News for hackers. Stuff that matters.
Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by lsc on Sunday April 22, 2018 @03:41AM (#16895158)
Seems like the right thing to do for most CMS type situations is something that generates the site offline... and only uploads a static site to the web.

Something like jekyll or something.

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by jmknoll on Sunday April 22, 2018 @05:15AM (#16895383)
I'm a big fan of Jekyll (and more recently, Gatsby), and I think you're correct in saying that in most cases where a CMS is used, a static site generator would be a better option.

However, I see a couple of problems standing in the way of more widespread adoption of static site generators:

1) I've never seen a static site generator that non-technical users felt comfortable with. Programmers like terminal interfaces. Your average user in 2018 has probably never opened the terminal.

2) Possibly even more significant, I don't think the people making the choice to use a CMS for a simple business-info or blog site are aware of the trade-offs that they're making, or of the benefits that a static site will provide down the line. For a lot of small business owners I've spoken with, Wordpress is basically synonymous with "web presence."

I wonder if there's a market for a web-based GUI like what Wordpress provides, but which runs jekyll under the hood and uploads the files to s3 or something like that. Is this what companies like Squarespace and Wix do?

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by hunvreus on Sunday April 22, 2018 @06:26AM (#16895545)
The first point is why I built Jekyll+ [1], which I initially built for the new Starbucks' website [2] (which runs on Jekyll). It supports multilingual content and we're now adding a whole bunch of new features (you can check the TODO list in the README [3]).

We also have a pretty neat solution for site generation/hosting (JekyllPro) which is rolling out next month.

Using these two, none of the contributors realize they're using Jekyll. It's not as user-friendly as Squarespace, but it's pretty darn good.

1: https://github.com/Wiredcraft/jekyllplus

2: https://wiredcraft.com/blog/the-new-starbucks-cn-website-bol...

3: https://github.com/Wiredcraft/jekyllplus#todo

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by bloopernova on Sunday April 22, 2018 @01:57PM (#16897436)
Just wanted to say that I really admire Jekyll, and Jekyll+ looks very nice too.
Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by IloveHN84 on Monday April 23, 2018 @12:19AM (#16900495)
And the jelyll-admin dashboard is pretty nice
Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by benaiah on Sunday April 22, 2018 @05:30AM (#16895417)
The project I work on, Netlify CMS (https://www.netlifycms.org/), is almost precisely what you described in your last paragraph.I say "only" because it only officially supports GitHub as a backend at the moment, from which you can deploy to a host. (I'm also currently working on supporting more backends, so that will change soon.) The CMS is an open-source (MIT license) CMS built as a static web page which connects to an API for an arbitrary backend from your browser and edits the content stored there - from there, you can build the content with whatever static site generator you want. This lets you build sites that non-technical users can keep up-to-date without tying yourself to a specific tech stack for the actual website.

(disclaimer: Netlify employee)

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by StavrosK on Sunday April 22, 2018 @06:21AM (#16895531)
Please put that description somewhere on the site. I tried to try out Netlify CMS there times because I love Netlify the service but couldn't figure out what it is any of those times.

That said, it didn't help that you don't support Gitlab, which is where all my sites are, and which is the more important reason why I couldn't get it to work.

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by rainbowmverse on Sunday April 22, 2018 @03:56PM (#16898196)
Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by benaiah on Sunday April 22, 2018 @06:24PM (#16898988)
Yup, improving backend support (and refactoring the backend API to make developing custom backend support easier) is currently my top priority. Initial GitLab support (without the editorial workflow) is very close to being complete - I hope to be releasing an initial PR this coming week if all goes as planned. My latest update in that thread is here: https://github.com/netlify/netlify-cms/pull/517#issuecomment...
Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by petepete on Sunday April 22, 2018 @08:38AM (#16895909)
I'm a huge fan of Netlify, everything you guys do is great.

We (Graphia) took a similar approach for our document management system. Essentially it looks and acts like a regular CMS but it sits on top of a git repo instead of a database; and publishes via Hugo.

It's not intended to be a fully-fledged CMS but the API would support it without much work; the UI is definitely the time consuming portion.

http://www.graphia.co.uk for anyone who is interested, not quite ready for prime time just yet. Soon.

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by benaiah on Sunday April 22, 2018 @07:04PM (#16899185)
That sounds really similar to Netlify CMS, especially the use of Git for content storage+version history and the focus on a decoupled UI for editing content. It's really cool to hear from somebody exploring the same space! Git as a backend for content is a really interesting concept that's worked very well for us so far, and I'd be interested to hear how you're implementing that and what issues you've run into. The internationalization approach you describe on the features page is pretty intriguing as well - that's a feature that we should improve our support for in Netlify CMS.

Feel free to ping me using the contact info in my profile or at @benaiah in our Gitter room (https://gitter.im/netlify/NetlifyCMS) if you're interested in discussing this elsewhere.

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by Y14NZZRhRT5 on Sunday April 22, 2018 @05:53AM (#16895464)
Why not use wordpress as the backend for your static site? The user can create pages and posts like normal and once they are done you can build the static page from the wordpress api.
Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by sleepychu on Monday April 23, 2018 @02:21AM (#16900939)
If you give the user wordpress one day they are going to ask "Why doesn't my dynamic plugin work?"
Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by mattkevan on Sunday April 22, 2018 @08:59AM (#16895976)
There’s a few services like Forestry.io and Cloudcannon that provide a friendly editor interface to Jekyll.

Forestry + Netlify + Bitbucket is a good combination.

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by tootie on Sunday April 22, 2018 @10:44AM (#16896370)
Some players are moving into this space. Headless CMS providers like Contentful or Prismic let you build a very nice content entry UI and asset manager. Then you can consume content dynamically via the API or set up triggers to build the site statically whenever content is updated.
Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by dreamfactored on Sunday April 22, 2018 @06:22PM (#16898976)
> set up triggers to build the site statically whenever content is updated

That's not only the same gnarly problem as cache invalidation but with a metric ton of filesystem writes on top of it.

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by rainbowmverse on Sunday April 22, 2018 @03:59PM (#16898212)
Both of these appear to be aimed at developers.
Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by tootie on Sunday April 22, 2018 @06:01PM (#16898865)
They definitely appeal to IT teams which is a very different sales pitch than you would see for most enterprise CMS products, but rest assured the actual product is very user-friendly. The content entry UI is very straightforward and has easy to use hooks to live preview like any other CMS.

I spent a lot of years working in tech consulting and did a lot of CMS integrations. We desperately wanted to push clients to Contentful and away from ornery beasts like AEM, but Adobe can sell AEM by saying it's part of the "marketing cloud" and that it's magic power is in user engagement and analytics and whatever other marketingspeak lies. Contentful was the developer favorite, but it was hard to convince businesses it was in their best interests even though it totally was.

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by pg_bot on Sunday April 22, 2018 @09:44AM (#16896129)
There definitely is a market for a product like this. I think the best thing would be a native app with deep git integration. Engineers can see the entire project and edit templates while end users get a GUI to drag and drop those templates to make an article. The output from the user is encoded to either json or protobufs, and then passed through a function that outputs html which is then uploaded to s3. Everything would be under version control so you could just operate as if it were a custom designed webpage. You could fund development by having a store that takes a cut of templates that other people create.

I would work on this if I wasn't already running another startup.

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by rainbowmverse on Sunday April 22, 2018 @03:49PM (#16898159)
Publii looks promising, but while it's "open source," the source is all wrapped up in an Electron app that could easily be reclosed at a later date.

There's also Netlify CMS, but I haven't done much with it. I think the GitHub requirement puts people off, and work on the GitLab--which has free private repositories--support issue is slow.

What we need is something like Publii that's not packaged in a way that's obviously meant to make closing the source easy. That story is too old, and too common, to believe their intentions are good.

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by foepys on Sunday April 22, 2018 @05:31AM (#16895421)
With something like Hugo, you only need a single executable and all you have to do is decide on a theme, write Markdown files, and compile it on a shell/cmd/powershell with a command you can save in a text file for later reference.

Imho if you are really wanting to write a blog and host it yourself, this should not be too hard to learn. Wordpress doesn't install itself automatically, either.

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by setquk on Sunday April 22, 2018 @07:01AM (#16895625)
Dreamweaver was a pretty good static site generator for non technical users.
Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by DonHopkins on Sunday April 22, 2018 @10:02AM (#16896202)
As long as we're mentioning old obsolete but "revolutionary at the time" site generator tools, there's Adobe PageMill and SiteMill.

https://en.wikipedia.org/wiki/Adobe_PageMill

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by ct520 on Sunday April 22, 2018 @12:13PM (#16896790)
Frontpage was uhh
Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by setquk on Sunday April 22, 2018 @12:49PM (#16897007)
It worked. Occasionally.

I remember having to purge front page extensions off many a server. Cathartic feeling that one.

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by arca_vorago on Sunday April 22, 2018 @11:17AM (#16896518)
As a sysadmin who has seen and fixed drupal/wp/joomla/dreamweaver etc nightmares, I personally have settled on a combination of emacs org-mode html export (don't forget how beautiful the latex export can be!, and that you can run programs inside org-mode, and the google calendar integration, etc) and asciidoc and asciidoctor(nicer default html export settings, but I suggest custom pure css3/html5 no js!).

That said, back on subject:

Look, this is the main reason you devs tend to hear disdain from us sysadmins when we hear you want to run some new webservice in whatever language fad of the day (node, python, perl, php, asp.net, ruby, scala, go, etc) instead of generating files with your app that can then be serviced to the user using the tried and true tools (apache, nginx, hiawatha, haproxy etc) that have had sometimes decades of public internet exposure to claw thier way through.

Ah, but what about $functionality. Most webdevs think they need a scripting language backend when they really don't. There are uses for it and it has it's place, but it's been way overdone.

Relevant discussion: https://groups.drupal.org/security/faq-2018-002

Sidenote: I think everyone should check out hiawatha webserver, over at (https://www.hiawatha-webserver.org/). Hugo wrote it with security in mind and it by default addresses many things that no other webserver does. It's also gplv2 (which is a big deal for me), and it's performance is second to none. I'm not a big php person, but if I were to be doing a webapp where a backend like that would be needed, I would probably try to go PHP-FPM with hiawatha(mbed TLS)/haproxy and a really nicely hardened boxen and edge firewall(you are using nftables now right?).

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by shendryl on Wednesday April 25, 2018 @08:29AM (#16920888)
If you like Hiawatha, you should take a look at Banshee (https://www.banshee-php.org/). A secure PHP framework made by the same person as Hiawatha. A good alternative for Drupal, Wordpress and other pieces of spaghetti code.
Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by arca_vorago on Wednesday April 25, 2018 @11:15AM (#16922249)
Yeah I like it but I have tended to prefer to use static pages for the very reasons mentioned. I'll have to try it again sometime. I really wish Hugo would explain why he took it MIT though... as I've been working hard at what I call gnu'izing my stack.
Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by indigodaddy on Sunday April 22, 2018 @02:03PM (#16897482)
Source for the Hiawatha performance claim?
Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by arca_vorago on Sunday April 22, 2018 @10:05PM (#16899994)
Well it's a bit old now but a few years ago on the Hiawatha blog a test of load under attack was done and Hiawatha was able to handle a simulated (d?)dos very well.

I'm on mobile but a quick ddg show: https://www.hiawatha-webserver.org/weblog/64

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by bastawhiz on Sunday April 22, 2018 @11:37AM (#16896599)
Somewhat tangential anecdote:

I used to work a LONG time ago for a company that built Yahoo Small Business ecommerce websites. They used a tool called RTML ("Robert T Morris Language"), which was essentially HAML, powered by Perl, and constructed using a GUI (no text editor interface). Select where you want a node > New node > select node type > Save...each action was a full page load. The process was excruciating, and I was in charge of developing tools to automate the upload of "template" files from the developer's machine to the client's Yahoo Small Business store.

At the end of the day, the customer would load up all their goods into the Yahoo database and hit "Publish", at which point a multi-hour job would kick off to run their RTML against the database. The result was a completely static ecommerce website. Only the cart/checkout pages were dynamic, and those were using shared code.

The development process was a nightmare. The client experience was really bad (want to fix a typo? You're going to wait a couple hours). But I'll be damned if it was possible for anyone to hack those things. There was nothing to hack.

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by stephenr on Sunday April 22, 2018 @04:15AM (#16895239)
Im pretty convinced static site generators should be the default first choice for most sites.
Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by StavrosK on Sunday April 22, 2018 @06:22AM (#16895536)
I've recently found the perfect middle ground: Django with Wagtail and Bakery. Django is Django, Wagtail is a very well designed CMS, and Bakery allows you to export Django views as static files. That way, I managed to convert my dynamic website to a static one with a few lines of code (basically a loop that iterates over all URLs on my site).
Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by bonesss on Sunday April 22, 2018 @05:02AM (#16895343)
Especially if you're popular and want to scale.

Turning that CMS into a distributed publishing platform is tricky, but scaling static content is easy-mode from top to bottom.

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by Roritharr on Sunday April 22, 2018 @04:15AM (#16895238)
That's of course a good solution but then you want your Ajaxy Web 2.0 Things in there, some more complicated forms maybe and you start looking at something that takes quite some effort to build compared to what you get from WordPress/Drupal etc.

Funnily enough, having worked on all kinds of websites for the past 15 years, i'm still at a loss when asked what the all-round good solution is.

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by andybak on Sunday April 22, 2018 @04:26AM (#16895265)
Maybe the problem is the phrase "all round". There are trade offs to be made and complex cost/benefit calculations that are required.

To further complicate things, things change. A website that was a perfect fit for a Wordpress template easily grows beyond that. And a site that seemed ideal for a custom Django/Rails backend might eventually settle into the kind of functionality groove where you begin to wonder if an off the peg solution might not have been a better idea.

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by jlgaddis on Sunday April 22, 2018 @04:42AM (#16895301)
WordPress at least automatically updates itself. There's been a few times when auto updates broke but, overall, it has been a tremendous help in reducing the number of exploited web servers out there.
Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by scandox on Sunday April 22, 2018 @06:52AM (#16895605)
Whenever I try to sell this internally we fall down on plugins. Marketing are using hundreds of them that we can’t replicate.
Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by arbie on Monday April 23, 2018 @03:14AM (#16901141)
Hundreds!?

Is there significant overlap in their functionality?

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by scandox on Monday April 23, 2018 @04:57AM (#16901718)
I have no idea. We more or less took one look at all the crazy sh*t they were doing with pixels, trackers, inbound marketing, outbound marketing, SEO, sitemaps, special codes for FB, GA, dynamic landing pages...

You know it's all trivial garbage...except if you want to replace it you need to support it, train them to use these tools and at every point you're going to encounter this resistance about WHY you're doing it and you say well security and speed and they're like it's fast enough and we've never been hacked.

So until the site grinds to a halt and they get also get hacked they basically view you as a blocker.

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by dreamfactored on Sunday April 22, 2018 @06:12PM (#16898914)
That's how the early CMS's like Vignette worked and they evolved to solutions like WP and Drupal which are better for the web publishing use case - easier to maintain, develop, and capable of real-time UGC and publishing (real-time is crucial for SEO in commercial publishing).

Static site generators are simply a file-system caching layer. Drupal used to have one of those and it was a terrible idea as the number of page variants on a commercial site very quickly hits file-system limitations and performance is appalling. Better to use a proper CDN for a similar result but with massively reduced latency due to content being served from the edge.

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by sphix0r on Sunday April 22, 2018 @04:12AM (#16895227)
This.

Most websites are mainly read only anyway. No need to throw in a programming language and store the data in a database.

The thing is, non-tech savvy people should be able to use(and deploy) and understand the static-web generators.

Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by tenken on Sunday April 22, 2018 @10:05AM (#16896213)
Grav CMS is interesting.
Re:“Drupalgeddon2” touches off arms race to mass-exploit pow... by pathartl on Monday April 23, 2018 @12:23PM (#16904824)
I've always wanted to try it. I'm more interested in Statamic which is premium, but seems better supported and I'd be more comfortable putting clients on it. From an outside perspective without having used either, that is.