News for hackers. Stuff that matters.

A comment on Drupal Core – Highly Critical Public Service announcement. Parent comment

Re:Drupal Core – Highly Critical Public Service announcement by eikenberry on Wednesday October 29, 2014 @11:50PM (#8531266)
> b) the whole web is moving towards contextual dynamic delivery.

But not using server side dynamism like Drupal provides. It is moving towards sites serving up static files consisting mostly of Javascript that then call data services, so called single page sites.

[ Parent | on HN ]
Re:Drupal Core – Highly Critical Public Service announcement by snowwrestler on Thursday October 30, 2014 @11:44AM (#8533623)
In so-called single page sites, the data services are the server side dynamism. The only difference is that you've moved the template engine client-side, and replaced one call to the server-side application with multiple calls.

SQL injection attacks are just as possible against those kinds of apps, although slightly tougher to configure because you need to read client-side JS to find the service URLs, tokens, etc.

Drupal is used to power client-side JS-based sites. The current Tonight Show website is a recent example.

[ Parent | on HN ]