3 ms·
As I read this I'm building a distribution of a web framework that eliminates block templates and will only have one page template (for the head HTML). I'm gon
by RNCTX 5y ago
As I read this I'm building a distribution of a web framework that eliminates block templates and will only have one page template (for the head HTML). I'm gonna have CSS generation and upload built in the CMS as well (tailwind or tachyons only).
I'm sure there will be howls of "you can't let them put code in the database!"
Why not? It's their (the customer's) database and their web service, after all. You can do all sorts of validation on a form input and a database field (like with Tidy and Bleach in my case with Python). Can't do any on a plain text template file.
But "separation of concerns!"
For who? It's always been bad practice in my opinion to assume that not only do end users have on-staff development, or contract development, but that they have multiple tiers of it which need lines drawn between the duties of each. Who says everyone who needs custom software or custom web services is an IBM-sized conglomerate with multiple departments full of software developers? Why can't a mom and pop restaurant have a nice website and a nice phone app? Because they don't want to learn to use javascript, webpack, npm, git, and an IDE? Is that the only reason why?
The least accessible (in a physical sense) parts of web development are the parts that a customer might do themselves (CSS and HTML). I will not believe there is a good reason for that other than software developers trying to talk themselves into more jobs and more contracts.
- jgalentine007 5y agoQuestion- if you're using eval() and bleach, won't your security be totally dependent on bleach not having a vulnerability?
- RNCTX 5y agoSure. Kinda like how storing web templates in files is totally dependent on the people who upload them not putting crypto miners in the linked javascript(s) [1]. Or totally dependent on PAM not having a vulnerability [2]. Or totally dependent on SSH not having a vulnerability [3]. In terms of libraries and utilities I can give PAM and SSH a pass for fixing these things long ago. In the case of restricting a customer's access to the mechanism that renders their thing in favor of the option of "trust this guy who uploads things instead" you've got a much tougher sell about why that's better. 1. https://www.fortinet.com/blog/threat-research/the-growing-trend-of-coin-miner-javascript-infection https://www.fortinet.com/blog/threat-research/the-growing-tr... 2. https://www.cvedetails.com/cve/CVE-2002-1227/ https://www.cvedetails.com/cve/CVE-2002-1227/ 3. https://www.cvedetails.com/cve/CVE-2002-0083/ https://www.cvedetails.com/cve/CVE-2002-0083/