Hacker News Reader

Comment by mjgs | Hacker News Reader

I like the idea of aggregating mentions from around the web on my personal static site. Ideally I would want to always have the most recent data, and not expose my site in a way that could be hacked.

These are the implementations that come to mind:

- re-render entire site on receipt of new mention (live data, but dangerous)

- re-render site on a schedule (less dangerous, nearly live data)

- fetch mentions client-side (live data, safe, but requires javascript enabled in the browser)

[UPDATED] - use cloud edge worker to insert the live data as the page is being returned to client (live data, safe, works with JS disabled in browser)

Are there some implementations that I’m missing?

View on HN

> not expose my site in a way that could be hacked

What do you mean? XSS? SQL injection? What are you afraid would get hacked?

> use cloud edge worker

So you let a 3rd party private company interfere in serving your website? Of course we rely on third parties for some things, but that's a pretty dramatic course of action to let one of those edit your webpages on the fly.

> What do you mean? XSS? SQL injection? What are you afraid would get hacked?

Perhaps hacked isn’t the right way to describe it. The issue is that if you setup a re-build if your static site on receipt of a mention, that means anyone on the internet can rebuild your site whenever just by creating a mention. That has the potential to take your site down because for example you might run out of build monthly minutes. There are probably other ways such a setup could be used to cause issues.

> that's a pretty dramatic course of action to let one of those edit your webpages on the fly

The way I have been thinking of cloud edge workers is just another place you can run some compute when you get a request. I think I can see why you might be hesitant, so you might have a valid point, I haven’t spent a huge amount of time analysing the threat vectors that are inherent with edge workers.

In your opinion, why are edge workers more dangerous than the usual hosting provider that ‘interferes’ with the request by rendering and returning the page?

Live-but-throttled is a decent compromise between the first two. Maybe something that submits a notification directly to you, as chance to approve/deny/respond, moderate what gets published, and be generally aware of what you’re publishing for that matter.

Oh yeah I hadn’t considered the need for a review & approve step. That’s pretty important. So actually implementing web mentions is kind of non-trivial.

An option that just occurred to me:

- use edge workers to fetch and insert data as the page is being returned to the client

That would work in browsers with JS disabled.

You could also have client-side code to update with live data as it comes in.

The downside is that it’s not very portable code, but that’s the same for most serverless stuff, and it’s probably not that difficult to re-implement on another platform.

Reply on news.ycombinator.com