The Small Target Stack

Two critical flaws. One leaked advisory. Close to a million internet-facing servers running PHP versions the emergency patch will never reach.

That was this week. Add last October's AWS outage, which knocked out more than three thousand companies in a single afternoon, and the occasional stretch where even Wikipedia and the Internet Archive go dark, and you get the question a few people have asked me lately. Why doesn't this happen to the sites you run?

Short answer: small target. That is my term for the stack philosophy here, and the rule is simple. Every piece of software you do not run is a piece you do not patch, do not monitor, and do not get paged about at 2 a.m. The goal is not better firefighting. The goal is owning fewer things that can catch fire.

What this site actually runs

The page you are reading is a static file. Next.js built it ahead of time, Vercel copied it to a global edge network, and when your browser asked for it, nothing executed on my behalf. No server. No database. No PHP, no WordPress, no cPanel, no plugin dashboard with a red badge counting the updates you owe it.

The patch count for this site this week is zero. The patch count for a typical shared hosting box is never zero, and that is before a plugin author ships a bad release on a Friday.

There is one moving part: the contact form, a single serverless function. If it fails, every page still loads and only the form sulks.

The honest part

I will not promise zero downtime, and you should distrust anyone who does. This site rents its resilience. If Vercel has a bad day, I have a bad day. The giants fall too, and the AWS outage proved it.

What the small target buys is not immunity. It buys three things.

A smaller blast radius. There is no database to leak and no admin panel to hijack. This week's PHP panic is a spectator sport for us. The most exciting thing an attacker can reach here is a cached HTML file with strong opinions in it.

A faster escape. The whole site is a git repository. If Vercel vanished tomorrow, the site would be living somewhere else before lunch. No database export, no migration window, no downtime announcement. Static files are the most portable artifact the web has, and portability is the uptime number nobody advertises.

A boring Tuesday. Deploys are atomic and rollback is a button. There is no maintenance window because there is no running process to restart.

What clients get

Same pattern, scaled to the client. The Chilliboys site is a single self-contained HTML file. Nothing to update, ever. The most patched software in that entire project is the browser. SaskPoly runs the same shape: static pages, clock-driven data, no server of ours sitting in the request path.

When a client genuinely needs a database and a backend, I will build it, and I will charge for the maintenance, because that is what owning moving parts costs. Most small business sites never need it. They need to be findable, fast, and open at 3 a.m. on a holiday.

The closer

The internet will keep having weeks like this one. That is not pessimism, it is the schedule. The only question is whether somebody else's bad Tuesday becomes your bad Tuesday. Own less, keep the exit cheap, and keep the PHP off the box.

There is no box.