Hacker News Reader

Comment by r0muald | Hacker News Reader

"Never worry about getting your site hacked. Since there isn’t a database, there’s nothing to hack."

Please. Seriously statiq.io wants prospective clients to believe this is their view on "hacking sites"?

I know... Is there a server? Are there user accounts? Is there something generating the static pages? Then there's something to hack.

You generate the pages on your local machine, or on our cloud service that is coming soon.

The only server involved is the one that runs the compile process. Once the site is built, we push it to S3, and your site is up… Nothing else is needed to view it.

That still leaves a server that can be attacked, and a way to inject code into people's pages through the compiler.

I'm not suggesting it would be in any way easy, it may be nearly impossible, but not having a database isn't the same as being "unhackable."

Seriously - there's always some attack vector. I got notified a few months ago that an old static blog on one of my personal sites that I had totally forgotten about was hacked (bad permissions + some feedback form).

Most web hosts have some form of caching available to customers so the concurrency argument doesn't hold up well either.

Compromise the S3 bucket that holds my site, then.

I can't. But then again Hacker News is full of examples and hacks that I'm incapable of pulling off. So that doesn't really mean anything.

It's also about optimization.

Reply on news.ycombinator.com