Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

VuePress: a static site generator that excels at working with documentation

forestry.io

Post reply on HN
Print view View original

21–30 of 39 posts

Re: VuePress: a static site generator that excels at working with documentation

#21

Post by savanaly »

kevan wrote: post #18
dyeje wrote: post #17

Earlier quoted context omitted.

But this is a static site generator. They can't take over your server if you're just serving up stuff from S3.

They can't take over your server but they can inject a script tag with a cryptominer for all of your users to run. It's not the end of the world because you're just out a few dollars in electricity but it would be embarrassing.

I think what he was trying to say was that if you knew for a fact yesterday that your static site didn't have malicious code on it, then you know it for a fact today, assuming you didn't rebuild the site in the interim. You can't say the same for dependencies on, say, a web server, since the web server may have rebooted and did an install or whatever overnight.

Re: VuePress: a static site generator that excels at working with documentation

#22

Post by h1d »

kevan wrote: post #18
dyeje wrote: post #17

Earlier quoted context omitted.

But this is a static site generator. They can't take over your server if you're just serving up stuff from S3.

They can't take over your server but they can inject a script tag with a cryptominer for all of your users to run. It's not the end of the world because you're just out a few dollars in electricity but it would be embarrassing.

Your reputation will be out of the window if you ran a crypto miner without notice and even if you get rid of it saying it was "hacked", people will hardly believe it.

Re: VuePress: a static site generator that excels at working with documentation

#23

Post by scrame »

superkuh wrote: post #12

All these static site "generators" seem pretty silly. If you're going to make a static site then just make a few template pages by hand in html then copy and edit them to fill with whatever content. It works even better if your webserver has server side includes (SSI) turned on. Then you can make header/footer/sidebar/etc templates and just insert them with a line in the page templates.

> if your webserver has server side includes (SSI)

are you trolling? shtml setups were nothing but security nightmares on top of bad ideas 20 years ago.

Re: VuePress: a static site generator that excels at working with documentation

#24

Post by ncphillips »

l_t wrote: post #20
dyeje wrote: post #17

Earlier quoted context omitted.

But this is a static site generator. They can't take over your server if you're just serving up stuff from S3.

True, but they can compromise the machine that runs VuePress (or at least, run arbitrary userlevel JS code on it).

Wouldn’t this be the case for any node app? Why pick on VuePress specifically?

Re: VuePress: a static site generator that excels at working with documentation

#25

Post by jnbiche »

superkuh wrote: post #12

All these static site "generators" seem pretty silly. If you're going to make a static site then just make a few template pages by hand in html then copy and edit them to fill with whatever content. It works even better if your webserver has server side includes (SSI) turned on. Then you can make header/footer/sidebar/etc templates and just insert them with a line in the page templates.

> It works even better if your webserver has server side includes (SSI) turned on.

If you're trolling, well done. If not, then you're not understanding the concept of the "static" in "static site generators". SSI are inherently dynamic. They run each time the page is viewed (yes, you can use a cache, but the page is still loaded dynamically by the cache server).

> Then you can make header/footer/sidebar/etc templates and just insert them with a line in the page templates.

This is precisely what any static site generator will do, since they all feature template engines.

Re: VuePress: a static site generator that excels at working with documentation

#26

Post by salty_biscuits »

kevan wrote: post #18
dyeje wrote: post #17

Earlier quoted context omitted.

But this is a static site generator. They can't take over your server if you're just serving up stuff from S3.

They can't take over your server but they can inject a script tag with a cryptominer for all of your users to run. It's not the end of the world because you're just out a few dollars in electricity but it would be embarrassing.

Stupid question, does anyone do this on purpose? (i.e. With the consent of the client side). In a way it seems like a good way to make income for content (say a blog post) rather than all the ad profiling nonsense that goes on now.

Re: VuePress: a static site generator that excels at working with documentation

#29

Post by krapp »

salty_biscuits wrote: post #26
kevan wrote: post #18

Earlier quoted context omitted.

They can't take over your server but they can inject a script tag with a cryptominer for all of your users to run. It's not the end of the world because you're just out a few dollars in electricity but it would be embarrassing.

Stupid question, does anyone do this on purpose? (i.e. With the consent of the client side). In a way it seems like a good way to make income for content (say a blog post) rather than all the ad profiling nonsense that goes on now.

I would be surprised if a javascript cryptominer was productive enough to even be worth the effort.

Re: VuePress: a static site generator that excels at working with documentation

#30

Post by _Chief »

vuepress also generates SEO friendly docs, eg when compared to docsify, but on the flip side docsify has full text search, while the default vuepress theme only searches headers (but since its seo ready most third party search will work ef algolia, google).
Post reply on HN