3 ms·
Well, because we have never seen any exploits with bash (Shellshock anybody?) or ssh (Heartbleed rings a bell?). You just don't know the weird ways things can
by erikb 10y ago
Well, because we have never seen any exploits with bash (Shellshock anybody?) or ssh (Heartbleed rings a bell?).
You just don't know the weird ways things can be exploited. And if an exploit is discovered you'll be just as happy as everybody else if you don't need to implement a fix yourself but can rely on others implementing, testing and reviewing fixes that they provide to you as an update.
- wolfgang42 10y agoAn exploit in bash or ssh would be fixed by a patch to bash/ssh, and has nothing to do with any given bash script.
- sho 10y ago> we have never seen any exploits with bash [..] or ssh[..]? Sure we have, and they have nothing to do with the static site generator. You're talking about compromising the web server in general. Totally unrelated. And you don't even need a web server with an SSG. I use a one locally and upload to S3. Maybe I "just don't know the weird ways things can be exploited", but I simply can't think of any conceivable angles on that. References to mysterious unknowable hacking superpowers aren't really useful. Paranoia is to be encouraged in security, but sometimes it really is just plain secure!