81–90 of 100 posts
$ ruby -r webrick/https -e "WEBrick::HTTPServer.new(Port: 9001, DocumentRoot: '.', SSLEnable: true, SSLCertName: [%w[CN localhost]]).start"If you have npm installed then simply doing npx serve is very easy
it's also very insecure, because you have no guarantee that the version of `serve` that gets pulled down has been vetted and is verified exploit-free, unless you tell npx exactly which version should be used, at which point things start become less easy and more "having to remember which versions are safe".
If you have npm installed then simply doing npx serve is very easy
Of course this requires internet access. It is also arguably less secure as it is downloading code from the internet and means that you are trusting the latest code from a handful of people https://www.npmjs.com/package/serve
Earlier quoted context omitted.
I think these are meant for development setups, which you normally run in a localhost context, meaning you most likely won't have to deal with CORS. But, if you still need it, the http-server program has a --cors flag to enable wildcard CORS.
Thanks!! I'll try it again, the last time I did I thought it was not allowing the right setting, but yeah a wildcard CORS should be enough of course.
You mean that isn't the production default?
/s
If you have npm installed then simply doing npx serve is very easy
Of course this requires internet access. It is also arguably less secure as it is downloading code from the internet and means that you are trusting the latest code from a handful of people https://www.npmjs.com/package/serve
Don't essentially all the options involve code downloaded from the internet? And you have to trust the source that it isn't malware or too buggy or insecure?
Are you making a case that the maintainers of this package aren't trustworthy? Or maybe the operators of npmjs.com?
I'm just not understanding the claim this is less secure than various other options.
What's a good one that serves gzip assets if they exist? I'm looking for a way to serve a webpack prod build.
sudo redbean.com -dp80 -L/var/log/redbean.log -P/var/run/redbean.pid -U65534 -G65534 -vvvvmbagMy favourite is thttpd [1] which is super tiny, battle-tested and actually meant for the job (and only this job). It's available as a package on most Linux distros. Serving a static folder `/static` on port `3000` as user `static-user` and with cache headers set to 60 seconds would go like this: thttpd -D -h 0.0.0.0 -p 3000 -d /static -u static-user -l - -M 60 Even if you've got Python lying around on every Ubuntu se…
/* Read the MIME headers. */
while ( ( buf = bufgets( hc ) ) != (char*) 0 )
{
if ( buf[0] == '\0' )
break;
if ( strncasecmp( buf, "Referer:", 8 ) == 0 )
{
cp = &buf[8];
cp += strspn( cp, " \t" );
hc->referrer = cp;
}
else if ( strncasecmp( buf, "Referrer:", 9 ) == 0 )
{
cp = &buf[9];
cp += strspn( cp, " \t" );
hc->referrer = cp;
}
else if ( strncasecmp( buf, "User-Agent:", 11 ) == 0 )
{
cp = &buf[11];
cp += strspn( cp, " \t" );
hc->useragent = cp;
}
else if ( strncasecmp( buf, "Host:", 5 ) == 0 )
{
cp = &buf[5];
cp += strspn( cp, " \t" );
hc->hdrhost = cp;
Earlier quoted context omitted.
Of course this requires internet access. It is also arguably less secure as it is downloading code from the internet and means that you are trusting the latest code from a handful of people https://www.npmjs.com/package/serve
> ...arguably less secure as it is downloading code from the internet... Don't essentially all the options involve code downloaded from the internet? And you have to trust the source that it isn't malware or too buggy or insecure? Are you making a case that the maintainers of this package aren't trustworthy? Or maybe the operators of npmjs.com? I'm just not understanding the claim this is less secure than various oth…
Earlier quoted context omitted.
> ...arguably less secure as it is downloading code from the internet... Don't essentially all the options involve code downloaded from the internet? And you have to trust the source that it isn't malware or too buggy or insecure? Are you making a case that the maintainers of this package aren't trustworthy? Or maybe the operators of npmjs.com? I'm just not understanding the claim this is less secure than various oth…
It feels somewhat disingenuous to rephrase "is downloading" as "downloaded" as though they mean the same thing.
By default -- presumably the most common case by far -- "npx serve" will download the most recent stable build. But why should that be less secure than some previous version?
New vulnerabilities could have been introduced. But, of course, old ones could have been resolved.
If you generally trust the source to be working in good faith and have an adequate level of competence, I would expect a given package/tool tends to become more secure over time, so taking the latest is a generally good strategy (not perfect of course) compared to running a version that is out-of-date to an arbitrary degree.
Of course, if you don't generally trust the source to be working in good faith or have an adequate level of competence, then you should not use the package/tool no matter when it was built or when you downloaded it.
I'm not seeing the logic here.