Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scaling Your Static Site to a Global Market for a Fraction of the Cost on AWS

medium.com

Post reply on HN
Print view View original

51–60 of 64 posts

Re: Scaling Your Static Site to a Global Market for a Fraction of the Cost on AWS

#51

Post by purerandomness »

1996 wrote: post #46
boulos wrote: post #19

Earlier quoted context omitted.

Most likely your "hasn't been updated for years". Given all the security vulnerabilities that have been disclosed, including things like Heartbleed, I hope you meant your "setup hasn't been changed in years".

No, I run nothing like apt update. Why would I fix something not broken? And no, I do not run ssl. I like to limit the number of moving parts. Anyway, if someone can manage to access my servers with only nginx serving static files, they deserve to 0wn it :-)

You're exposing your users to MITM attacks by not deploying SSL.

While your setup stays the same, major security flaws are found in different parts of the stacks.

Security is a process, by neglecting it you're paying for resources that are abused by attackers in order to harm other users.

Re: Scaling Your Static Site to a Global Market for a Fraction of the Cost on AWS

#52

Post by 1996 »

purerandomness wrote: post #51
1996 wrote: post #46

Earlier quoted context omitted.

No, I run nothing like apt update. Why would I fix something not broken? And no, I do not run ssl. I like to limit the number of moving parts. Anyway, if someone can manage to access my servers with only nginx serving static files, they deserve to 0wn it :-)

You're exposing your users to MITM attacks by not deploying SSL. While your setup stays the same, major security flaws are found in different parts of the stacks. Security is a process, by neglecting it you're paying for resources that are abused by attackers in order to harm other users.

If you want to mitm my static site with no login and mostly PDFs, you are welcome to.

Security is a state of mind, not a bunch of recipes. Some things must be protected, some for some others it doesn't make sense

Re: Scaling Your Static Site to a Global Market for a Fraction of the Cost on AWS

#53

Post by purerandomness »

1996 wrote: post #52
purerandomness wrote: post #51

Earlier quoted context omitted.

You're exposing your users to MITM attacks by not deploying SSL. While your setup stays the same, major security flaws are found in different parts of the stacks. Security is a process, by neglecting it you're paying for resources that are abused by attackers in order to harm other users.

If you want to mitm my static site with no login and mostly PDFs, you are welcome to. Security is a state of mind, not a bunch of recipes. Some things must be protected, some for some others it doesn't make sense

How do you know your users are seeing "a static site with no login and mostly PDFs"?

Security is a state of mind, indeed.

Re: Scaling Your Static Site to a Global Market for a Fraction of the Cost on AWS

#54

Post by nkristoffersen »

drudru11 wrote: post #27

Does this require invalidating the main page in cloudfronts CDN when you add a blog post or article?

If you want the updated site to be available immediately then you must invalidate the cache.

I do it as the last step in my CI/CD process:

    - aws configure set preview.cloudfront true
    - aws cloudfront create-invalidation --distribution-id $CLOUDFRONT_ID --paths '/*'
    - curl https://google.com/ping?sitemap=$SITEMAP_URL

Re: Scaling Your Static Site to a Global Market for a Fraction of the Cost on AWS

#55

Post by nkristoffersen »

1996 wrote: post #2

why can't he use the free cloudflare? A static website cached by cloudflare seems very vanilla. Also, why S3? this seems very easy to do with Linode or anything else similarly cheap or cheaper ($20 gets you a KVM VPS with 2 Gb nowadays) Unless you have to regenerate constantly, all it needs is nginx, to serve the pages to Cloudflare edges when thry drop out of the cache

I would say because using S3 for static sites costs pennies instead of $20 :-)

Re: Scaling Your Static Site to a Global Market for a Fraction of the Cost on AWS

#56

Post by EvilEndures »

minxomat wrote: post #49
EvilEndures wrote: post #13

Earlier quoted context omitted.

Sorry. Spaces = Digital Ocean's Spaces product. $5/month. Park a CDN in front of it with Edge rules and you get a similar setup.

Spaces will get a native CDN this year if DOS roadmap is to be believed.

The problem with Spaces as static hosting is it doesn't handle index.html/index.htm correctly so you need a CDN with edge rules.

Re: Scaling Your Static Site to a Global Market for a Fraction of the Cost on AWS

#57

Post by PowerfulWizard »

qrohlf wrote: post #41
PowerfulWizard wrote: post #9

I have set up some sites the same way, the only ugly part for me was that I wanted to use the features of S3 web hosting interface, but restrict all traffic to come through CloudFront. This blog post (not mine) describes the problem and the approach: https://abridge2devnull.com/posts/2018/01/restricting-access...

there's actually a way to do this with OAI, you just have to configure the html5 routing stuff using CloudFront distribution rules instead of configuring the S3 bucket as a static website. As a nice side effect, you can also enforce https https https communication all the way through the S3 Cloudfront world chain, which isn't possible to force when the S3 bucket is configured for static site hosting. I have about 75%…

yeah, I tried to do that or something similar first, IIRC the s3 website setup was handling the index document and error document stuff, but using cloudfront to fetch through the S3 API wasn't doing that so that is how I ended up where I ended up.

Re: Scaling Your Static Site to a Global Market for a Fraction of the Cost on AWS

#58

Post by drudru11 »

nkristoffersen wrote: post #54
drudru11 wrote: post #27

Does this require invalidating the main page in cloudfronts CDN when you add a blog post or article?

If you want the updated site to be available immediately then you must invalidate the cache. I do it as the last step in my CI/CD process: - aws configure set preview.cloudfront true - aws cloudfront create-invalidation --distribution-id $CLOUDFRONT_ID --paths '/*' - curl https://google.com/ping?sitemap=$SITEMAP_URL

Thx. I was hoping there was a way to avoid that extra cost. Also, thx for sharing your code to do this.

Re: Scaling Your Static Site to a Global Market for a Fraction of the Cost on AWS

#59

Post by 1996 »

purerandomness wrote: post #53
1996 wrote: post #52

Earlier quoted context omitted.

If you want to mitm my static site with no login and mostly PDFs, you are welcome to. Security is a state of mind, not a bunch of recipes. Some things must be protected, some for some others it doesn't make sense

How do you know your users are seeing "a static site with no login and mostly PDFs"? Security is a state of mind, indeed.

I know because I make the site and use it too

Re: Scaling Your Static Site to a Global Market for a Fraction of the Cost on AWS

#60

Post by ramses0 »

outworlder wrote: post #21
bigpicture wrote: post #17

Earlier quoted context omitted.

> This is probably an exceptional rate of change for the _vast_ majority of static sites. I also doubt that many static sites have much "overhead" related to maintaining nginx config files and Let's Encrypt certificates.

Sure, but then there's the whole overhead of maintaining a server.

Clarify this: "The difference between zero servers and one server is much larger than the difference between 100 servers and 101 servers"

The person you're talking to is likely thinking of the "100=>101" case, not the "0=>1" case.

Post reply on HN