Go Static or Go Home • Hacker News Board

Re: Go Static or Go Home

#61

Post by wglb » Tue, Jan 20, 2015, 5:38 PM UTC

yk wrote: post #48

StefanKarpinski wrote: post #33

"Little Johnny Tables". Um, yes, that was "Little Bobby Tables" [1]. Obviously not a big deal, but it seems emblematic of how sloppy this piece is. The article confuses – seemingly willfully, since Paul Vixie should know better – the concepts of dynamic language, dynamic page generation, lack of proper input hygiene, and various other orthogonal issues. The argument that dynamic languages are less secure depends an a…

Calling any Turing complete language "more secure" is probably nonsense. It is possible to write secure applications in C, and it is possible to directly pipe attacker controlled input to a shell in Haskell.

It is possible to write secure applications in C

Yes, but is it probable? History says no.

Re: Go Static or Go Home

#62

Post by qeorge » Tue, Jan 20, 2015, 5:40 PM UTC

j_baker wrote: post #59

qeorge wrote: post #57

Startup idea, free for the taking: create a service that "ossifies" dynamic websites into static HTML. (By ossify, I mean to take something dynamic and make it static). For example, that WordPress site you commissioned for a movie 3 years ago? Its a huge liability, but you don't have to take it offline - just ossify it. No one is updating that blog anymore! Under the hood, it would basically be a crawler, and the del…

That's basically what the wayback machine does: https://archive.org/web/

Yes! It would be like the Wayback machine as a service, but with some key differences:

1) The intention is that you replace your dynamic site with the static copy, but your visitors are none the wiser. All URLs are the same, as well as the content returned. Might require some .htaccess trickery.

2) It would have to preserve all the images, css, and other assets, some possibly hotlinked. (The Wayback Machine is not awesome at this, understandably)

Re: Go Static or Go Home

#63

Post by thegeomaster » Tue, Jan 20, 2015, 5:40 PM UTC

StefanKarpinski wrote: post #47

codygman wrote: post #43

Earlier quoted context omitted.

> Haskell vs Python (more secure) If you mean comparing type systems there isn't much of a debate!

I was talking about which is more secure. The real point is that this isn't a static vs. dynamic language issue: C and C++ are static and full of terrifying security traps; Haskell is static and it isn't. Since C and C++ are the most commonly used static languages, and they are much less secure than the most commonly used dynamic languages, it's questionable to claim – without additional elaboration – that static is…

C++, especially when using features provided by the newest standards (C++11 and C++14), cannot be likened to C in terms of security problems. In theory, yes, it's backward compatible with C so any security issues present in C can be reconstructed in C++, but using managed pointers, standard containers, RTTI and other features can considerably reduce the attack surface... but I'd argue that not a great amount of applications could benefit from being written in C++ vs. some safer language.

Re: Go Static or Go Home

#64

Post by wglb » Tue, Jan 20, 2015, 5:41 PM UTC

thegeomaster wrote: post #60

tptacek wrote: post #56

Earlier quoted context omitted.

I know a total of zero working security researchers who think C is just as safe as Scala. The obvious flaw in your example: you can exec a program unsafely in both C and in Scala, but only in C can you do it accidentally simply by idiomatically copying a string from one place to another.

FWIW, idiomatically copying a string in C is done using strncpy, and that doesn't introduce any RCE bugs. I would not in my right mind defend the premise that C is just as safe as Scala, but the truth is that sloppy programming can do harm in every language imaginable. It just becomes about damage control.

Sorry, if you get the third argument of strncpy wrong, you are right back in the area of trouble.

Re: Go Static or Go Home

#65

Post by voyou » Tue, Jan 20, 2015, 5:54 PM UTC

qeorge wrote: post #57

Startup idea, free for the taking: create a service that "ossifies" dynamic websites into static HTML. (By ossify, I mean to take something dynamic and make it static). For example, that WordPress site you commissioned for a movie 3 years ago? Its a huge liability, but you don't have to take it offline - just ossify it. No one is updating that blog anymore! Under the hood, it would basically be a crawler, and the del…

You can get pretty close to this, I think with:

    wget --mirror --convert-links http://site.example.com/

From the wget manual:

    --convert-links
           After the download is complete, convert the links in the document
           to make them suitable for local viewing.  This affects not only the
           visible hyperlinks, but any part of the document that links to
           external content, such as embedded images, links to style sheets,
           hyperlinks to non-HTML content, etc.

           The links to files that have been downloaded by Wget will be
           changed to refer to the file they point to as a relative link.

           Example: if the downloaded file /foo/doc.html links to
           /bar/img.gif, also downloaded, then the link in doc.html will
           be modified to point to ../bar/img.gif.  This kind of
           transformation works reliably for arbitrary combinations of
           directories.

Re: Go Static or Go Home

#66

Post by bch » Tue, Jan 20, 2015, 5:58 PM UTC

wglb wrote: post #61

yk wrote: post #48

Earlier quoted context omitted.

Calling any Turing complete language "more secure" is probably nonsense. It is possible to write secure applications in C, and it is possible to directly pipe attacker controlled input to a shell in Haskell.

It is possible to write secure applications in C Yes, but is it probable? History says no.

History says that security is a process, not a product (or artifact). I get it that C can be difficult. Pointers allow NULL dereferencing and use-after-free, strings are open to poor handling, etc. That said: we have OpenBSD w/ their re-written string/memory management and static and dynamic analysis tools with decades of development behind them.

I'm more hesitant to crucify C than I feel others are... are we throwing out the baby with the bathwater ?

To your comment -- that a C program is probably not secure -- most code written (regardless of language) is probably junk, with different classes of errors. Its tough.

Re: Go Static or Go Home

#67

Post by faraazin » Tue, Jan 20, 2015, 6:02 PM UTC

Noob qn:how does custom search work on static sites? May not be the best approach, but a simple SQL query would do the trick for dynamic sites.

Re: Go Static or Go Home

#68

Post by pbsd » Tue, Jan 20, 2015, 6:19 PM UTC

wglb wrote: post #64

thegeomaster wrote: post #60

Earlier quoted context omitted.

FWIW, idiomatically copying a string in C is done using strncpy, and that doesn't introduce any RCE bugs. I would not in my right mind defend the premise that C is just as safe as Scala, but the truth is that sloppy programming can do harm in every language imaginable. It just becomes about damage control.

Sorry, if you get the third argument of strncpy wrong, you are right back in the area of trouble.

Even when you don't get it wrong (i.e., no out-of-bounds writes), you can still get out-of-bounds reads because strncpy does not always null-terminate strings. C strings suck.

Re: Go Static or Go Home

#69

Post by ivanhoe » Tue, Jan 20, 2015, 6:29 PM UTC

Static site is more secure only if the server is also up-to-date and setup properly to trim down all unnecessary options. Putting static site on a general purpose apache installation that will happily serve PHP and CGIs from user home dirs is not such a big security improvement.

Re: Go Static or Go Home

#70

Post by alexsop2 » Tue, Jan 20, 2015, 6:35 PM UTC

Xorlev wrote: post #39

normloman wrote: post #23

Earlier quoted context omitted.

Thanks for answering my question. Would you mind clarifying it for me? If your blog has a reusable template, wouldn't the images, fonts, and stylesheets that are part of the template get cached on the user's computer, regardless of whether it was dynamic or static? Or are you talking about caching things serverside?

I think he means that you can cache the majority of the page (including the HTML template) and then substitute in just the data (usually coming from JSON). I don't buy that it's more efficient personally. I'd rather resend a lightweight page on every time then force the browser to download it all, load the JS, then build a page and have the browser draw that. It seems to me that single-page apps are great when you ar…

I’ve gone down this rabbit hole and aside from fluid navigation, it isn’t worth the hassle. Since the content is largely text which will be transformed into HTML (before or after being sent down the pipe), the size difference is mostly negligible.

Time is better spent cleaning up the critical rendering path, deferring styles and scripts.