#ramp_down_website

[MikeMcC399]

From proposed #ramp_down_website:

"The Corona-Warn-App website will continue to be reachable. Among other things, the Science Blog will be updated with new articles."

I assume this means that the repository https://github.com/corona-warn-app/cwa-website will continue to be actively used. Is that correct?

[MikeMcC399]

The repository will not be sustainable long-term:

1. Opensource gulp v4, which is the main builder, is outdated and practically unmaintained. The last release was 4 years ago.
2. This means that some dependencies cannot be updated and vulnerabilities cannot be resolved (see npm audit 32 vulnerabilities (11 moderate, 21 high))
3. The high usage of screenshots and videos in the past makes the repository very large Heavy screenshot usage in repository (size and number of files) #2699 and Large file warning uploading copy of cwa-website to GitHub #3325

[brianebeling]

Hike Mike, we are aware that the choice of technologies is not suitable for long term use.
While the repository will stay online for the foreseeable future (albeit I imagine in an archived state eventually), the website itself may not be available for as long. How long that timespan is specifically is not decided yet.

This means that some dependencies cannot be updated and vulnerabilities cannot be resolved (see npm audit 32 vulnerabilities (11 moderate, 21 high))

Most, if not all, of these "vulnerabilities" are not real vulnerabilities: We are serving a static website with no real time interaction or code that executes server-sided. Therefore, the attack vector is low. Many of these vulnerabilities are exploitable on compile time only.

The high usage of screenshots and videos in the past makes the repository very large #2699 and #3325

That is true and something we often discussed internally already. We would like to reduce the size of the repository as well, but unfortuantely at this time there is no clear solution to the problem. Something we are looking at currently is to remove screenshots of releases before a certain point. That brings its own share of problems and goes against the idea of keeping the website up as a sort of "museum/gallery" unfortunately.

Thanks for bringing this up!

[MikeMcC399]

@brianebeling

This means that some dependencies cannot be updated and vulnerabilities cannot be resolved (see npm audit 32 vulnerabilities (11 moderate, 21 high))

Most, if not all, of these "vulnerabilities" are not real vulnerabilities: We are serving a static website with no real time interaction or code that executes server-sided. Therefore, the attack vector is low. Many of these vulnerabilities are exploitable on compile time only.

The problem for contributors like myself is that it is not obvious which of these vulnerabilities can be ignored (I would not be worried about denial of service issues for instance) and which are real exposures to my local system when I launch JavaScripts locally. The number of open vulnerabilities makes it quite time-consuming to go through each of them to evaluate their impact.

[brianebeling]

You are right, dependencies often severly overlooked by developers across the spectrum and that is why we want to do better. I agree that evaluating each vulnerability can be time-consuming, but it is essential to ensure the website's security. Albeit I don't have an overview of all dependencies at all times, I do check and read up on all the secrurity warnings in a regular interval. So far none of these presents any risk.

We do take care of it by updating packages and paying close attention to the warnings.

We appreciate your contribution to the website and your concerns regarding its security. If you have any specific questions or concerns, please do not hesitate to reach out to us and we can take a look at it here.

[Ein-Tim]

I assume this means that the repository corona-warn-app/cwa-website will continue to be actively used. Is that correct?

Yes, that is the plan at the moment!

Regarding your other points, e.g. the long term usage of the underlying technics/frameworks & the large repository size, I will leave it to the Open-Source-Team to answer, or respectively coordinate my answer with them.