Search

2 results for “paulehoffman”

1. 

   Paul Hoffman @paulehoffman

   2026-10-24

   I have a set of requirements for a static site generator that is probably not what any of them are designed for, but I suspect some will fulfill the requirement well if not excellently.

   The requirements boil down to: make a nice-looking web site for someone who will not add pages very often, but will update some pages regularly. You know, like many sites for people who have small businesses and want to show off what they do, and have a nice but not fancy website. No forms, no blog, just a good-looking site.

   Nice-looking means:
   - Selectable background colors
   - Background art for page headings and body (and maybe footers?)
   - Different fonts on the page
   - Page headings with different designs
   - A page menu (one-level is find)
   - Ability to have a bunch of pictures well-arranged
   - Template-driven so that the user can just type paragraphs with links, no HTML

   It should be easy to update pages in place, such as when dates change or when a new thing is announced or removed.

   This can all be done with commercial desktop packages, but I’d like something FOSSy so that it’s more likely to be supported ten years from now.

   If you use a SSG that has the above and either comes with some reasonable templates or there is a template library somewhere, I’d appreciate hearing about it.

2. 

   Paul Hoffman @paulehoffman

   2026-10-22

   The PHP disaster has now turned into a clowshow. Some hosters are not updating to the fixed versions of PHP but instead backporting changes to known-bad versions *and not updating the version number*. A hoster I use still says that my site is running 8.4.20, but assures me in a trouble ticket:

   "For older PHP versions, the security fixes were applied to the existing release (?backported?) and didn't come with a new version number. If your site, a plugin or a security scanner still reports the same PHP version as before, that's expected, and your site is still protected.”

   FWIW, this is a very major WordPress hoster. However, I got a similar story when looking at older versions of Ubuntu: they apparently backported the fixes into PHP versions that are EOL.

   The result will be that there will be plenty of systems out there that can’t tell if they are safe, so they will assume they are. And when the next CVE comes out, they can’t even tell what actual version they are coming from.

   The blame for this lays squarely on the hosters and repo maintainers, not on the PHP dev team.