derekzhouzhen
Joined 5 years ago
Joined 5 years ago
1) User goes to BAD website and enter credentials
2) BAD website use GOOD website to check if credential is valid
3) Pwned
It is just MITM attack. The moment you go to BAD and enter credential (password or one time code) you are done.
No, generating HTML string and setting innerHTML is unsafe and slower than necessary. It is better to create DOM elements programmatically. HTML is for serialization of the DOM tree; if everything is done in javascript then you don't need HTML as an intermediate step.
* web-component is a way to attache javascript to certain elements. There are other ways to do it, but sometime this way feel cleaner, like when you do server-side rendering and not using any javascript framework.
* shadow-dom is a way to organize your styles. As you said there are other ways to do it, but I find it useful because it offers full isolation, and is compatible with browsers 3 years back.
It is a fully functional RSS reader. You are welcome to poke under the hood. The key insight is that I don't need reactivity, if re-rendering everything at every event is fast enough.
I believe this style of barebone SPA programming can scale up to at least 10,000 LOC javascript.
You are welcome to use but don't complain the lack of functionality. I wrote it to suit my own need.
Also, the article is about fully managed Wordpress vs self-hosted (or PaaS hosted) SSG. If the choice is between self-hosted Wordpress vs self-hosted SSG, I bet the outcome will be very different.
Now, you may wonder why the OP was not make an apple to apple comparison, like fully managed Wordpress vs fully managed SSG. Well, fully managed SSG does not exists, because it won't sell!
I use several SSGs and wrote one myself. I still can't recommend any SSG to people willing to pay.