Comments (2)
I think @eduardoboucas's Staticman is an awesome project, and I'd love to use it, but there are a few things that make me a bit reserved before adding it:
- No notifications for participants in a comment thread. That means you can't really have a conversation. People will post a comment and then forget all about it and never see the replies.
- Are there user accounts? That is, when someone posts a comment, is there a name, image, and link to find more info about them?
- A variety of security concerns:
- Giving write access to my repo (and many other repos) to a single GitHub account. This makes the Staticman GitHub account a prime target for hacking.
- CSRF support. Without a basic CSRF token, it seems like anyone anywhere could post to the URL
https://api.staticman.net/v1/entry/{your GitHub repository}/{your repository name}/{the name of the branch}
and either automatically generate a comment on your site or at least flood you with PRs. Is there at least rate limiting? - Injection attacks. Depending on how the Staticman code writes into your data directory, an attacker could craft a POST that breaks out of that code and ends up modifying other files and folders in your repo. Of course, you can prevent these sorts of attacks through escaping, but YAML, which is typically used for Jekyll data files, and the various YAML libraries out there are notorious for really nasty injection exploits.
from yevgeniy-brikman-homepage.
All of brikis98’s concerns for Stickman are valid. Nonetheless, Disqus comes with its own set of issues. FWIW I’ve implemented Stickman on a yevgeniy-brinkman-homepage cloned site if this is still of interest to you. Huge thanks to brikis98 for his design!
faithworkcamps/faithworkcamps.github.io
from yevgeniy-brikman-homepage.
Related Issues (20)
- Add site monitoring HOT 1
- Fix header sizes
- Add a favicon
- Add Twitter / FB share meta tags
- Update links in the book to point to ybrikman.com
- Monetization HOT 1
- Add concatenation and minification HOT 1
- Make links stand out more
- Highlight selected nav item
- Fill out README
- Fix styling for tags page
- Add next / previous buttons to the post page HOT 1
- These need text descriptions
- Tags and Popular links overlap oddly on mobile
- Check blogger canonical URLs
- Add read more link to blog post list HOT 1
- Create standalone, linkable pages for each project
- Hello, Startup should appear on the page with individual blog entries HOT 1
- Future photo solution HOT 7
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from yevgeniy-brikman-homepage.