3 ms·

Yeah. That's why I said I could host it myself if I wanted, in a container separate and isolated from my blog. I'm just too lazy to bother. This is gonna be

Yeah. That's why I said I could host it myself if I wanted, in a container separate and isolated from my blog. I'm just too lazy to bother. This is gonna be the case no matter how the content is passed in the request (I.e. url vs form encoding). It's dynamic content. What is your proposed solution for supporting dynamic content on a static site that doesn't involve running some kind of service on the side?

superkuh 7y ago
It's not so much not running a service as not running any more services that are receiving connections of any kind from the 'net. I trust nginx. I don't trust some webmentions specific script or program. I implemented my website's (see profile) comment system based on a tiny perl script that tails the logs from my webserver. It's completely separate and no internet user is connecting to it. Any URL, followed by the string "/@say/" like, "http://what.ever/something.html/@say/Neat http://what.ever/something.html/@say/Neat something" is added to the comment page.
- CarelessExpert 7y ago
  That's a distinction without a difference. What you've done is made the webserver a blanket endpoint, where the "API" and the "database" are your web server log files. Practically speaking, what you have is a CGI script with a non-standard interface to the server. It's still subject to any bugs in your perl script, since you're still processing input from an untrusted location. It's certainly clever, though!
  - superkuh 7y ago
    One of the promoted examples on the indieweb site for webmentions is sending webmentions manually with curl. But since it's form encoded you'll never know what the values were when you look in the logs. If it was just a URL string then you could do the entire thing manually with cURL. You'd have to agree this would be a distinction with a difference.

3 ms·

Yeah. That's why I said I could host it myself if I wanted, in a container separate and isolated from my blog. I'm just too lazy to bother. This is gonna be

by CarelessExpert 7y ago

superkuh 7y ago
It's not so much not running a service as not running any more services that are receiving connections of any kind from the 'net. I trust nginx. I don't trust some webmentions specific script or program. I implemented my website's (see profile) comment system based on a tiny perl script that tails the logs from my webserver. It's completely separate and no internet user is connecting to it. Any URL, followed by the string "/@say/" like, "http://what.ever/something.html/@say/Neat http://what.ever/something.html/@say/Neat something" is added to the comment page.
- CarelessExpert 7y ago
  That's a distinction without a difference. What you've done is made the webserver a blanket endpoint, where the "API" and the "database" are your web server log files. Practically speaking, what you have is a CGI script with a non-standard interface to the server. It's still subject to any bugs in your perl script, since you're still processing input from an untrusted location. It's certainly clever, though!
  - superkuh 7y ago
    One of the promoted examples on the indieweb site for webmentions is sending webmentions manually with curl. But since it's form encoded you'll never know what the values were when you look in the logs. If it was just a URL string then you could do the entire thing manually with cURL. You'd have to agree this would be a distinction with a difference.