Hugo and S3 buckets. Have a Docker image that does the builds and deploys. All triggered on git push using Bitbucket Pipelines https://github.com/rabidgremlin/hugo-s3
Ask HN: Most Sites Don't Use a CMS Like Wordpress – What Non-CMS Do You Use?
51–60 of 74 posts
Re: Ask HN: Most Sites Don't Use a CMS Like Wordpress – What Non-CMS Do You Use?
#52I wonder what percentage of websites created by non-technical people are hosted using SaaS that's technically a CMS but isn't standalone -- e.g. Squarespace or Blogspot or Google Sites?
Re: Ask HN: Most Sites Don't Use a CMS Like Wordpress – What Non-CMS Do You Use?
#53Some good answers here. Interestingly (for me), I've started going back to building more or less static sites for clients. I used Wordpress for a long time, but have increasingly found none of them want to blog, and few of them update either the site (or Wordpress, which can end up a security nightmare). Often when it came to updating pages, they would call or email and say "can you do XXX", to which I'd reply "I can…
I am going through a similar transition. Moving my ten odd Drupal sites I built for family and friends to Hugo. In other cases just plain HTML using WinHttrack to download HTML version of site as is. I will convert to Hugo if need arises.
Only one user from the 10 ever used the CMS functionality to modify her site. She did it the one year, totally forgot her password and the following year asked me to make the changes. Maintenance of a CMS is even more of a struggle if that isn't your core job. If I worked on Drupal for my day job I wouldn't leaving the sites on Drupal.
Re: Ask HN: Most Sites Don't Use a CMS Like Wordpress – What Non-CMS Do You Use?
#54This 57% sounds horribly wrong. They don't really explain how they come to this conclusion here: https://w3techs.com/technologies My gut feeling is that 57% is a huge number if you assume that they don't use a CMS. I don't think that's manageable by the average owner with static site generators. None of my clients would be able to update their site with GIT + text editors. It's more likely that there's some kind of b…
Well, that's 57% that they could identify and that they happened to classify that way. There are lots of ways to obscure what's running and many more platforms out there.
Re: Ask HN: Most Sites Don't Use a CMS Like Wordpress – What Non-CMS Do You Use?
#55Earlier quoted context omitted.
Security updates for instance.
Maybe it's a failure of imagination but I'm struggling to think of how a static site generator could need a security update?
The basic problem of security: They just need to find one attack path. You need to defend all, even the ones you don't know.
Re: Ask HN: Most Sites Don't Use a CMS Like Wordpress – What Non-CMS Do You Use?
#56For my personal website, I wrote a backend in Haskell: https://github.com/myfreeweb/sweetroll after trying a lot of static generators, writing Dropbox-backed blog engines, etc. It uses the Micropub protocol for posting/editing/deleting (I also made a frontend editor app for Micropub: https://github.com/myfreeweb/micro-panel ), Webmention for talking to other websites, Git+JSON to store content. I don't like the PHP/M…
Firstly, sweetroll looks amazingly cool and being able to add javascript plugins seems like a great idea.
Second, have you looked at clckwrks[0]? It aims to specifically dethrone wordpress by making plugins that are provably safe. I think this is a viable way to attack wordpresses stronghold, though I think being able to do things like write plugins based in javascript or other popular languages when an existing provably safe plugin doesn't exist will also be necessary.
Last time I tried clckwrks it was a bit hard to get setup (this was pre-stack) so I don't blame you for rolling your own solution.
I do wonder what you think of clckwrks and the idea of exploiting Haskell to make provably safe plugins so you can create a large ecosystem without the security issues that wordpress plugins have.
Re: Ask HN: Most Sites Don't Use a CMS Like Wordpress – What Non-CMS Do You Use?
#57Void[0], vim, git and ssh do the job for me.
Re: Ask HN: Most Sites Don't Use a CMS Like Wordpress – What Non-CMS Do You Use?
#58I've been using Nanoblogger, a Bash-based static website generator, for about ten years. It hasn't been updated in the last four, and indeed is still hosted on SourceForge. I could switch to something newer and better, but why bother?
> I could switch to something newer and better, but why bother? Since it's not maintained, personally I'd be tempted to try transitioning to something that is (with minimal change to content and structure/configuration required) to save dealing with it when you're just trying to publish new content and suddenly run up against some bug.
OTOH, if it's worked fine for ten years, the risk of headaches seems lower than anything else.
And for any given static site generator, there's a pretty high risk it will be more or less unmaintained two years from now...
Re: Ask HN: Most Sites Don't Use a CMS Like Wordpress – What Non-CMS Do You Use?
#59I kind of like to use XSLT and xsltproc.
Re: Ask HN: Most Sites Don't Use a CMS Like Wordpress – What Non-CMS Do You Use?
#60Earlier quoted context omitted.
Maybe it's a failure of imagination but I'm struggling to think of how a static site generator could need a security update?
The basic problem of security: They just need to find one attack path. You need to defend all, even the ones you don't know.
Any attack against nanoblogger would be an "on the other side of this airtight hatchway" attack https://blogs.msdn.microsoft.com/oldnewthing/20100114-00/?p=...
Nanoblogger is a bash script in my home directory. To add an entry, I ssh into the web server, give it the text of the post, and it generates a bunch of HTML and writes it to /srv. It is only run to create a new post. It doesn't listen on a port, or talk to the outside world at all.
An attacker could theoretically edit the bash script to do something nefarious... but if they had write access to my home directory they would just edit .bashrc. An attacker could leverage some kind of hole in nginx, (plus a permission elevation vuln, since www-user can't do much) but by then you already own the box, and don't need to bother with nanoblogger. You could ssh in as me, then do something tricky with the script... but if you're logged in as me you own the box. Etc etc etc.
Nanoblogger has about as much attack surface as a rock.