Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Copyright (c) 2014 Ryan Sobol. Licensed under the MIT license. Please see the {file:LICENSE} for more information.
Mango is a dynamic, database-free, and open source website framework that is designed to make life easier for small teams of developers, designers, and writers.
Mango eliminates the barriers to collaboration by decoupling from one another the activities of writing, theming, publishing, extending, and maintaining a website. Mango websites are also decoupled from a database, and instead utilize file-based storage and "convention over configuration".
Writing and revising copy using the clunky administrator interface of a CMS is painful. Which is why it's common for people to work in a text editor and then copy-and-paste their changes back into the CMS.
Mango leverages the writing tools you're already familiar with -- the file system and your favorite text editor. As a bonus, files match perfectly with version control systems, like Git, making for powerful revision history.
Mango supports the following content formats:
Don't see your favorite content format? Patches are welcome
Mango separates a website's theme from it's content. Using a powerful and flexible template system, Mango facilitates both uniformity of major sections and individuality of content presentation. In addition to the standard browser formats -- HTML, CSS, and JavaScript -- Mango also supports the following template formats:
Don't see your favorite template formats? Patches are welcome
Mango websites are dead-simple to publish. Mango supports a wide variety of publishing tools like:
Mango is related to a family of tools called static website generators. One killer feature missing from Mango's cousins is the ability to dynamically process HTTP requests on the server.
Mango websites leverage the Sinatra framework to connect web requests to content pages on-the-fly. Additionally, developers can enhance a Mango website to intercept specific web requests and dynamically customize the HTTP response, communicate with other Internet services, or serve unique content.
With Mango and server-side processing you can:
Mango is distributed as a RubyGem and utilizes Fear-Driven Versioning, a versioning scheme for those who only care about breaking changes.
I highly recommend installing Ruby with a version management tool.
$ ruby -v
ruby 2.1.2p95 (2014-05-08 revision 45877) [x86_64-darwin13.0]
TIP: The revision and arch-type may differ on your machine.
I also highly recommend using Bundler to install Mango and it's gem dependencies.
$ bundle -v
Bundler version 1.7.0
First, create a new directory for your app.
$ mkdir app-name
$ cd app-name
Then, create a Gemfile
wit the following contents:
source "http://rubygems.org"
ruby "2.1.2"
gem "mango", "~> 0.9.0"
I recommend installing Mango, and all its necessary components, inside your app's directory.
$ bundle install --path vendor/bundle --binstubs
Simply edit the Mango version in your website's Gemfile
and re-install.
$ bundle install
With Mango installed, the mango
command will generate a new website.
$ bin/mango create .
The foreman start
command will start a Puma webserver listening at http://0.0.0.0:5000
.
$ bin/foreman start
07:19:41 web.1 | started with pid 57974
07:19:42 web.1 | Puma starting in single mode...
07:19:42 web.1 | * Version 2.7.1, codename: Earl of Sandwich Partition
07:19:42 web.1 | * Min threads: 0, max threads: 16
07:19:42 web.1 | * Environment: development
07:19:42 web.1 | * Listening on tcp://0.0.0.0:5000
07:19:42 web.1 | Use Ctrl-C to stop
Now that the newly generated Mango website is running, here's how the website is structured.
$ tree /path/to/your/app
/path/to/your/app
├── Gemfile
├── Procfile
├── README.md
├── config.ru
├── content
│ └── index.erb
└── themes
└── default
├── javascripts
│ └── timer.coffee
├── public
│ ├── favicon.ico
│ ├── images
│ │ └── particles.gif
│ ├── javascripts
│ │ └── fireworks.js
│ ├── robots.txt
│ └── stylesheets
│ ├── fireworks.css
│ └── reset.css
├── stylesheets
│ └── screen.sass
└── views
├── 404.haml
├── layout.haml
└── page.haml
TIP: The tree command is awesome!
themes/default/public/
..js
, Mango searches for a stylesheet template in themes/javascripts/
..css
, Mango searches for a stylesheet template in themes/stylesheets/
.content/
and wraps it within a view template in themes/default/views
.themes/default/public
or themes/default/views
.Authors write and revise copy in text file called a content page. A content page contains two optional components -- a body and a header. Though optional, the majority of authors will utilize both components.
For example, the Mango website generator produces the following content page:
$ cat content/index.erb
---
title: Congratulations!
---
<h1><%= page.title %></h1>
<h2>You did it!</h2>
The above example highlights the key facets of writing a content page.
content
directory. Here, the file name is index.erb
.---
dividers.The header is composed of key-value attribute pairs in YAML format. Utilizing the page
local variable, attribute data is available within the content page's body and view template.
In the previous example, the message Congratulations!
is substituted for <%= page.title %>
whenever the content page is rendered.
The body of a content page supports many writer and designer friendly formats. The content page's file extension determines the body's format. Rendering a content page converts the body to HTML.
Mango supports the following body formats:
A handful of attributes are automatically inserted into every content page and cannot be altered in the header. Two such attributes are data
and body
which contain a content page's data and pre-rendered body respectively.
For example, given the following content page:
---
title: Congratulations!
---
<h1><%= page.title %></h1>
<h2>You did it!</h2>
Calling <%= page.data %>
would yield:
---
title: Congratulations!
---
<h1><%= page.title %></h1>
<h2>You did it!</h2>
and calling <%= page.body %>
would yield:
<h1><%= page.title %></h1>
<h2>You did it!</h2>
The content
attribute contains the rendered body of a content page. Like the data
and body
attributes, the content
attribute is automatically inserted into every content page and cannot be altered in the header. The rendered body contained within the content
attribute is only available inside a view template.
For example, given the following content page:
---
title: Congratulations!
---
<h1><%= page.title %></h1>
<h2>You did it!</h2>
Calling <%= page.content %>
in a view template would yield:
<h1>Congratulations!</h1>
<h2>You did it!</h2>
Heroku (pronounced her-OH-koo) is a cloud platform for Ruby-powered web applications. Heroku lets app developers spend 100% of their time on their application code, not managing servers, deployment, ongoing operations, or scaling. And best of all, Mango websites can leverage this power with their free Blossom tier.
If you haven't done so already, prepare your Mango website with Git. Just initialize a new Git repository, add the project directory, and commit.
$ cd /path/to/your/app
$ git init
$ git add .
$ git commit -m "First commit"
Next, get started with Heroku by signing up for an account, installing the heroku
gem, and adding your ssh public key to their network.
$ gem install heroku
$ heroku keys:add
Then create a heroku app that targets the "Badius Bamboo" plus "Matz Ruby Implementation" 1.9.2 platform stack.
$ heroku create APP_NAME --stack bamboo-mri-1.9.2
Finally, deploy the heroku app. If you've followed these instructions carefully, deployment is trivial.
$ git push heroku master
Now, bask in the glory of your live website in the cloud.
$ heroku open
TIP: Like the entire the platform, the heroku
command-line tool has great documentation.
Mango is designed to make life easier for small, integrated teams. They prefer tools that allow for shared access to the same resources and for processes that provide instantaneous feedback.
The Ruby on Rails revolution has arrived. The world's next-generation web applications are built with powerful tools from the Ruby eco-system. Mango is designed to harness this power, but delivered in a smaller package to meet the needs of simpler websites.
Thank you for taking the time to help improve Mango.
Is Mango not behaving like you expect it should? Please forgive me. Submit a report over at the Issue Tracker and I'll get that sorted out.
TIP: You can read through existing issues and vote for the ones you'd like to see resolved first.
Is Mango not behaving like you need? Patches are always welcome and appreciated. Report your issue to make sure we're not duplicating any work and go to town. Alternatively, you can lend a hand on existing issues.
Once you've been assigned an issue, the process for contributing your work back to the source is straight-forward.
LICENSE
, README.mdown
, mango.gemspec
, etc.)TIP: Take a moment to get a feel for the style of coding, specifications, and in-line documentation.
Mango has a plethora of documentation to bring a Rubyist of any level up to speed. Once the development dependencies are met (please see the REQUIREMENTS section), fire up the documentation web server.
$ yard server
Then point your browser to http://0.0.0.0:8808
Thanks to all of my friends and family for their invaluable support!
FAQs
Unknown package
We found that mango demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.