4 ms·
>focus on removing attack surface, rather than continuously monitoring it. Amen to that. I stopped caring about these sorts of entries in my HTTP logs when I r
by drbawb 8y ago
>focus on removing attack surface, rather than continuously monitoring it.
Amen to that. I stopped caring about these sorts of entries in my HTTP logs when I realized these automated attacks target software packages written for language runtimes I don't even have installed. I'm sure not losing any sleep at night that someone is trying to hit phpMyAdmin or wp-admin on my server that doesn't even have a PHP interpreter.
- squarefoot 8y agoA while ago I was looking for a very lightweight system to set up a small CMS with no bells & whistles (Pico, Grav etc), but all of them seem to require PHP. Are there any alternatives around which could also dodge most common attacks by not having installed most common interpreters?
- tracker1 8y agoLook into static site generators... you basically write your site offline, and run a script to deploy it to a static web server (or mostly static). In the end, a web server that doesn't run any code outside delivering content is the most secure web server. It'll be fast, and (usually) near zero attack surface.