Versioned Static Hosting, Agentic Publishing
Today, two critical flaws in PHP were disclosed, with working attack code made public the same day. Roughly 70% of websites run PHP. Every server behind those web sites needed to be patched by human or machine.
As AI models and tooling improve, more and more vulnerabilities will be surfaced, leaving servers at risk. We are already at the point where vulnerabilities can be exploited faster than they can be patched.
My new take on web publishing, reducing costs, increasing performance, and removing nearly all of the attack surfaces for which we are currently liable. The system is based on three principles:
WordPress assembles each page on every visit using PHP, so real code is running on a real server. That creates an attack surface, the one that became exploitable today.
Letterpress originated before AI and agentic tooling existed. I wrote automated tooling to migrate your dormant WordPress sites to static hosting on AWS. That tooling became the publishing engine for Letterpress.
The same agent can make any change to the site, not just publish posts.
A laptop or a phone.
Letterpress only accepts mail that is provably from you. It checks the signature your mail provider adds, and a second signature only your own key can make.
Title, category, tags, images. AI helps with the formatting and tagging. People decide what actually gets published.
The post is filed as a proposed change. GitHub privately stores every version of every page, with who changed what and when. You can also edit it by hand before it goes out.
Every draft gets its own copy of the site, with the change in place, at a link you can open on any device. Ask for changes and it goes back for another pass. Approve it and it goes out.
Approval builds the site into static pages. They go into Amazon S3, which stores them, and CloudFront, which hands out copies from servers all over the world. From here, it's the same setup already serving your static sites.
A reader types the address. Route 53 sends them to CloudFront, which hands them a page. No database is queried and none of our code runs.
We offload the burden of protecting our attack surfaces to AWS and other commercial entities.
A server costs the same whether anyone visits or not. Static files cost money mainly when people download them.
Estimates for low-traffic sites from published list prices. Delivery costs grow with visitors, so a site that goes viral costs more, and stays up.
The goal: every Lessig site, for a monthly bill in the low double digits.
With no server-side code running, static sites can't process form submissions and the like. Donation forms run as embedded widgets, so they port over to static sites seamlessly.
A WordPress blog migrated to Letterpress, from Yours Truly <3