> "...By default, registration of new users is disabled." It's good to know that it can be disabled, but I'm mostly concerned with attack surface, minimalism/h

> "...By default, registration of new users is disabled." It's good to know that it can be disabled, but I'm mostly concerned with attack surface, minimalism/hackability and not getting caught on an upgrade treadmill. At the moment my personal Web site is static, the Web UI to my git repos is static and read-only, pushing to those repos is done via SSH, I accept patches by email, etc. I'm hesistant to run anything dynamic at all, let alone something more complex than I need (e.g. a Web frontend) with the capability to perform destructive actions which I don't need (even if they're marked 'disabled'). It would be nice to have an Internet-facing server which only deals with untrusted data, accumulates incoming updates to a file (e.g. sqlite), pushes out posts from a queue (e.g. a directory) and serves the necessary public info when requested, maybe using static files for stuff like my profile. I can then read and write those files over SSH, maybe transforming them into some easy to consume format like maildir. Of course, the first rule of security is don't write it yourself, but this is beginning to sound like a nice weekend project :)