4 ms·
How do you hack a static HTML page? The point is that most WordPress pages don’t warrant the dynamic code execution on every page load. When you use a static
by sshine 3mo ago
How do you hack a static HTML page?
The point is that most WordPress pages don’t warrant the dynamic code execution on every page load.
When you use a static site generator and make content creation convenient behind the scenes, you move the entire attack surface to, in my case, nginx, the load balancer, and OpenSSL.
- kmoser 3mo agoYou don't hack a static HTML page, you hack the (presumably public-facing) vibecoded admin panel that can update the static page.
- sshine 3mo agoI think "yolo" gets overloaded here to mean "not thinking". I've described it as static HTML. The admin dashboard isn't static HTML, but it also isn't public-facing. The admin dashboard lives behind an oauth2-proxy authenticated via keycloak, and only accessible to the corporate wifi / vpn. The dashboard is really a completely separate application. The probability that you can hack an admin panel because you know the public URL assumes either there's a "Login" button on the front page, or that the admin panel depends on the source code in the same way as the public-facing pages.