Just to build on this, there are RCEs that involve overflowing headers; Go just ... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

_ktx2 on July 15, 2023 | parent | context | favorite | on: The theory versus the practice of “static websites...

Just to build on this, there are RCEs that involve overflowing headers; Go just had one not that long ago. There's plenty of inputs on a GET request. You still need to do proper security on a static site.

jameshart on July 15, 2023 [–]

Or.. a commodity static hosting provider can do proper security for you.

I don’t tend to worry about the RCE risk of hosting files in an S3 bucket behind a cloudfront distribution. That’s someone else’s problem.

snowwrestler on July 15, 2023 | [–]

Commodity hosting with proper security is also available for dynamic website technologies.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact