←back to thread

116 points vgr-land | 6 comments | | HN request time: 0s | source | bottom

A few weeks ago a friend sent me grug-brain XSLT (1) which inspired me to redo my personal blog in XSLT.

Rather than just build my own blog on it, I wrote it up for others to use and I've published it on GitHub https://github.com/vgr-land/vgr-xslt-blog-framework (2)

Since others have XSLT on the mind, now seems just as good of a time as any to share it with the world. Evidlo@ did a fine job explaining the "how" xslt works (3)

The short version on how to publish using this framework is:

1. Create a new post in HTML wrapped in the XML headers and footers the framework expects.

2. Tag the post so that its unique and the framework can find it on build

3. Add the post to the posts.xml file

And that's it. No build system to update menus, no RSS file to update (posts.xml is the rss file). As a reusable framework, there are likely bugs lurking in CSS, but otherwise I'm finding it perfectly usable for my needs.

Finally, it'd be a shame if XSLT is removed from the HTML spec (4), I've found it quite eloquent in its simplicity.

(1) https://news.ycombinator.com/item?id=44393817

(2) https://github.com/vgr-land/vgr-xslt-blog-framework

(3) https://news.ycombinator.com/item?id=44988271

(4) https://news.ycombinator.com/item?id=44952185

(Aside - First time caller long time listener to hn, thanks!)

Show context
stmw ◴[] No.45009206[source]
It's nice to see this. Things used to be simple! (XSLT itself should've been simpler of course).

BTW, as I commented on earlier HN threads re: removal of XSLT support from HTML spec and browswers, IBM owns a high-performance XSLT implementation that they may want to consider contributing to one or more browsers. (It is a JIT that generates machine code directly from XSLT and several other data transformation and policy languages, and then executes it).

replies(2): >>45009901 #>>45013010 #
bawolff ◴[] No.45009901[source]
I think it would be very unlikely browsers would use a jit engine for xslt. They are removing it because they are afraid of the security footprint. A JIT engine would make that footprint much worse.
replies(2): >>45011705 #>>45014299 #
1. dpassens ◴[] No.45011705[source]
Not necessarily. The security issues are with the libxml implementation, a different one might be more secure even with JIT. That's part of what makes the whole situation so ridiculous.
replies(3): >>45011879 #>>45012772 #>>45015730 #
2. afavour ◴[] No.45011879[source]
Emphasis on might be. Finding out whether it actually is is not a trivial process.
replies(1): >>45012102 #
3. troupo ◴[] No.45012102[source]
There are multiple CVEs in multiple Chrome-only non-standards that Chrome spits out by the hundreds in the past few years. They have no issues releasing those, supporting them, and fixing them.

Somehow they have an issue with supporting, fixing (and updating to latest version) this particular one. Possibly because it doesn't result in promotions.

replies(1): >>45015884 #
4. whizzter ◴[] No.45012772[source]
Still, from a security perspective considering the low amount of sites that use it I think a better solution would be to implement it with a JS shim like PDF.js.

JS is already required to have a XML DOM parser, an universal XSLT engine in JS should be a low-effort web to continue supporting XSLT, as for performance the transform could probably be eval'ed and cached to JS snippets so that they in turn become JIT-compiled.

https://developer.mozilla.org/en-US/docs/Web/API/DOMParser

5. bawolff ◴[] No.45015730[source]
Whether or not it is actually secure, as a factual matter, has nothing to do with its security footprint.
6. afavour ◴[] No.45015884{3}[source]
This often ends up as an anti-Google argument but all the major browser makers agree with this deprecation proposal.