Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Most Sites Don't Use a CMS Like Wordpress – What Non-CMS Do You Use?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 74 posts

Re: Ask HN: Most Sites Don't Use a CMS Like Wordpress – What Non-CMS Do You Use?

#61

Post by glinskik »

crisnoble wrote: post #49
glinskik wrote: post #28

I use middlemanapp.com and deploy to s3 with cloudfront and then use lambda/apigateway for the 2 backend operations I need.

I would love to learn more about the lambda/apigateway part, I too need two backend operations on an otherwise static site, mailchimp signup and contact form submission. I am new to AWS, but I am pretty sure lambda could handle this, do you have suggestions on where I could learn more about setting something like this up?

contact form submission is the main use case for us. API gateway doesn't support form data so it will have to be an ajax post. Just found this blog which is the same use case I have https://codehabitude.com/2016/04/05/forms-to-emails-using-aw...

Re: Ask HN: Most Sites Don't Use a CMS Like Wordpress – What Non-CMS Do You Use?

#62

Post by kijin »

cdevs wrote: post #46
kijin wrote: post #18

A single file named `index.php` that loads a bunch of text files and spits out what looks vaguely like a blog. It's a total mess. Business logic and HTML snippets scattered everywhere. Layers of caching to make the whole thing load in less than 0.03 seconds on cheap shared hosting. I'm sure I do a much better job for paying clients, but somehow never get around to fixing the decade-old garbage that runs my own site.…

Could still be if file_exist then read file despite where or what file , it's the 2nd most common security hole I have seen behind sql injection.

The script just preloads every file in a hard-coded directory into an associative array and uses isset() to check if the requested post exists. So no arbitrary file access, either.

Re: Ask HN: Most Sites Don't Use a CMS Like Wordpress – What Non-CMS Do You Use?

#64

Post by tome »

codygman wrote: post #56
floatboth wrote: post #9

For my personal website, I wrote a backend in Haskell: https://github.com/myfreeweb/sweetroll after trying a lot of static generators, writing Dropbox-backed blog engines, etc. It uses the Micropub protocol for posting/editing/deleting (I also made a frontend editor app for Micropub: https://github.com/myfreeweb/micro-panel ), Webmention for talking to other websites, Git+JSON to store content. I don't like the PHP/M…

Firstly, sweetroll looks amazingly cool and being able to add javascript plugins seems like a great idea. Second, have you looked at clckwrks[0]? It aims to specifically dethrone wordpress by making plugins that are provably safe. I think this is a viable way to attack wordpresses stronghold, though I think being able to do things like write plugins based in javascript or other popular languages when an existing prov…

[0] http://www.clckwrks.com/page/view-page-slug/1/clckwrks-com

Re: Ask HN: Most Sites Don't Use a CMS Like Wordpress – What Non-CMS Do You Use?

#65

Post by erikb »

sbierwagen wrote: post #60
erikb wrote: post #55

Earlier quoted context omitted.

The basic problem of security: They just need to find one attack path. You need to defend all, even the ones you don't know.

Any attack against nanoblogger would be an "on the other side of this airtight hatchway" attack https://blogs.msdn.microsoft.com/oldnewthing/20100114-00/?p=... Nanoblogger is a bash script in my home directory. To add an entry, I ssh into the web server, give it the text of the post, and it generates a bunch of HTML and writes it to /srv. It is only run to create a new post. It doesn't listen on a port, or talk to th…

Well, because we have never seen any exploits with bash (Shellshock anybody?) or ssh (Heartbleed rings a bell?).

You just don't know the weird ways things can be exploited. And if an exploit is discovered you'll be just as happy as everybody else if you don't need to implement a fix yourself but can rely on others implementing, testing and reviewing fixes that they provide to you as an update.

Re: Ask HN: Most Sites Don't Use a CMS Like Wordpress – What Non-CMS Do You Use?

#67

Post by anotheryou »

tenken wrote: post #43
anotheryou wrote: post #4

Las time I used grav for something that does not have to be client friendly. It still felt a bit immature though. (the pretty flat-file markdown quickly gets gobbled up in the YAML headers and than they can only be edited through the admin interface)

Lately the admin plugin has an Advanced view that exposes the full yaml file in a form...

I still miss my vim and editing the synced raw files on my mobile...

Both next to impossible with escaped markdown.

I guess markdown keeps the syntax clean for a WYSIWYG editor too, but the real benefit always was that you could write it in plain text with any editor you want.

Re: Ask HN: Most Sites Don't Use a CMS Like Wordpress – What Non-CMS Do You Use?

#69

Post by wolfgang42 »

erikb wrote: post #65
sbierwagen wrote: post #60

Earlier quoted context omitted.

Any attack against nanoblogger would be an "on the other side of this airtight hatchway" attack https://blogs.msdn.microsoft.com/oldnewthing/20100114-00/?p=... Nanoblogger is a bash script in my home directory. To add an entry, I ssh into the web server, give it the text of the post, and it generates a bunch of HTML and writes it to /srv. It is only run to create a new post. It doesn't listen on a port, or talk to th…

Well, because we have never seen any exploits with bash (Shellshock anybody?) or ssh (Heartbleed rings a bell?). You just don't know the weird ways things can be exploited. And if an exploit is discovered you'll be just as happy as everybody else if you don't need to implement a fix yourself but can rely on others implementing, testing and reviewing fixes that they provide to you as an update.

An exploit in bash or ssh would be fixed by a patch to bash/ssh, and has nothing to do with any given bash script.

Re: Ask HN: Most Sites Don't Use a CMS Like Wordpress – What Non-CMS Do You Use?

#70

Post by sho »

erikb wrote: post #65
sbierwagen wrote: post #60

Earlier quoted context omitted.

Any attack against nanoblogger would be an "on the other side of this airtight hatchway" attack https://blogs.msdn.microsoft.com/oldnewthing/20100114-00/?p=... Nanoblogger is a bash script in my home directory. To add an entry, I ssh into the web server, give it the text of the post, and it generates a bunch of HTML and writes it to /srv. It is only run to create a new post. It doesn't listen on a port, or talk to th…

Well, because we have never seen any exploits with bash (Shellshock anybody?) or ssh (Heartbleed rings a bell?). You just don't know the weird ways things can be exploited. And if an exploit is discovered you'll be just as happy as everybody else if you don't need to implement a fix yourself but can rely on others implementing, testing and reviewing fixes that they provide to you as an update.

> we have never seen any exploits with bash [..] or ssh[..]?

Sure we have, and they have nothing to do with the static site generator. You're talking about compromising the web server in general. Totally unrelated.

And you don't even need a web server with an SSG. I use a one locally and upload to S3. Maybe I "just don't know the weird ways things can be exploited", but I simply can't think of any conceivable angles on that.

References to mysterious unknowable hacking superpowers aren't really useful. Paranoia is to be encouraged in security, but sometimes it really is just plain secure!

Post reply on HN