News for hackers. Stuff that matters.

A comment on Ask HN: How do you continuously monitor web logs for hack attempts?. Parent comment

Re:Ask HN: How do you continuously monitor web logs for hack... by drbawb on Tuesday May 08, 2018 @09:52AM (#17020856)
>focus on removing attack surface, rather than continuously monitoring it.

Amen to that. I stopped caring about these sorts of entries in my HTTP logs when I realized these automated attacks target software packages written for language runtimes I don't even have installed. I'm sure not losing any sleep at night that someone is trying to hit phpMyAdmin or wp-admin on my server that doesn't even have a PHP interpreter.

[ Parent | on HN ]
Re:Ask HN: How do you continuously monitor web logs for hack... by squarefoot on Tuesday May 08, 2018 @12:14PM (#17022049)
A while ago I was looking for a very lightweight system to set up a small CMS with no bells & whistles (Pico, Grav etc), but all of them seem to require PHP. Are there any alternatives around which could also dodge most common attacks by not having installed most common interpreters?
[ Parent | on HN ]
Re:Ask HN: How do you continuously monitor web logs for hack... by tracker1 on Tuesday May 08, 2018 @03:06PM (#17023776)
Look into static site generators... you basically write your site offline, and run a script to deploy it to a static web server (or mostly static). In the end, a web server that doesn't run any code outside delivering content is the most secure web server. It'll be fast, and (usually) near zero attack surface.
[ Parent | on HN ]