Just put some HTML on the web

The internet is becoming a more dangerous place, and fast. LLMs are only getting better at identifying security issues, and more people are taking advantage of this. Some people argue that LLMs will eventually make large-scale vulnerabilities a thing of the past. I’m not so sure. Either way, I think it’s a good idea to have less stuff that can be hacked online. One way to do that is with statically generated sites. This past week was a bad one for security issues. The most prominent one was PHP2Shell, which had PHP on the minds of non-technical folks — not a win for society. There was also Node2Shell, which exploited Node’s built-in Brotli compression stack. But there were a whole lot more. Note that the above chart is only showing critical CVEs. Here’s another showing all CVEs. When I last fretted about this in May, we were still doing rookie numbers. Things aren’t likely to get better any time soon. In my time, I’ve built a lot of stuff on the web. From the early 2000s to the…