Hacker News Reader

Comment by alxmng | Hacker News Reader

I’m skeptical cheap and easy is something inherent with static sites. I think a dynamic setup can have both those qualities, but there isn’t yet CMS/blog software that hits the sweet spot: self-contained, simple to setup, manage, and host.

View on HN

Dynamic sites are a strict superset of static sites. A static website will always be easier to host, and it will always have a smaller attack surface simply because less code is needed - especially custom one-off code.

There is no custom executable to run, there is no need for authentication, there is no need to write files to disk, there is no need to parse user-provided content, there is no need to access a database, there are no custom libraries to update... A static website can literally be "upload and forget", and that simply isn't the case for dynamic sites.

The static sites attack surface is so small that it is zero :)

You get everything anyway, and nothing you do is used by the server.

Of course the server itself can be attacked, though it is much more difficult then with dynamic sites.

Write your own. You know what subset of features you care about, only implement what you need how you need it, and don't worry about making it extensible for others. You'll never need to read any documentation or worry about breaking changes when you update it, and you'll know exactly what it is doing.

I wrote my blog's static site generator 10 years ago and I'm still using it. If I want something it doesn't do, I change it. It's still a single-file perl script and it's easier (for me) than any other option.

Publii is a nice, easy to use, self-contained GUI for creating static websites. And Open Source, too.

I've been running a site with Publii (at https://legendstudio.com/) for a few years now. Really happy with it.

Hugo users would disagree with you.

Indeed. These days we have 24x7 net connections on both our mobiles as well as home LAN/desktop whatever, but you still can't get a single, 1-click, drop-dead simple program that you can use to both author as well as serve web-pages and images right from your own device. Thanks largely to dynamic IPs, NAT, firewalls, ISP upstream throttling and developer apathy (since their livelihood may depend on the complexity of this), Joe wanting to publish his thoughts or photos still either has to sell his soul to FB/Insta/whatever or fork over significant cash for the likes of Wordpress/Squarespace, OR spend days to teach himself the nitty-gritty of buying a domain, fiddling with your DNS, setting up dynDNS, connecting all this to GitHub pages or whatever, fronting the whole thing with Cloudflare.

Freenet has been doing this since the 00s.

This isn't the only reason. People who are trying to get attention will flock to where attention is directed. For better or worse, centralized platforms are a good place to do that. It's the same reason protestors, charity drives, people handing out free tickets to a new concert venue, do this in downtown parks and public squares, not their front yards. Popular photographers hold shows in galleries, not their own living rooms.

A really popular photographer might hold a show in their own house and invite people. People who matter would go.

Exposing your home devices to the internet is a really bad idea, because it exposes you to doxxing, DDoSing, whatever security issues your 5-year-old smartphone may have, and a plethora of other risks.

People used to do this in the 90s and early 2000s, but it turned out to be a hilariously bad idea security-wise. Even the enthusiasts these days use a dedicated server somewhere in a datacenter. Services like Github Pages and Cloudflare exist for a reason, and it isn't because anyone is trying to gatekeep web hosting.

Some of us have been doing this since the 90's and don't see and end in sight. The issues are not bad compared to your average customer service call. I prefer knowing what is going on with the technology I manage. Most websites are way over complicated on the backend. It's very easy to self-host.

Other than DDoS, all other issues you mentioned apply equally to all internet facing apps like Whatsapp etc. A static file server can be hardened to the point where only DDoS remains a significant threat and that hardly applies to an average Joe. IF my little site of a few boring pages & pics gets DDoS'ed, then I can move to Wordpress, Cloudflare or whatever.

There’s also a nice middleground - you can just proxy your site through Cloudflare. This masks your IP and protects against DDoS, the only caveat being you need to move your DNS to Cloudflare.

My usual model is to configure the servers to be hosted locally and rsynced anywhere else. I'm currently going through this exercise right now. I start by making everything good local and then can publish anywhere.

I love having a completely independent working local copy. My environment is perfect for my needs or I change it.

Basically my deployment plans and disaster recovery are indistinguishable.

I built a little micro CMS backend for myself that I’m working on open sourcing which is pretty much this. It parses markdown files with frontmatter into html on startup and stores them in an in memory SQLite database. So you have no real content rendering overhead, and you get the little extra bonuses like full text search with FTS4 by default. I use it with sveltekit and it’s pretty cool, strikes a nice balance and is hilariously fast.

If after 20 years of CMS/blogs (WordPress is 20), there isn't yet one...

You should try one of the free CDNs like Cloudflare or Netlify. Usually they're free for small sites. Integrates with static generators and git and makes the whole thing very simple.

I am using Cloudflare pages and it's super easy to use. In the easiest version, there isn't even git just plain old file uploads.

There are so many out there these days. It seems more likely to me that you just haven't found a static site generator which suits your workflow and technology preferences.

Reply on news.ycombinator.com