Modernizr website is out of date

[KevinLaity]

The modernizr.com website hasn't been updated since 2017 and the latest version downloadable version there is 3.6.0. This can mislead users into thinking that that is in fact the latest version. It could also encourage the use of this older version because it is the easiest way to build and install the library.

Version 3.6.0 has been flagged by our security auditors as being a security risk, because it is out of date.

Please update the modernizr.com website, either by updating the version served there, or by retiring the custom build page and pointing to the github page, to prevent users from using a version of the library that carries potential security risks.

[Markel]

Hi @KevinLaity 👋👋

Yeah we're pretty aware of that, @patrickkettner manages the website and he doesn't have the time to update it. Don't know what to say apart from that 🙃

Sorry for the inconvenience, in the meantime you may build your file from one of the releases here on Github.

[rejas]

I can only reiterate what Markel wrote, Sorry for the inconvenience, but this is out of my or his hands right now :-(

[KevinLaity]

It sounds like you've lost the ability to update the website. Can you at least stop pointing to it then? The comments of the built library still point to it as though it were the canonical home of modernizr.

Possibly add a warning to the Github page not to use it?

You might be putting users of modernizr at risk by leaving things as-is. My concern is not about my ability to build it.

[Markel]

Yeah there was an attempt of adding a note in #2481, but it seems like some problems arose (right now http://new.modernizr.com throws a 405 when you try to build anything). I guess a solution could be to modify the Readme in a way in which we suggest more to use a platform like npm, which actually has the last version (I actually don't know who updates it, gonna guess that @rejas?), make it more prominent than the current _Install dependencies npm install_ (which I'm not sure it refers to installing Modernizr from npm).

That would alleviate some of the costs of the server (or no?, I actually don't know) and make it more likely that developers who stumble upon the Github to use npm (we can't update the website so we cannot do anything about the ones that enter to the website). On the other end, I also love the website so I would love that people could use it securely and with the last version over using something like npm and that's why a super alert saying _Hey don't use the website_ would break my heart.

But hey, in the end you (me) just bear with the fact that this is a backlog issue that bothers everyone but nobody can solve and you move on; I have a degree to get, I'm not even an official member of the team, I guess @rejas works and has his life, etc. I don't know... Any opinions are welcomed and thank you for reading about my life in this last paragraph :) Stay safe.

EDIT: Thank you for your concerns @KevinLaity btw

[foosel]

Is it just me or is the website now completely down? In FF I get a protocol violation, and Chrome shows what seems to be a domain squatter in action.

[Markel]

Yeah @foosel, strange, some Whois say that the domain expired like 3 days ago while others say that the domain has been renovated. @patrickkettner you may want to check on this :upside_down_face:. But yeah, the http version is a domain squatter from namecheap while the https version, well namecheap couldn't care less about it and it just throws an error. You may build it from one of the Github Releases (or from npm) in the meantime.

[foosel]

@Markel thanks, that's exactly what I did already, just figured I'd send y'all a heads-up here too that something's up.

[Markel]

If someone arrives here and wants to see a status page here you have https://status.markel.dev/786965594 (I don't promise it will be up for all the eternity so take that into account if you're reading this 2 years/months from now).

PD: If you're in the present, don't check the main domain, is garbage and outdated :upside_down_face: (and incompatible with chrome)

[rejas]

I started a discussion on the future of the website (https://github.com/Modernizr/Modernizr/discussions/2635) in the hope of getting the outdatedness fixed once and for all.
Yes, I am updating npm when a new release is due. But unfortunatly only @patrickkettner seems to be able to update the website so we are stuck with it (or maybe just lost it, I dont know).
I will add a note to the github readme, anything else is out of my reach.
Thanks for your headsup @foosel (love your work :-) and @KevinLaity

[foosel]

You might also want to remove the homepage link associated with the repository for now:

Maybe point it to the npm listing for now?

[rejas]

Good catch, changed it. Thx!