3 ms·

I like the idea of aggregating mentions from around the web on my personal static site. Ideally I would want to always have the most recent data, and not expose

by mjgs 6y ago

I like the idea of aggregating mentions from around the web on my personal static site. Ideally I would want to always have the most recent data, and not expose my site in a way that could be hacked. These are the implementations that come to mind: - re-render entire site on receipt of new mention (live data, but dangerous) - re-render site on a schedule (less dangerous, nearly live data) - fetch mentions client-side (live data, safe, but requires javascript enabled in the browser) [UPDATED] - use cloud edge worker to insert the live data as the page is being returned to client (live data, safe, works with JS disabled in browser) Are there some implementations that I’m missing?

90minuteAPI 6y ago
Live-but-throttled is a decent compromise between the first two. Maybe something that submits a notification directly to you, as chance to approve/deny/respond, moderate what gets published, and be generally aware of what you’re publishing for that matter.
- mjgs 6y ago
  Oh yeah I hadn’t considered the need for a review & approve step. That’s pretty important. So actually implementing web mentions is kind of non-trivial.
- mjgs 6y ago
  An option that just occurred to me: - use edge workers to fetch and insert data as the page is being returned to the client That would work in browsers with JS disabled. You could also have client-side code to update with live data as it comes in. The downside is that it’s not very portable code, but that’s the same for most serverless stuff, and it’s probably not that difficult to re-implement on another platform.
southerntofu 6y ago
> not expose my site in a way that could be hacked What do you mean? XSS? SQL injection? What are you afraid would get hacked? > use cloud edge worker So you let a 3rd party private company interfere in serving your website? Of course we rely on third parties for some things, but that's a pretty dramatic course of action to let one of those edit your webpages on the fly.
- mjgs 6y ago
  > What do you mean? XSS? SQL injection? What are you afraid would get hacked? Perhaps hacked isn’t the right way to describe it. The issue is that if you setup a re-build if your static site on receipt of a mention, that means anyone on the internet can rebuild your site whenever just by creating a mention. That has the potential to take your site down because for example you might run out of build monthly minutes. There are probably other ways such a setup could be used to cause issues. > that's a pretty dramatic course of action to let one of those edit your webpages on the fly The way I have been thinking of cloud edge workers is just another place you can run some compute when you get a request. I think I can see why you might be hesitant, so you might have a valid point, I haven’t spent a huge amount of time analysing the threat vectors that are inherent with edge workers. In your opinion, why are edge workers more dangerous than the usual hosting provider that ‘interferes’ with the request by rendering and returning the page?

by mjgs 6y ago

90minuteAPI 6y ago

Live-but-throttled is a decent compromise between the first two. Maybe something that submits a notification directly to you, as chance to approve/deny/respond, moderate what gets published, and be generally aware of what you’re publishing for that matter.

mjgs 6y ago
Oh yeah I hadn’t considered the need for a review & approve step. That’s pretty important. So actually implementing web mentions is kind of non-trivial.
mjgs 6y ago
An option that just occurred to me: - use edge workers to fetch and insert data as the page is being returned to the client That would work in browsers with JS disabled. You could also have client-side code to update with live data as it comes in. The downside is that it’s not very portable code, but that’s the same for most serverless stuff, and it’s probably not that difficult to re-implement on another platform.

southerntofu 6y ago

> not expose my site in a way that could be hacked What do you mean? XSS? SQL injection? What are you afraid would get hacked? > use cloud edge worker So you let a 3rd party private company interfere in serving your website? Of course we rely on third parties for some things, but that's a pretty dramatic course of action to let one of those edit your webpages on the fly.

mjgs 6y ago
> What do you mean? XSS? SQL injection? What are you afraid would get hacked? Perhaps hacked isn’t the right way to describe it. The issue is that if you setup a re-build if your static site on receipt of a mention, that means anyone on the internet can rebuild your site whenever just by creating a mention. That has the potential to take your site down because for example you might run out of build monthly minutes. There are probably other ways such a setup could be used to cause issues. > that's a pretty dramatic course of action to let one of those edit your webpages on the fly The way I have been thinking of cloud edge workers is just another place you can run some compute when you get a request. I think I can see why you might be hesitant, so you might have a valid point, I haven’t spent a huge amount of time analysing the threat vectors that are inherent with edge workers. In your opinion, why are edge workers more dangerous than the usual hosting provider that ‘interferes’ with the request by rendering and returning the page?