00:00:00 UTC to 2015-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20172018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 6 mentions; 1 submissions, 5 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2023

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20112011-01-01 00:00:00 UTC2012-01-01 00:00:00 UTC202
20122012-01-01 00:00:00 UTC2013-01-01 00:00:00 UTC202
20132013-01-01 00:00:00 UTC2014-01-01 00:00:00 UTC000
20142014-01-01 00:00:00 UTC2015-01-01 00:00:00 UTC202
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC101
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC303
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC101
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC000
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC000
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC000
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC000
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC615
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC101

What Hacker News says

18 sources
This doesn't actually cover the most important part, which is where the response to a chat shows up. Has anyone figured this out? I only looked briefly, but AFAICT, it doesn't show up in the response data in Chrome or Firefox DevTools. I figured it was maybe using WebSockets or Server Sent Events, which apparently don't show up in DevTools in some cases (?). I think this is a Chrome bug [0] [1] and also a Firefox bug [2]. EDIT: It's using EventSource. If you open the debugger and Cmd+Shift+F for `onmessage`, you'll find where it receives the message, and you can add a breakpoint, which you can then right click and change to a logpoint, to log the contents of the message. There is probably a one-liner you could paste into devtools to do some prototype hacking of window.EventSource, but I don't have time to figure that out atm, and can't fi
Read the rest
nd anything in a few quick searches of GitHub code. EDIT EDIT: Just tried Safari, it does indeed show up as a spinner, but I still can't see the actual messages in DevTools. [0] https://github.com/Yaffle/EventSource/issues/79 [1] https://bugs.chromium.org/p/chromium/issues/detail?id=102589... [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1405706
In Everything ChatGPT – under the hood of the ChatGPT web app
It makes me deeply sad to see these sort of interactions in open source [1]. > Hmm, I think it's a worthwhile fix. Where did you see malware here? > I think the author of this repo is free to decide what code he publishes. Say thanks to that it's for free An incredible amount of people have dedicated sweat and tears and foreheads (from banging against the desk in frustration) to open source across the entire stack, from the contributers to OSs such as Linux to those working their arses off to create better frameworks, languages and runtimes, that we can all benefit from and use with a reasonable expectation of security, respect and privacy. As a university student, I feel privileged to have been able to grow up in a world where so much work and knowledge is provided for free with no strings attached, regardless of demographic/location, I
Read the rest
would not be where I am without it. A century ago this would not have been possible. To all of you who have tirelessly and selflessly worked on OSS for others, without expecting anything in return or imposing politics, ideologies, infringing on privacy, causing damage, collecting vast quantities of marketable personal information or monopolisation, I give you my heartfelt thanks for your efforts, you know who you are. You have created something that will have forever helped to improve our society and empower those that want to learn and create their own designs. From my own personal experience, I want to give a shout-out to the smaller projects of Rust, Svelte and Elixir. I think it's incredible that the work and ideas of (often) a single person (Rich Harris, José Valim) can grow into larger extremely welcoming and helpful communities with many more motivated contributors that are proud of being parts of those projets and put in an extraordinary effort to try and do things better than before. I'm sure there are plently of other worthy names I'm too young/ignorant to know. Love it or hate it, Node.js has been very empowering for a large number of people to learn and publish their own full-stack applications, the JavaScript ecosystem has improved enormously since its beginnings, but has a tendancy to change slowly due to its size, unless a disruptive technology comes along such as TypeScript. Websites are a great way to introduce people to the joy of programming with its visual feedback, you can make a small penguin move across the screen, then move on to play tic tac toe. Even as a younger developer, I admit that the days of FTP, no-build-step pages with a sprinkle of JQuery were easier to understand and actually safer for newcomers than introducing someone to a SPA stack (which can easily have thousands of transient dependencies) nowadays. [1]: https://github.com/Yaffle/EventSource/issues/202
In Node.js packages don't deserve trust
> Cool story. Actually, "blacklists", "redlists" and many other "lists of undesirables" weren't cool at all. But every generation or so they unfortunately seem appealing again. > the list that they're discussing has actually existed for 30 years Where is this list? Who maintains it? OC certainly didn't know about it: "We should probably start an open source sanction list of individuals who abuse trust to ship malware" > When you commit a crime "crime"? Please link me to the law you think they broke. Here's the license: https://github.com/Yaffle/EventSource/blob/master/LICENSE.md > THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED So, how is this a "crime"? > that knowledge never disappears in any country Not true in any country except maybe North Korea or some other authoritarian state. In any society with
Read the rest
checks and balances, verdicts can be appealed, judgements reversed, records expunged and rights restored. This "undo" feature is pretty critical to any legitimate system of justice, as is "innocent until proven guilty". I didn't see any details about the rights of the accused in anyone's blacklisting proposals. > None of these address what happened in any way. Yes, it does. MIT licensed software is provided "AS IS, WITHOUT WARRANTY". If you don't like it you can fork it. If you're afraid of a bad commit, vendor it, which is a best practice anyway, for this exact use case. > Relatively easy for the rest of us to see. Our entire legal branch of government exists because these lines are not always easy. Judges judge things all the time, and not uniformly. If everything was easy to see, we wouldn't need judges or juries. The interpretation of language or of an act on a case by case basis is where things get tricky. > The rest of us will act without you At this point I have way more questions: * Would you blacklist this contributor if they documented the Russian timezone popup as a feature in the package as the issue creator suggested (https://github.com/Yaffle/EventSource/issues/202#issuecommen...)? * What "test" would you apply to code to determine if the developer should be blacklisted or not? Would this blacklist only pertain to malware? Wikipedia (https://en.wikipedia.org/wiki/Malware) defines a few different malware categories: "Many types of malware exist, including computer viruses, worms, Trojan horses, ransomware, spyware, adware, rogue software, wiper, and scareware." If the code doesn't fall into one of those categories (as is this case), under what circumstances might you still blacklist the developer? * If a maintainer stops maintaining their current library and says all future maintenance will be done on a new library, and that new library contains this Russian timezone popup code, would they be blacklisted? * Would it matter if the "bad code" was intentional or not? Or a joke or not? Or temporary or not? How would you determine the author's intent? Would they have a chance (or be obligated) to respond? Or would you only look at the impact of the code? If you look at the impact, under what conditions would a "bug" get you blacklisted? * Would you blacklist a developer for making a breaking change to a package? What if the breaking change was politically motivated? * Who runs and maintains the list? Does this list have an appeals process? What are the rights of the accused? * How will you disambiguate the list so as not to misconstrue "innocent" developers as blacklisted developers? Will you include their birth name? Social profiles? Emails? Addresses? How will you deal with name changes (someone gets married, or changes their name?), or new online handles? * What age and definition of a minor will you use? And will minors be given different treatment or excused from the blacklist? I could go on, but if you're serious about this idea, you'll probably want to communicate it in more detail because a "forever list of bad developers" sounds a lot like a "forever list of communists" or a "forever list of undesirables". If you're not going to make the same mistakes McCarthy (and others before him) did where this list turns into a biased weapon of control and intimidation, then these details will be really important.
In NPM package event-source-polyfill compromised by political activists
Why is "compromised by political activists" in the title? "political activists" is 1) plural (wasn't it only 1 committer?) and 2) an opinionated label for someone we don't know much about. Sure, the commit may be an act of political activism, but to label the individual based on this one action seems inappropriate. And "compromised" makes it sound like it's against the will of the maintainers. Do we know that? The commit was 23 days ago. There's an ongoing open discussion here where there are folks defending both sides: https://github.com/Yaffle/EventSource/issues/202 Anyway, a better title might be "event-source-polyfill displays popup about Ukraine in Russian timezones" or if its malware, then "event-source-polyfill affected by malware in Russian timezones"
In NPM package event-source-polyfill compromised by political activists
Reading the source the compromise is on these lines in particular (https://github.com/Yaffle/EventSource/blob/de137927e13d8afac...). To experience the exploit set your computer timezone to any Russian timezone (e.g. asia/omsk) and paste the following data URL to your url bar: data:text/html;charset=utf-8,<!DOCTYPE html><title>EventSource</title><meta charset="utf-8"><script type="module">import "https://unpkg.com/event-source-polyfill@1.0.26"</script> In 15 seconds an alert window will open with a message which translates to: > On February 24, Russia attacked Ukraine. > The people of Ukraine are universally mobilized and ready to defend their country from enemy invasion. 91% of Ukrainians fully support their President Volodymyr Zelensky and his response to the Russian attack. > The whole world condemned the unjustified invasion and d
Read the rest
ecided to impose unprecedented sanctions against Russia. With each new day, they will be felt more and more strongly among civilians. > At the same time, the Russian government restricts citizens' access to external information, planting one-sided formulations and versions of what is happening. > As a reliable source of information, download the secure Tor Browser: > https://www.torproject.org/ > And visit: > https://www.bbcweb3hytmzhn5d532owbu6oqadra5z3ar726vq5kgwwn6a... > Stop this senseless war! Stop war criminal Putin! After you dismiss the alert window a new window will open with the page http://www.change.org/NetVoyne
In NPM package event-source-polyfill compromised by political activists
Websockets would overkill for this kind of feature – you don't need realtime two-way communication. Server sent events (SSE) [1] are a much better alternative; it's a simple, long-lived HTTP request where the server can push data to the client. They're built into most browsers [2], and the client-side polyfill [3] is small (2kb gzipped). [1] https://developer.mozilla.org/en-US/docs/Web/API/Server-sent... [2] http://caniuse.com/#search=server-sent%20events [3] https://github.com/Yaffle/EventSource
In Show HN: Real Time Users – Add a real-time user counter to your site
Nice post, and interesting timing, just published a post on how to do SSE with Java: http://eranmedan.com/server-side-events-sse-in-java and... I must admit the Node.js version is clearly more concise and elegant :) but still this is one of the simplest ways to do server side "push", if only IE supported it... though you can always use a polyfill: https://github.com/Yaffle/EventSource/ (though that polifill didn't work for me for that example, but I didn't spend much time trying to figure out why)
In Server-Sent Events: The simplest realtime browser spec
This is my latest weekend project[1] and first web application written in Go. Go's concurrency model made it very easy to query multiple sites at once and stream the data back to the client. Specifically, I'm creating a Gorountine for each website, sending results to a channel, and then streaming those results back using server-sent events[2]. Server-sent events aren't supported by all browsers, so I'm using Yaffle's EventSource polyfill[3](https://github.com/Yaffle/EventSource). [1]: https://github.com/kyleconroy/handlehelp [2]: https://developer.mozilla.org/en-US/docs/Server-sent_events/... [3]: https://github.com/Yaffle/EventSource
In Show HN: HandleHelp - Easily check username availability across sites

Showing the 15 most recent of 18 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.