Help with Site Redesigns

I built the existing TaoSecurity.com and Bejtlich.net Web sites with with Nvu. I would like to redesign both sites, but I am not sure how to proceed. I approached one company and they told me they design sites using Wordpress. Another uses Joomla. I am not comfortable using PHP given some of the recent security problems I've seen. I'm not sure I want/need a database on the back end either.

I have a feeling that I could use a nice style sheet from Open Source Web Design and continue to use Nvu to generate static HTML. Does anyone have any comments on this?

Comments

Anonymous said…
Richard, try using black or grey backgrounds. Easier on the eyes.
5:22 PM
Anonymous said…
Another good site to look at for style sheets is csszengarden. There's some really amazing stuff there.

-Pete
6:16 PM
Anonymous said…
If you want client-side CMS features - without hosting PHP on your server - you can look at Bricolage
6:21 PM
Anonymous said…
I wish I could help ya here, but I have to admit I design any of my own pages by hand with Notepad or UltraEdit.

I will say though, having no back-end database is wise, especially if you just don't need t (I don't use them, usually). In addition, if you don't use a database, php isn't such a bad tool. You likely won't have any input fields, which greatly minimizes the need for fancy php modules and minimizes your exposure.
-LonerVamp
6:33 PM
Richard Bejtlich said…
I like Bricolage already (it's in the ports tree). :)
7:32 PM
Anonymous said…
How about using Ruby on Rails. It doesnt require a database and also has a ton of built in functionality for Ajax.
11:58 PM
Anonymous said…
I've you're comfortable with java you might want to check out the free edition of Jahia @ jahia.org
8:04 AM
Anonymous said…
Python is quick, easy and safe...check out TurboGears or Django - both very good, each suiting a different style of developer.
9:01 AM
John Ward said…
1 suggestion, hire a professional.

It has nothing to do with tools or "wiken mad c0derz s/<1ll5", its about presentation and functionality. And since the TaoSecurity site is pretty much an electronic brochure advertising your business, what you need is a graphics designer/artist. No tool, no matter how feature filled, is going to replicate good artistic talent.

While I can do all the backend server coding, client side Javascripting in Ajax, or whatever the buzzword of the moment is, the reason I don't design web pages is because I lack artistic talent. I refer to individuals who do have talent.
3:12 PM
Anonymous said…
I would absolutely avoid building a static website.

Even if your site is just an electronic brochure, updates are immensly less a burden when the site is run by a lightweight content management system. I started to build that kind of sites with the help of Textpattern (open source, LAMP based) after several years of manually managing all the links, menus, file names and the like. It is a major relief to get rid of that ballast.
5:14 PM
John Ward said…
I would only consider a CMS in the site recieves consistent updates. In the case of Taosecurity, the only things that would really recieve regular updates. In this case, only the Events and Press section would recieve those, and I doubt they would update often enough to warrent the added layer of complexity. A CMS only adds another avenue of possible vulerabilities. Its kind of hard to introduce that kind of vulnerability with static pages that get updated once or twice in a 3 month period, if even that. It'd be embarassing if a security consultants web site got hacked or defaced due to the CMS system implemented for the once a month updates in the events section of the site.
9:10 PM
Anonymous said…
Why you afraid Joomla. I think it's optimal for such sites.
5:20 AM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technical or pol
Read more