3 ms·
It's not so much not running a service as not running any more services that are receiving connections of any kind from the 'net. I trust nginx. I don't trust s
by superkuh 7y ago
It's not so much not running a service as not running any more services that are receiving connections of any kind from the 'net. I trust nginx. I don't trust some webmentions specific script or program.
I implemented my website's (see profile) comment system based on a tiny perl script that tails the logs from my webserver. It's completely separate and no internet user is connecting to it. Any URL, followed by the string "/@say/" like, "http://what.ever/something.html/@say/Neat http://what.ever/something.html/@say/Neat something" is added to the comment page.
- CarelessExpert 7y agoThat's a distinction without a difference. What you've done is made the webserver a blanket endpoint, where the "API" and the "database" are your web server log files. Practically speaking, what you have is a CGI script with a non-standard interface to the server. It's still subject to any bugs in your perl script, since you're still processing input from an untrusted location. It's certainly clever, though!
- superkuh 7y agoOne of the promoted examples on the indieweb site for webmentions is sending webmentions manually with curl. But since it's form encoded you'll never know what the values were when you look in the logs. If it was just a URL string then you could do the entire thing manually with cURL. You'd have to agree this would be a distinction with a difference.