OniSec's Security Blog

About this blog

Greetings,

I felt like it was necessary to provide some specific information about this blog, what is running, how it is set up, what it costs and how easy it is to build your own.

This blog is built on Hugo, hosted by Cloudflare (til I have enough content to justify migrating to a paid platform such as WriteFreely or hosting on a VPS like 1984 or privex). Currently, operational costs are less than $0.85/month. This is due to Cloudflare selling domains at cost rather than making profit and buying this domain for $10.11 per year, for 10 years.

This theme was specifically chosen to avoid Javascript, to minimize code that runs in your browser. For the base blog, no javascript is required.

Though I do recognize the irony of hosting with the Cloudflare honeypot, nothing being posted here is private as the goal is to freely share knowledge. Besides, I am using Cloudflare Pages as infrastructure so regardless if it is proxied or not the data still goes to Cloudflare. For the time being, this is the cheapest way to start this blog with as much customization. In the future, I will likely go the VPS route, at which point I’ll run an onion service version for those who prefer onion services as I do.

For that reason, TOR is supported, feel free to access this site using TOR. I would recommend using Whonix or Qubes OS. Just keep in mind the site is configured to high security, so if the exit node you’re using was seen demonstrating attacker behavior in the last 14 days you’ll probably get hit with a captcha. Depending on how it goes I may change the settings to be more friendly to TOR users. Please send feedback on your experience via Session.

While the intention is to avoid using javascript, Cloudflare does inject some javascript.

There is javascript in the Relearn Hugo theme that is used for the knowledge garden, however it functions mostly okay without javascript being enabled. It looks like only the search functionality, intra-document tabs, paging left and right with your keyboard, and the color theme settings do not work. I am going to be looking to default to darkmode because who likes light mode?

I may disable the beacon.min.js in the future. At this point I am still figuring out the platform, but I have no desire to know specific details about visitors. Still interesting to see spikes in activity from different countries.

#Cloudflare   #Hugo   #Privacy   #Setup   #Knowledge Garden