Go Static or Go Home • Hacker News Board

Re: Go Static or Go Home

#51

Post by jkot » Tue, Jan 20, 2015, 4:51 PM UTC

vinceguidry wrote: post #45

jkot wrote: post #20

Earlier quoted context omitted.

There are castles with no gates. I think problem is that current dynamic websites are sort of crippled already. Right now even simple shopping app requires UI based on HTML + web. Not a chance to use command line, some automated devices etc... In future we might see radically simplified protocols/webservices for more universal access.

> There are castles with no gates. Like, real castles?

Yes. Some towers in Ireland have entrance on 3th floor. And Meteora monasteries are build on top of rocks, with only crane access.

Re: Go Static or Go Home

#52

Post by sandymcm » Tue, Jan 20, 2015, 4:51 PM UTC

stevewilhelm wrote: post #40

normloman wrote: post #27

Earlier quoted context omitted.

I'm not advocating static page generators that use markdown. Far from it. I used to use a blog platform called Movable Type. It was just as easy to use as WordPress but it generated static pages. You'd make changes in the back end, click publish, and Movable Type would generate a new static page to serve up. You can make WordPress generate static pages too. They have plugins for that.

Six Apart's MovableType is still around. https://movabletype.org

I used MT for years. Versions 4 and 5 had various problems, coincidental with various changes at the parent company, SixApart. (At one time they had three blogging products: Vox, TypePad, and MT.)

I've been searching for a suitable replacement ever since MT 4. I tried to switch to WordPress but hated it. Maybe just preferences, but I've never warmed to WP, in spite of trying each new version that launches.

I see that Byrne Reese, former SixApart employee and co-founder of the MT-based OpenMelody project, is now using Ghost.io for his blog. That's the system I'm testing now as well. (Have used Tumblr in the meantime, with some success.)

Re: Go Static or Go Home

#53

Post by smhenderson » Tue, Jan 20, 2015, 4:53 PM UTC

gizzlon wrote: post #30

Ok, I understand that there's reasons for using static pages, but I don't get the feeling this guy really understands what he's talking about. > Even if [..] and there's nothing like bash installed on the same computer as the web server Bash installed? Huh? Why Bash exactly? I feel mentioning jails or containers here would be more on point.. > This is because every DCMS page view involves running a few tiny bits of s…

Bash installed? Huh? Why Bash exactly? I feel mentioning jails or containers here would be more on point.

Maybe because of this? https://en.wikipedia.org/wiki/Shellshock_%28software_bug%29

Re: Go Static or Go Home

#54

Post by erikb » Tue, Jan 20, 2015, 4:57 PM UTC

And there we have it. Security needs stability, stability decreases on a daily basis. We can't have that traditional kind of security. We need to move on to a more proactive way of thinking.

Re: Go Static or Go Home

#55

Post by sre_ops » Tue, Jan 20, 2015, 5:01 PM UTC

Ah yes, Vixie, the guy who thought it was his customers that had to adapt to his "vision" rather than his vision had to adapt to customer needs.

Re: Go Static or Go Home

#56

Post by tptacek » Tue, Jan 20, 2015, 5:08 PM UTC

yk wrote: post #48

StefanKarpinski wrote: post #33

"Little Johnny Tables". Um, yes, that was "Little Bobby Tables" [1]. Obviously not a big deal, but it seems emblematic of how sloppy this piece is. The article confuses – seemingly willfully, since Paul Vixie should know better – the concepts of dynamic language, dynamic page generation, lack of proper input hygiene, and various other orthogonal issues. The argument that dynamic languages are less secure depends an a…

Calling any Turing complete language "more secure" is probably nonsense. It is possible to write secure applications in C, and it is possible to directly pipe attacker controlled input to a shell in Haskell.

I know a total of zero working security researchers who think C is just as safe as Scala.

The obvious flaw in your example: you can exec a program unsafely in both C and in Scala, but only in C can you do it accidentally simply by idiomatically copying a string from one place to another.

Re: Go Static or Go Home

#57

Post by qeorge » Tue, Jan 20, 2015, 5:26 PM UTC

Startup idea, free for the taking: create a service that "ossifies" dynamic websites into static HTML.

(By ossify, I mean to take something dynamic and make it static).

For example, that WordPress site you commissioned for a movie 3 years ago? Its a huge liability, but you don't have to take it offline - just ossify it. No one is updating that blog anymore!

Under the hood, it would basically be a crawler, and the deliverable would be a zip file containing a 1-to-1, static copy of their website with all URLs still working. I suspect most folks here could whip up a shitty proof of concept in 48 hours.

If someone does this, email me! I have a couple of potential clients for you (I'm a former consultant, with lots of WordPress sites in my history).

Re: Go Static or Go Home

#58

Post by betenoire » Tue, Jan 20, 2015, 5:32 PM UTC

bnegreve wrote: post #37

gizzlon wrote: post #30

Ok, I understand that there's reasons for using static pages, but I don't get the feeling this guy really understands what he's talking about. > Even if [..] and there's nothing like bash installed on the same computer as the web server Bash installed? Huh? Why Bash exactly? I feel mentioning jails or containers here would be more on point.. > This is because every DCMS page view involves running a few tiny bits of s…

On the other hand, I don't really get your point. > Sure, but guess how those pages are returned? By running code on the server.. Yes, but by running static code. > > The web server executes no code on behalf of a viewer until that viewer has logged in.. > 1) Of course it does, 2) How do the site check your info without executing code? :) Again, static code. So his point is not that we shouldn't run code at all, but…

> of course you can argue [that] no code is truly static

what the hell is static code? Static has very specific meanings in different technical contexts (static pages, static allocation, static scoping, etc), but I've never heard someone refer to static code.

Can you give me an example of code that is and isn't static by your definition?

Re: Go Static or Go Home

#59

Post by j_baker » Tue, Jan 20, 2015, 5:32 PM UTC

qeorge wrote: post #57

Startup idea, free for the taking: create a service that "ossifies" dynamic websites into static HTML. (By ossify, I mean to take something dynamic and make it static). For example, that WordPress site you commissioned for a movie 3 years ago? Its a huge liability, but you don't have to take it offline - just ossify it. No one is updating that blog anymore! Under the hood, it would basically be a crawler, and the del…

That's basically what the wayback machine does: https://archive.org/web/

Re: Go Static or Go Home

#60

Post by thegeomaster » Tue, Jan 20, 2015, 5:37 PM UTC

tptacek wrote: post #56

yk wrote: post #48

Earlier quoted context omitted.

Calling any Turing complete language "more secure" is probably nonsense. It is possible to write secure applications in C, and it is possible to directly pipe attacker controlled input to a shell in Haskell.

I know a total of zero working security researchers who think C is just as safe as Scala. The obvious flaw in your example: you can exec a program unsafely in both C and in Scala, but only in C can you do it accidentally simply by idiomatically copying a string from one place to another.

FWIW, idiomatically copying a string in C is done using strncpy, and that doesn't introduce any RCE bugs. I would not in my right mind defend the premise that C is just as safe as Scala, but the truth is that sloppy programming can do harm in every language imaginable. It just becomes about damage control.