Hacker News Reader

Comment by simonw | Hacker News Reader

I miss the days when "implement your own blogging engine" was one of the most popular learning projects for engineers.

We should bring that back! Its such a great way to play around with client- and server-side development options in an almost zero-risk environment.

View on HN

When I was a teenager I wrote my first "CMS" and was very proud. A few months later someone called my parents and asked for me. He said he was a developer and found some issues with security. He gave me a few tipps and suggested me some books and left for good. Never talked to hm again but this was so kind and I learned a lot about secure coding after that.

I wrote a "CMS" in college as a project in PHP (really hot then) so you could drag txt files and images into whatever directories and it would create web pages based on that. Professors were not impressed: "why you would want such thing, a MS Access would be better". I was disappointed, but hey, that's life.

I used PHP for so much stuff in the past. Really gave me a good start in large company but in school they teached us Microsoft FrontPage as the way to go tool for websites. Strange days. Hope you went on with your ideas and don't let anyone tell you otherwise.

I wrote my own DSL to write my own blogging engine with embedded Lua, jq, mustache, and more:

https://github.com/williamcotton/webpipe

My blog code:

https://github.com/williamcotton/williamcotton.com/blob/mast...

  GET /hello/:world
    |> jq: `{ world: .params.world }`
    |> handlebars: `<p>hello, {{world}}</p>`
  
  describe "hello, world"
    it "calls the route"
      when calling GET /hello/world
      then status is 200
      and output equals `<p>hello, world</p>`

I suppose it's because fewer people have personal web sites these days?

What is the typical learning project these days for beginners of a programming language?

Maybe the ubiquitous "to do list" app?

Any simple CRUD app should do.

I vote for inventory apps. Books, movies, games, whatever.

Every headline when I was in college was "App J Sold for a Gizzillion Dollars." So, I figured I would learn programming and join the club. Easier said than done. Nevertheless, I started watching YouTube videos titled "Make a Clone of J."

In hindsight, it was a horrible way to learn. Most YouTubers probably benefited more from clickbait teaching than from actual fundamental teaching. Eventually, I was able to navigate the internet and land on an actual structured curriculum, whose lectures and courses were long and boring but taught you the fundamentals of programming.

I am picking up a similar pattern with Vibe Coding. Beginners are more excited about having a launched product wrapped with a band-aid rather than having deep knowledge.

Still a good project when one learns a new programming language.

yep. What makes it good is that it's an easy concept to imagine the use cases, but contains subtle details that covers the breadth and depth to gain the experience you need/want. Getting it wrong is not a death sentence (as long as you quarantine the project to it's own, rather than make it part of your home setup...).

I keep thinking a nice client app that is mostly working against a directory of markdown files that "publishes" to an option of fastly/denoland/cloudflare as mostly-static content would be a pretty nice option.

The blog/data directory can be backed up or even using a github repository for long term raw storage.

I'm not a fan of having the same site/application for rendering as editing the blog as it tends to become too much of a big/easy target... ie: Wordpress, how much internet traffic is script bots trying WP exploits?

Everything web-facing, if it's not a static website delivered by a well-tested web server, happens in a high-risk environment. And doubly so, if, like in this case, stuff like custom cgi libraries are involved. One has to be either very confident in their skills to do that or very, very brave.

What? Are you serious?

If you roll your own little cgi-bin perl script behind Apache you're far from vulnerable compared to, say, a WordPress website.

In any web application all data that comes from the outside world is potentially hostile. A decent web framework takes care of basic security measures, does input sanitation, provides referer checking and csrf for forms, etc. When you roll your own, your _are_ on your own to do that all properly yourself, if you even know all the potential pitfalls. And if you write your own cgi library like the op even more so. I'm not advocating for using WordPress either. I'm advocating for either having a static blog or using a decent, tested web framework or the the very least cgi module that provides tested implementations of common security features that in my experience are typically missed in self-made cgi scripts.

Nah. There are ways to mitigate the blast radius of experiments like this.

You can't utterly wrap developers up in cotton wool. Ultimately, people learn strong lessons from screwing up. You can at least make sure they're doing this learning within a sandbox in which the damage is contained. Like, maybe containerising it so it has limited access to anything that could do any real damage. If somebody builds a blogging app and the worst thing that happens is that they learn the value of sanitising your input, preventing SQL injection, that spam is an unfortunate fact of life, and that you should be very careful with how you manage cookies, I would consider that a _very_ big win for that novice developer.

Because we're talking about _developers_ here.

I am not exactly sure about using containers (most likely you mean docker/podman) as sandboxes...

Please correct me wrong but for a better form of sandboxing, I would recommend something like microvm and the bottlefire thing which was recently shared if that might pique your interest as I found it to be interesting and then using it with something like https://github.com/Zouuup/landrun

There is also tinykvm and other projects too which can simply take a binary and run it and I think that maybe developers should also try out all the different sandboxes and different things just for understanding as well I suppose too. To me, I really like playing with different form of sandboxes or such technologies in general.

Also do note that I am not sure if bottlefire provides sandbox/isolation by default as they mention Sandbox with Landlock seperately so I am now a bit confused if they provide sandbox by default or not as I previously thought it might have.

Sure, there are many ways to achieve the same end of limiting blast radius, but that's not really the point here: the point is that we should dismiss projects like this solely because something might go wrong, especially when there are ways to mitigate against real damage.

Ok. I'll bite. What are the risks? As I see it, if you screw up and someone get root access on your server, it's the worse that may happens and then shut down the whole thing is a click away.

Yes, if they do it for fun.

If they do it for money they will install something else and run it in parallel with the blog of the owner of the server. If they are good they'll be lean with resources and not get noticed for months or years. Example: I don't run ps -ef on my server very often and even if I did there are things that can be hidden from ps. It can get complicated.

My point here is that if someone breaks your blog, they've broken your blog. The blast radius of that should be strictly limited.

Obviously don't go rolling your custom CGI scripts on a server that also hosts your personal email - but these days we are spoiled for choice in terms of isolated hosting strategies for a blog.

Heroku, Vercel, Cloudflare Workers, Fly.io, GitHub Pages, a $5/month VPS...

But "broken your blog" could mean "shell access to your blog server" -- is there no risk of illegal activities happening on that server that put the owner at risk? Like, I don't know, drug trade or child porn or whatever?

Philosophically: L'État, c'est moi, build your crappy cgi scripts with nginx or apache all from the CLI and all in vim and you will understand.

Practically: Ports 22, 80, and 443 open and directly accessible from 0.0.0.0/0 is extremely manageable.

Why would anyone today leave port 80 open? I do https by default even for my blog.

For me personally it's just old configs I have that redirect from port 80 to 443. You're right though - probably unnecessary in this day and age.

Anecdotally, I can't remember ever hearing about someone getting in real trouble because their server got popped and someone else used it for crime.

oh my gosh someone got root on your php personal home page

1. nobody cares 2. its not that complicated to write a dynamic web page that isn't going to get pwned

Reply on news.ycombinator.com