3 ms·

Public Libraries on the internet need to be static websites where anyone can read a book in the browser. Which means you need one more static website that knows

Public Libraries on the internet need to be static websites where anyone can read a book in the browser. Which means you need one more static website that knows which book is hosted at which library. Obviously all of these sites need to run without JavaScript and the funding has to come from Companies interested in hiring educated folks who have read a few books. Every book needs to be in the language it was written in and in the public domain but that goes without saying. People will figure out how to find and read a book from one of these online libraries if they want to.

jamesrr39 3y ago
> static websites This is a nice intention and would be great for security. It works fine for displaying opening hours and upcoming events, etc. However, as soon as you want to search for books, or you want some log in feature to see which books you have loaned out and when they need to be returned, it's clear that a purely static site just doesn't cut it for today's expectations.
- Lacerda69 3y ago
  Sorry the dumb question, but why not? Can't I make a static page that offers search (reload on every query with results) or profile (reload every time soemthing is changed in the profile)
  - chrisandchris 3y ago
    I think your understanding of "static" website is off. A static site does not have any backend, thus cannot provide you with search results because it cannot do any computing at all (just provide you the same (static) content again and again).
    - deleted 3y ago
      [deleted]
    - benterix 3y ago
      Actually some subset of this functionality is possible with static or semi-static pages but actually the problem is not so much about a page being static or dynamic but about being read-only vs getting user input. As soon as you need to deal with user input, there are inherent security issues. You can go around these by having some presets in the profile and providing cached results for the most common search types but this is more or less as far as you can go.
      - fieldcny 3y ago
        This is incorrect, any request made by a browser to a backend will by definition accept user input whether it wants to or not. I can change the values of the presets I can add headers, remove headers change the value of cookies, add cookies, remove cookies etc etc.
        benterix 3y ago
        Strictly speaking, you are correct. But in this case dealing with user input such as headers and their modifications is the responsibility of the server just like dealing with potentially malformed HTTP replies is the responsibility of the browser. What we are talking here though is the possibility of interaction with the remaining elements of the system (application, database). If these are read-only, the attacker loses these attack vectors.
    - johngladtj 3y ago
      Any reason it can't just have a JSON page somewhere, and then the search simply be a JavaScript app that looks through that static JSON for all the entries that contain a given token in it's list of keywords? Most people don't need overly complex searches...
      - LorenzoGood 3y ago
        That would be so slow
fieldcny 3y ago
This is a very uninformed take, the real world is not this easy. Let’s just for a second assume they built a static only website (setting aside all your requirements to provide some way to read a book online which is ridiculously complex due to legal requirements to protect the content, data formats, and even simple things like pagination), most people in this thread thread would be commenting about how stupid it was that in this day and age one of the largest and most important libraries in the world only has a static site. The fact of the matter is that everyone has expectations, providing this service is not rocket science but security is hard and you need constant vigilance to stay up to date and safe. This is why all you kids who are like oh yeah I can just build x don’t realize that for the majority of ‘x’ the build part is the easy and cheap part, the maintain is the hard and expensive part.

jamesrr39 3y ago

> static websites This is a nice intention and would be great for security. It works fine for displaying opening hours and upcoming events, etc. However, as soon as you want to search for books, or you want some log in feature to see which books you have loaned out and when they need to be returned, it's clear that a purely static site just doesn't cut it for today's expectations.

Lacerda69 3y ago
Sorry the dumb question, but why not? Can't I make a static page that offers search (reload on every query with results) or profile (reload every time soemthing is changed in the profile)
- chrisandchris 3y ago
  I think your understanding of "static" website is off. A static site does not have any backend, thus cannot provide you with search results because it cannot do any computing at all (just provide you the same (static) content again and again).
  - deleted 3y ago
    [deleted]
  - benterix 3y ago
    Actually some subset of this functionality is possible with static or semi-static pages but actually the problem is not so much about a page being static or dynamic but about being read-only vs getting user input. As soon as you need to deal with user input, there are inherent security issues. You can go around these by having some presets in the profile and providing cached results for the most common search types but this is more or less as far as you can go.
    - fieldcny 3y ago
      This is incorrect, any request made by a browser to a backend will by definition accept user input whether it wants to or not. I can change the values of the presets I can add headers, remove headers change the value of cookies, add cookies, remove cookies etc etc.
      - benterix 3y ago
        Strictly speaking, you are correct. But in this case dealing with user input such as headers and their modifications is the responsibility of the server just like dealing with potentially malformed HTTP replies is the responsibility of the browser. What we are talking here though is the possibility of interaction with the remaining elements of the system (application, database). If these are read-only, the attacker loses these attack vectors.
  - johngladtj 3y ago
    Any reason it can't just have a JSON page somewhere, and then the search simply be a JavaScript app that looks through that static JSON for all the entries that contain a given token in it's list of keywords? Most people don't need overly complex searches...
    - LorenzoGood 3y ago
      That would be so slow

fieldcny 3y ago

This is a very uninformed take, the real world is not this easy. Let’s just for a second assume they built a static only website (setting aside all your requirements to provide some way to read a book online which is ridiculously complex due to legal requirements to protect the content, data formats, and even simple things like pagination), most people in this thread thread would be commenting about how stupid it was that in this day and age one of the largest and most important libraries in the world only has a static site. The fact of the matter is that everyone has expectations, providing this service is not rocket science but security is hard and you need constant vigilance to stay up to date and safe. This is why all you kids who are like oh yeah I can just build x don’t realize that for the majority of ‘x’ the build part is the easy and cheap part, the maintain is the hard and expensive part.