4 ms·

Well let's define what you mean by "maintaining a static site." Because if you can change it and update it, a la WordPress, then it's not really a static site.

by ebbv 12y ago

Well let's define what you mean by "maintaining a static site." Because if you can change it and update it, a la WordPress, then it's not really a static site. What you seem to mean is are there CMSes that output static pages instead of rendering pages live when they are viewed. And you're just really talking about caching. And the answer is, you can accomplish this pretty easily with just about any CMS (including WordPress) by using Varnish or other caching systems.

michaelmior 12y ago
When using a static site generator, you still change and edit content. It's just that the output is generated statically and users access the static content. Anyway, I'm guessing your interpretation of the OP's intent is correct. However, you can't do all the same with WordPress + Varnish. One of the nice things about statically generated sites is that you can deploy anywhere (such as S3) without minimal operational complexity.
- ebbv 12y ago
  > One of the nice things about statically generated sites is that you can deploy anywhere (such as S3) without minimal operational complexity. Fair point. I was not entering any hosting concerns into the equation, only the behavior of the system as a whole.
  - icebraining 12y ago
    Caching is not the same, since if the page isn't in the cache - and it's often easy to find one that isn't -, the request will get passed on to the generator, which (vastly) increases the attack surface of the whole system.
    - ebbv 12y ago
      Come on, that's like saying brakes don't work because if you don't press them then your car doesn't stop. Of course if you're concerned about this you'd make sure every page is current int he cache.
      - icebraining 12y ago
        Then the attacker does a POST instead, which the caching layer passes on, and your work was for naught. I'm sure it's possible in theory to prevent all kinds of attacks, but it's not like not pressing the breaks, more like trying to plug every hole in a sieve. The tool just isn't built to help you do that.
falcolas 12y ago
One major problem with Wordpress, especially when talking about mostly static sites, is that it tries to do so much more that it becomes challenging to secure. My favorite example is that Wordpress has its own cron system, which uses loopback requests to implement asynchronously. This is ok for a minimal blog install by someone without sysadmin experience, for a corporate site it just becomes a security liability.

by ebbv 12y ago

michaelmior 12y ago

When using a static site generator, you still change and edit content. It's just that the output is generated statically and users access the static content. Anyway, I'm guessing your interpretation of the OP's intent is correct. However, you can't do all the same with WordPress + Varnish. One of the nice things about statically generated sites is that you can deploy anywhere (such as S3) without minimal operational complexity.

ebbv 12y ago
> One of the nice things about statically generated sites is that you can deploy anywhere (such as S3) without minimal operational complexity. Fair point. I was not entering any hosting concerns into the equation, only the behavior of the system as a whole.
- icebraining 12y ago
  Caching is not the same, since if the page isn't in the cache - and it's often easy to find one that isn't -, the request will get passed on to the generator, which (vastly) increases the attack surface of the whole system.
  - ebbv 12y ago
    Come on, that's like saying brakes don't work because if you don't press them then your car doesn't stop. Of course if you're concerned about this you'd make sure every page is current int he cache.
    - icebraining 12y ago
      Then the attacker does a POST instead, which the caching layer passes on, and your work was for naught. I'm sure it's possible in theory to prevent all kinds of attacks, but it's not like not pressing the breaks, more like trying to plug every hole in a sieve. The tool just isn't built to help you do that.

falcolas 12y ago

One major problem with Wordpress, especially when talking about mostly static sites, is that it tries to do so much more that it becomes challenging to secure. My favorite example is that Wordpress has its own cron system, which uses loopback requests to implement asynchronously. This is ok for a minimal blog install by someone without sysadmin experience, for a corporate site it just becomes a security liability.