This site holds the Attack Surface Reduction Manifesto. It is a static site: four layout templates, one stylesheet, one small script for the theme toggle. No framework, no package manager, no database, no build service. The files you are reading are the files that get served.
It answers to two addresses — reducetheattacksurface.com and reduceattacksurface.com. Both serve the same content; pick whichever you find easier to type.
What it tracks
One thing: page views, counted by Plausible. No cookies, no device identifiers, no cross-site tracking, no per-visitor records. We get a number that goes up, and which pages it went up on. Nothing that could be used to follow a person around.
That is the only third-party script on the site, and it is here deliberately. A manifesto that asks you to delete dependencies owes you an accounting of its own, so it is listed in the footer of every page rather than buried somewhere. The domain is hardcoded in the template, which means local previews and copies served from other hosts are not counted.
What it does not do
No advertising, no A/B testing, no session recording, no heatmaps, no comment system, no login, no email capture, no newsletter. There is nothing to sign up for and nowhere for your data to go.
Reuse
Content and code are licensed CC BY-SA 4.0 — see LICENSE. Copy it, fork it, translate it, argue with it. If you build on it, keep the same license and keep the attribution.
Contributing
The manifesto is a living document and it improves when people send in things that actually happened. The most useful contributions are:
- A named organisation that removed something and got a measurable improvement.
- An incident where the damage was small because the data was never collected.
- A written policy, standard, or procurement rule that requires reduction.
Send the primary source with it — the advisory, the postmortem, the policy text. If a claim cannot be traced to a document, it does not belong in here.
Who maintains this
Anant Shrivastava, with the research and drafting work done by an agent that runs the checks in the repository before it proposes anything. Every change arrives as a pull request against the repository and is reviewed before it is published.