3 ms·
If it generates something, it can still do whatever it wants with the generated files if the purpose is to, for example, embed spam links. If the server is the
by KarlKemp 5y ago
If it generates something, it can still do whatever it wants with the generated files if the purpose is to, for example, embed spam links.
If the server is the target, it either still has access to it, or to some alternative computer which, for a private individual writing a blog, will be their much more valuable personal device.
Yes, you can spin up a VM, generate html, run it through all sorts of tests and only then upload it. The victims of this hack aren’t going to do that.
- Tomte 5y agoThat's a threat model that is wildly imaginative. Tell your web server to only serve the login stuff to you (certificates, HTTP Basic Auth, whatever). Problem solved. And what is your solution? A SSG also generates something and could embed bad stuff. Something has to upload your SSG generated files and thus needs access to your web server. If you're running it on your personal device it could compromise it. Really, stop trying so hard to invent Wordpress problems. If you don't like it, nobody forces you to use it.