Re: Some thoughts on merging 0install.net and 0install.de

Here are 3 ideas.

Generate static pages from the wordpress site. There are at least a couple wordpress plug ins that do this.

Host it on a unikernel like mirage os https://mirage.io/. That lowers your attack surface by not running anything but the software to host the website.

Write the site in ur/web http://www.impredicative.com/ur/. Probably a bit of learning curve here though.
But it would be protected by the static type system from most injection attacks.

Phil


	

-----Original Message-----
From: Thomas Leonard [mailto:[email protected]] 
Sent: Sunday, July 31, 2016 3:49 PM
To: Bastian Eicher
Cc: The Zero Install system
Subject: Re: [Zero-install-devel] Some thoughts on merging 0install.net and 0install.de

On 31 July 2016 at 19:46, Bastian Eicher <[email protected]> wrote:
> 0install.net is an English website with a focus on the original version Zero Install for Linux.
> 0install.de is an English and German website with a focus on Zero Install for Windows.
> The following is a discussion on merging these two sites.
>
>> On 26 July 2016 at 14:08, Bastian Eicher <[email protected]> wrote:
>> > Hi Thomas,
>> >
>> > I have just finished a few small design changes on 0install.de to 
>> > bring the look closer to 0install.net. This got me thinking about 
>> > the possibility of merging 0install.net and 0install.de again. From 
>> > the perspective of an end-user the separation probably seems somewhat arbitrary and confusing.
>> >
>> > Perhaps we could take individual steps like these:
>> > 1. Align the visual design of the two websites as close as possible.
>> > 2. Design a common landing page for both sites.
>> > 3. Design a common navigation bar for both sites.
>> > 4. Host the content of both sites under the same domain name. We 
>> > could keep 0install.net content as static HTML files and 
>> > 0install.de content as WordPress-generated, since the file names / URIs do not collide.
>> > 5. Move some content from static HTML files to WordPress to add 
>> > multilingual/translation support.
>> >
>> > What do you think about this? Do you have any concerns or different ideas?
>> >
>> > Regards
>> > Bastian
>>
>> On 28 July 2016 at 21:53, Thomas Leonard <[email protected]> wrote:
>> Yeah, it would be good to bring these closer together. Would adding 
>> another subdomain be useful? e.g. docs.0install.net or something?
>>
>> The main problem I have with dynamic sites is that they tend to get 
>> hacked after a while, and then it takes effort to clean it all up. I 
>> did attempt to move it to github pages 
>> (https://urldefense.proofpoint.com/v2/url?u=https-3A__0install.github
>> .io_web-2Dsite_&d=CwICAg&c=4ZIZThykDLcoWk-GVjSLm9hvvvzvGv0FLoWSRuCSs5
>> Q&r=4Pr_PrAPzkvj5hwDAYMdDu8rWJVZyxE05zU9XgLghe8&m=G5diRWFi5mRAsa--GeoQf54KG1DsaqqmEPyHU3g-DAg&s=9tqKtdbQcHVReV-XrGxT8keDM9B81WxjPn1GsFeuZuw&e= ) though ideally I'd like to have something handle the php bug-reporter link, which github doesn't support.
>>
>> We should probably discuss it on the mailing list...
>
> I agree that static websites are preferable from a security standpoint. However, using WordPress for 0install.de has provided a few advantages for me:
>  * Logic for navigation, menus, shared title bars, etc. comes "for free".
>  * I use WordPress' user account features for 0install.de Sync. I did not have to build features like sign-up, forgot password, etc. myself.
>  * There are a bunch of ready-made plugins that implement "boring" stuff such contact forms and language switching.
>  * I can edit the website from my smartphone. ;) The recurring theme 
> with all this is: It saves me time that it can instead spend tinkering on Zero Install itself.
>
> I host 0install.de on a dedicated VM. I create daily offline backups and can rebuild everything from scratch using Puppet in about an hour.
> While this setup does have a lot more moving parts than static hosting and naturally can never be bullet-proof, I am reasonably confident in the security of the current setup.
> Any recommendations on how to further improve this are very welcome!
>
> @Thomas: Regarding the docs.0install.net subdomain idea: Which content would you envision there? Mainly the technical details, making the main page more end-user focused?

We could perhaps have a static landing page (so there is still something there if the database is down), but redirect some of the other pages to docs.0install.net (possibly more over time).

> @All: Any other ideas how to bridge the gap between the two pages? Perhaps somebody with mad CSS-fu skills interested in lending a hand?

(note: I'll be mostly offline for the next week and a bit)


-- 
talex5 (GitHub/Twitter)        https://urldefense.proofpoint.com/v2/url?u=http-3A__roscidus.com_blog_&d=CwICAg&c=4ZIZThykDLcoWk-GVjSLm9hvvvzvGv0FLoWSRuCSs5Q&r=4Pr_PrAPzkvj5hwDAYMdDu8rWJVZyxE05zU9XgLghe8&m=G5diRWFi5mRAsa--GeoQf54KG1DsaqqmEPyHU3g-DAg&s=wTctLNpQN-as18ToJRDTDBUGyTv3kCjdn8-_m9gsK1w&e= 
GPG: 5DD5 8D70 899C 454A 966D  6A51 7513 3C8F 94F6 E0CC
GPG: DA98 25AE CAD0 8975 7CDA  BD8E 0713 3F96 CA74 D8BA

------------------------------------------------------------------------------
_______________________________________________
Zero-install-devel mailing list
[email protected]
https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.sourceforge.net_lists_listinfo_zero-2Dinstall-2Ddevel&d=CwICAg&c=4ZIZThykDLcoWk-GVjSLm9hvvvzvGv0FLoWSRuCSs5Q&r=4Pr_PrAPzkvj5hwDAYMdDu8rWJVZyxE05zU9XgLghe8&m=G5diRWFi5mRAsa--GeoQf54KG1DsaqqmEPyHU3g-DAg&s=SAcNQPSYghVriJ4QLab4DQtvNV0Ll68w9XkjnYTlwFQ&e= 

------------------------------------------------------------------------------