Suggestion: It is very hard to allow HTML but remove JavaScript. Write a method called something like isJSPresent() and then after you've done your filtering, check if JavaScript is on the page. If it is, return a HTML-encoded version of the page. Then, the security of your page will rely only on the correctness of that single method, and not on the correctness of your rewriter (which is much more complex).
We used to have to get up at 10 o'clock at night, half an hour before we went to bed, edit our blog entries with "ed", tie them to pigeon's feet, and send them to the Web, where they'd arrive a week later, if you were lucky.
Now you try to tell the young people of today that.
For better or for worse, I'm a fan of minimalism, but it has to just work. That's not the case currently - I'm finding this very frustrating.
-I made a page, then registered, but there's no way to associate a previously made page to an account. (I guess I have to change the original name to a throwaway account and start again)
-No way to delete a page?
-I tried to make a simple list of links. It works once, but when you edit the page a second time, the :link tags are no longer properly parsed.
-Links move around or disappear in different views. In particular, the contacts link is gone when I log in.
The list goes on, but... am I the only one with all of these simple usage problems? Or have people upvoted this submission without actually trying the product?
I was looking for some demo pages, but the link at the bottom http://pen.io/showlast.php (latest pages) is actually showing only the latest, which are unfortunately frequently left empty or unmodified.
it would be nice to have some "pick random" link, choosing across some well visited pages.
Regarding output? Any sufficently advanced SSG is indistinguishable from a dynamic site (cf. Movable Type). Regarding the software itself? Even default jekyll has quite a few dependencies, compared to something like blosxom or even simple dynamic blog engines (bet there are a few that aren't more than one page of PHP).
"Minimalist" gets thrown about a lot, too much, probably. Especially for software, but even for presentation/design, where "simple" would often fit better.
Never mind it's all bigger than just using "cat" for blogging and exposing your .plan over HTTP…
Erroneously calling random things that lack functionality and polish "minimalist" is a fad, but the minimalism itself is an well established form of design.
http://xssdemo.pen.io
Suggestion: It is very hard to allow HTML but remove JavaScript. Write a method called something like isJSPresent() and then after you've done your filtering, check if JavaScript is on the page. If it is, return a HTML-encoded version of the page. Then, the security of your page will rely only on the correctness of that single method, and not on the correctness of your rewriter (which is much more complex).