131–140 of 183 posts
I think the spirit of this article is correct, although some of the digs at modern web tech and SPAs seem to be beside the point. I used to have a "mildly dynamic website." It was a $5 digital ocean box. It ran nginx with php-fpm, mostly so it could have a Wordpress install in a subdirectory, and it had a unicorn setup for an experimental Rails app somewhere in there. Given that environment, the "mildly dynamic websi…
Earlier quoted context omitted.
Shared hosting is probably better, and AFAIK more common, for the mildly dynamic website. The host handles a lot of the admin tasks like OS updates that you have to handle yourself with a VPS.
NearlyFreeSpeech.NET is good for this. Their main tier - "production" sites - are very inexpensive and the admins take care of OS and server-software updates. They have another tier - "non-production" sites - that are even cheaper and can be perfectly sufficient for a personal homepage. The admins maintain these servers as well but they might do beta testing on them. The environment is fully hackable and has PHP, SSH…
Earlier quoted context omitted.
I am puzzled that your site required constant maintenance. I run a similar setup that I hardens using systemd service restrictions with nothing running as root. Then I subscribed to Debian and couple more mail lists with security announcements. It turned out I needed to spend like 20 minutes per month to maintain it. I also find that PHP works much better than Go regarding maintenance efforts. With Debian I have auto…
They didn't say constant maintenance, they said endless maintenance. 20 minutes a month is a never ending commitment of time. They have better things to think about.
PHP deployment was indeed easy. But it turns out "dump everything in docroot and let mod_php interpret and execute whatever it finds there" had security implications...
Semi-related: what's the best place to learn the old school style of working with php, I already know laravel but it feels so far removed from normal php that I am not confident working with it on it's own.
Semi-related: what's the best place to learn the old school style of working with php, I already know laravel but it feels so far removed from normal php that I am not confident working with it on it's own.
Why not read the PHP docs and any tutorials they might have? The docs are pretty comprehensive.
Earlier quoted context omitted.
"I have run production websites where I didn't patch security for months or years on end." Linux users wondering why nobody takes them seriously.
Security people on high alert for every possible scenario with no sense of relative risk or attack surface wonder why their concerns aren’t taken seriously.
Earlier quoted context omitted.
> it requires endless system maintenance. Otherwise all the PHP stuff becomes vulnerable to random hacks How so? I've seen PHP websites & apps run for 10+ years in production without updates. Even longer with a simple "sudo apt update" every few months and a "composer update" every year or so. The maintenance rate is actually very very low.
Years ago a Digital Ocean virtual server of mine stopped working because I had never upgraded Ubuntu to the newest major version. After a few years, the version of Ubuntu was no longer supported by the Digital Ocean hypervisor and couldn't mount or boot at all. In my experience, yes you absolutely need maintenance. In the past I've had to upgrade from HTTP to HTTPS, upgrade the OS, upgrade to newer versions of extern…
If, as an industry, we focussed on correctness and reliability over features, a lot of these problems would disappear.
Earlier quoted context omitted.
Years ago a Digital Ocean virtual server of mine stopped working because I had never upgraded Ubuntu to the newest major version. After a few years, the version of Ubuntu was no longer supported by the Digital Ocean hypervisor and couldn't mount or boot at all. In my experience, yes you absolutely need maintenance. In the past I've had to upgrade from HTTP to HTTPS, upgrade the OS, upgrade to newer versions of extern…
These are all problems that shouldn’t exist. You have succinctly described the problems with modern IT. Software doesn’t need to have an expiration date. It doesn’t decay or expire. But because of our endless need to change things, rather than just fix bugs, we end up with this precarious tower of cards. If, as an industry, we focussed on correctness and reliability over features, a lot of these problems would disapp…
Earlier quoted context omitted.
Ah but! The problem is SSI includes the bang directive, which outputs the results of a shell command. Once that's available, people will demand and abuse it, and we're back at cgi-bin.
> SSI includes the bang directive, Not in ngx_http_ssi_module or any modern webserver I've used? As for "people"? What people? I guess your implicit assumption is this is a group or commercial project? I was thinking more website made by a human person.
(I've still never seen the need to switch to more trendy web servers, so they may well have disabled exec)