October 21, 2026 at 1:08:29 PM UTC

	Since	posts	replies	likes	reposts and quotes	views
Bluesky	May 2023	1,039	8,236	23,127	2,380
Mastodon	Nov 2022	2,399	29,156	55,396	16,820
GitHub	Jul 2010	179	5,777 3,520	33,866	3,317
npm	Jul 2014	139	1,546			75,991,720
YouTube	Dec 2015	30		1,203		32,713
Letterboxd	Mar 2026	55
Blog	Nov 2025	20
Hacker News	Jan 2011	59	575	802
All	Jul 2010	4,807	37,967	114,394	22,517	76,024,433

I know folks get real mad when I say this but in times of widespread security crisis, static sites sure are nice

Also posted to Bluesky.

77 replies

devolute Mastodon 6 min later

@zachleat Your face when.
1. Zach Leatherman Mastodon 19 min later
  
  @devolute my anxiety could never
Alesandro Ortiz 🇵🇷🏳️‍🌈 Mastodon 11 min later

@zachleat 💯 A decade or so ago I was running all my sites, even static ones, on my own PHP VPSes. Now everything is 99% static (on 11ty!) and any backend stuff uses lightweight Node servers on a tiny VPS.
1. GunChleoc Mastodon 3 hr later
  
  @AlesandroOrtiz @zachleat Did you say Node? https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
Andrew Roberts Bluesky 36 min later

going to the SPA 🧖‍♂️🧖
1. Zach Leatherman Bluesky 53 min later
  
  …wait
Tim Moore Bluesky 43 min later

There're reasons I stopped using WordPress and other CMS's and this is one of them, a big one.
1. Naomi "Strings" Bluesky 3 hr later
  
  For me it's because as much as I try I can't learn PHP :/
2. Marios Antonoudiou Bluesky 22 hr later
  
  I've never seen a typical LAMP WordPress website not being hacked in some way. Something always happens and gets breached.
wfk Mastodon 46 min later

@zachleat
My mitigation has been to just remove PHP from my servers. There shouldn't have been any remaining service depending on it, and if there accidentally was, I prefer learning about that from it not working, rather than it compromising my systems.
Elena ``of Valhalla'' Mastodon 51 min later

@zachleat please, don't do these things.
saying this things aloud is how we get a catastrophical apache / nginx zero day :D
1. Zach Leatherman Mastodon 56 min later
  
  @valhalla *runs away screaming*
  1. Elena ``of Valhalla'' Mastodon 1 hr later
    
    @zachleat (to be fair, static website means only having to worry about CVEs in the base system and http server, instead of having to worry about CVEs in the base system, http server, language AND platform, it's not a trivial advantage)
Mike Aparicio Bluesky 1 hr later

I hope no one is still using those PHP sites I built 20 years ago! 🫣
1. Michael Bishop Bluesky 3 hr later
  
  The irony is they wouldn’t be affected.
your auntifa liza 🇵🇷 🦛 🦦 Mastodon 1 hr later

@zachleat they shouldn’t. a status.html page should be static, served in a subdomain and a from a separate server (or vps). that even MDN doesn't practice that is proof how the appification of web development has degraded the practice of developing actual websites.
1. Tristan / RecoilZA Mastodon 1 day later
  
  @blogdiva But the MDN is static, so why should we add more static pages to a static site that regenerates its HTML pages once every 24 hours?
  1. Zach Leatherman Mastodon 1 day later
    
    @tristantheb @blogdiva nice yeah! I remember this https://developer.mozilla.org/en-US/blog/mdn-front-end-deep-dive/
Eva Ogbe Bluesky 1 hr later

Ironic thing to post on a social media website
1. Zach Leatherman Bluesky 3 hr later
  
  only if you think a social media website can’t be static 🥹
  1. Eva Ogbe Bluesky 6 hr later
    
    How would you do a social media website without a server?
    1. Zach Leatherman Bluesky 6 hr later
      
      I think you’re probably getting at how to accept input/writes without an app server but the simple/fair answer is that you wouldn’t — lots of wiggle room to explore there though.
      1. Eva Ogbe Bluesky 1 day later
        
        If you have an app server that processes writes, then you're exposed to whatever vulnerabilities the language has. It's a PHP bug, not a JavaScript bug.
        
        Zach Leatherman Bluesky 1 day later
        
        hmm… in your mind how does a static site relate to JavaScript?
        
        Eva Ogbe Bluesky 1 day later
        
        I believe a static site would just serve static HTML and CSS with no server. JS makes it dynamic
        
        Zach Leatherman Bluesky 1 day later
        
        oh interesting. that’s not the classification I’d make but it makes our conversation make more sense now!
        
        Eva Ogbe Bluesky 1 day later
        
        If the static site has a server and JS then it's just as vulnerable to these things as any site that has a server and JS and isn't calling it static. I don't understand how a static site that has a server and JS would avoid these vulnerabilities
Ben Zeigler | DoubleBuffered Mastodon 1 hr later

@zachleat I've started using Astro which lets you use all of the fancy javascript coding you could ever want, to make completely static sites in production
1. Zach Leatherman Mastodon 3 hr later
  
  @DoubleBuffered never heard of it!
Tim Apple Mastodon 1 hr later

@zachleat nothing to patch on a pile of html files is a pretty nice feeling today lol
1. Andres Mastodon 4 hr later
  
  @timapple @zachleat There is a certain irony that an nginx security release happened around the same time. However, that one was pretty minor in comparison to the php thing.
  https://lists.debian.org/debian-security-announce/2026/msg00490.html
  1. Tim Apple Mastodon 5 hr later
    
    @Andres4NY @zachleat ha, of course nginx picked this week too. at least a minor one is just an apt upgrade and move on
GoOz Mastodon 1 hr later

@zachleat my thoughts exactly :3 but let’s just not fuel the fire… not yet. :D
Private reply Mastodon 2 hr later
Eric Bailey Bluesky 2 hr later

every time I get mad I have to edit frontmatter or whatever I remember that at any point in time four trillion bots are bouncing off of my site like water off a very poorly coded duck's back
1. Zach Leatherman Bluesky 3 hr later
  
  when someone says agentic I always think of
2. Mastro.{js,ts} Bluesky 4 hr later
  
  And with @sveltiacms.app you don’t even need to edit frontmatter!
Cj Bluesky 2 hr later

Somewhere there's a developer protecting a personal blog with OAuth, Kubernetes, and military-grade encryption. It gets 11 visitors a month, eight of whom are bots.
eobet Mastodon 2 hr later

@zachleat I recently switched providers and I wasn't even allowed to subscribe with an option without php... 😑
Dmian 🇪🇺 Mastodon 3 hr later

@zachleat That’s why I like @publii so much! Peace of mind. 😁
Naomi "Strings" Bluesky 3 hr later

I just saw something about vulnerabilities in PHP. Wild. I'm static by night and vulnerable by day (my side hustle projects are all static, my day job is wordpress...)
1. Zach Leatherman Bluesky 3 hr later
  
  yes you likely need to update immediately!
  1. Naomi "Strings" Bluesky 3 hr later
    
    yep!! on it :🫢
Konnor Rogers Bluesky 3 hr later

*but who serves the static site*
1. Justin Fagnani Bluesky 3 hr later
  
  In my case, Node
  1. Zach Leatherman Bluesky 3 hr later
    
    computers are a mistake
2. Zach Leatherman Bluesky 3 hr later
  
  hand delivered by carrier pigeon or station wagon (full of hard drives)
  1. Cory LaViska Bluesky 3 hr later
    
    are they 5G pigeons or fiber? Where can I sign up?
    1. Zach Leatherman Bluesky 4 hr later
      
      localhost:8080 has all the details
3. David Dal Busco Bluesky 4 hr later
  
  I build my own engine to serve mine. No Node, no PHP.
  
  kyushu.dev
4. Luke Bluesky 5 hr later
  
  A memory safe web server / reverse proxy. Because obviously something as critical as that would be memory safe. We're not all running c code in the critical path still right... Right?!
  1. Konnor Rogers Bluesky 5 hr later
    1. Luke Bluesky 5 hr later
      
      caddyserver.com caddy is your friend. 😛
      1. Konnor Rogers Bluesky 6 hr later
        
        Caddy is ❤️
      2. Ryan Bluesky 7 hr later
        
        Did you ever get a free tshirt for how much you shill it? You deserve one
        
        Konnor Rogers Bluesky 7 hr later
        
        This is the one time Luke is right to be fair, so hes running with it.
        
        Luke Bluesky 17 hr later
        
        Ryan Bluesky 17 hr later
        
        Now you're getting too big for your britches, reel it in Luke
Private reply Bluesky 3 hr later
1. Zach Leatherman Bluesky 3 hr later
  
  the lazy pit of success
Private reply Bluesky 4 hr later
Dan Szabo Bluesky 5 hr later

D̶o̶n̶'̶t̶ give me static
Peter Bowyer Bluesky 6 hr later

I was feeling smug, then remembered I'd dropped a PHP file into my static site to screen and email me form submissions...
Robert Stowe Bluesky 6 hr later

I think the underrated part is where the risk moves. With static output, a vulnerable dependency lives in the build rather than on a running server, so patching becomes a rebuild and a deploy instead of a scramble to find out what was exposed.
1. Private reply Bluesky 6 hr later
L Ξ Ο N V Λ N Κ Λ Μ Μ Ξ N Mastodon 6 hr later

@zachleat this is why https://xrforge.isvery.ninja is a static website generator..i dont trust my own code in server-mode 😅
CMDR Yojimbosan 🅅⁂ Mastodon 8 hr later

@zachleat A long long time ago, static sites were all we had. I built a wonderful website for a business directory, hundreds of entries, everyone listed in up to 4 different category/subcategory pairs. It started from an Access database they gave me, took 5 minutes to run on a 486 PC/linux, and produced all the cross-linking pages for the index, each business, all the category, and each of the category/subcategories.
When I upgraded to a Pentium it took 1.5 minutes :-)
1. CMDR Yojimbosan 🅅⁂ Mastodon 8 hr later
  
  @zachleat After a couple of years, someone else got the customer and made it all LAMP stack. They couldn't figure out how to do all the category/subcategory queries, so the site lost all that functionality. Just, wow.
2. Zach Leatherman Mastodon 8 hr later
  
  @yojimbo Intel Inside! what year was this?
  1. CMDR Yojimbosan 🅅⁂ Mastodon 8 hr later
    
    @zachleat around 1995 perhaps? it could have been earlier, the pentiums came out in 1993 according to wikipedia, but I'm not sure how long it took for them to become "reasonably available" in my location.
    1. CMDR Yojimbosan 🅅⁂ Mastodon 8 hr later
      
      @zachleat Now I'm starting to double-guess if the original was even Access. I know the categories were all arbitrary and self-declared by each company registering, there was some effort to conform to pre-existing ones but it was a manual process.
      Anyway, static sites can be arbitrarily awesome :-) and a good design process can trade processing for disk space well before the webserver itself gets involved!
      1. Zach Leatherman Mastodon 8 hr later
        
        @yojimbo that’s awesome! certainly the earliest static build I’ve heard of!
        
        CMDR Yojimbosan 🅅⁂ Mastodon 9 hr later
        
        @zachleat Oh boy, you want to know what I was doing back in 1995 then lol. We were operating an SSL website, which pins the date to 1995 as the earliest (therefore my other story needs to move forward a year I guess) and we had a 40-bit cert, one of the first to be deployed outside the US (small cert size because of export restrictions)
        The website provided an actual catalog of things to buy from several different vendors, and collected ccard data for offline processing. Fun days!
        
        CMDR Yojimbosan 🅅⁂ Mastodon 9 hr later
        
        @zachleat Now, you don't want to know how we got the order and associated ccard from the web server to the customer, do you?
        That was a little embarrassing, involving multiple emails with "the first few digits" on one message and "the next few digits" in another. And of course email wasn't encrypted.
        In a spooky voice: "This was before PCI existed and ... bad things happened ... on ... the Internet!!!!!"
        
        CMDR Yojimbosan 🅅⁂ Mastodon 9 hr later
        
        @zachleat However, the site was very successful, as lots of people across the world ordered christmas gifts for their friends in the UK - i.e. no international shipping! Saved themselves a heap of money I hope!
Tom Phoolery Bluesky 9 hr later

hah jokes on you every CLI is written in node.js
1. Zach Leatherman Bluesky 11 hr later
  
  i never joke about runtime versus build time vulnerabilities tom