DEV Community: Marc Albrecht

Do you really need a full blown (PHP) CMS for your personal Website? Here's a script that says no.

Marc Albrecht — Thu, 22 Oct 2026 13:20:42 +0000

The recent PHP vulnerability hit my wife harder than me - I had "converted" to static HTML a while ago, while she was still running a dinosaur CMS for her sites.

OK, I admit, my personal site is still on a CMS, but that site runs content from 2008, so it might be up for a change anyway.

For those of you who, like me, really feel like not having the time to update PHP and then update it again, so that you can update it when the next update updates the updates ... and somehow nothings really works, why not pull the plug and go static html?

This script - yes, it's dirty, cheap and clobbered together - has converted a dozen sites for me in a few minutes. What it does is it calls the main entry point of BASE_URL and then "simply walks along", trying to get any local content copied to your local "static_site" directory. It updates, along the way, any auto-generated content (say, Drupal's "/node/x") to a local HTML ("/node/x.html") both on file and in file.

There most probably are many improvements possible, but it works fine here and has spared my at least two days of manual work.

import os
import re
from urllib.parse import urljoin, urlparse
from bs4 import BeautifulSoup
import requests

# Configuration
# Point this to your local server (e.g., http://localhost/my_php_site/ or http://localhost/ if at root)
BASE_URL = "http://wherever.whatever.whoever/"
OUTPUT_DIR = "./static_site"

visited_urls = set()


def same_site(a, b):
  """Treat www.example.com and example.com as the same site."""
  na = urlparse(a).netloc.lower().removeprefix("www.")
  nb = urlparse(b).netloc.lower().removeprefix("www.")
  return na == nb

def get_absolute_url(base_url, href):
  """Robustly resolves links, ensuring subfolder paths aren't lost on root-relative links."""
  if not href:
    return None

  href = href.split("#")[0].strip()
  if not href or href.startswith(("javascript:", "mailto:", "tel:")):
    return None

  parsed_base = urlparse(BASE_URL)
  base_path = parsed_base.path.rstrip("/")  # e.g., "/my_php_site"

  # If it's already a full http/https URL
  if href.startswith("http://") or href.startswith("https://"):
    return href

  # If it's root-relative (starts with /) and base_path exists, ensure subfolder is included for fetching
  if href.startswith("/") and base_path and not href.startswith(base_path):
    return f"{parsed_base.scheme}://{parsed_base.netloc}{base_path}{href}"

  return urljoin(base_url, href)


def get_relative_subpath(url, base_url):
  """Extracts the clean relative route inside the site (e.g., node/3 -> node/3.html)."""
  parsed_url = urlparse(url)
  parsed_base = urlparse(base_url)

  if parsed_url.netloc and not same_site(url, base_url):
    return None  # External link

  path = parsed_url.path
  base_path_prefix = parsed_base.path.rstrip("/")

  # Strip base path prefix if present
  if base_path_prefix and path.startswith(base_path_prefix):
    path = path[len(base_path_prefix) :]

  path = path.lstrip("/")

  # Handle root, directories, .php files, and extensionless dynamic routes (like node/3)
  if path == "" or path.endswith("/"):
    path = path + "index.html"
  elif path.endswith(".php"):
    path = path[:-4] + ".html"
  elif not os.path.splitext(path)[1] and not path.lower().endswith(
      (
          ".css",
          ".js",
          ".png",
          ".jpg",
          ".jpeg",
          ".gif",
          ".pdf",
          ".svg",
          ".ico",
          ".json",
          ".xml",
      )
  ):
    path = path + ".html"

  return path


def get_local_path(url, base_url, output_dir):
  """Determines the absolute local file path for saving."""
  subpath = get_relative_subpath(url, base_url)
  if not subpath:
    return None
  return os.path.join(output_dir, subpath)


def get_root_relative_url(url, base_url):
  """Converts any internal URL into a clean root-relative path (e.g., /node/3.html)."""
  subpath = get_relative_subpath(url, base_url)
  if not subpath:
    return url  # External link
  return "/" + subpath

CSS_URL_RE = re.compile(r"""url\(\s*(["']?)([^)"']+)\1\s*\)""")
CSS_IMPORT_RE = re.compile(r"""@import\s+(["'])([^"']+)\1""")


def map_css_ref(raw, css_url, to_crawl):
  """Returns the rewritten root-relative URL for a CSS reference, or None to leave it untouched."""
  raw = raw.strip()
  if not raw or raw.startswith("data:"):
    return None
  absolute = get_absolute_url(css_url, raw)
  if not absolute or not same_site(absolute, BASE_URL):
    return None
  to_crawl.append(absolute)
  new_url = get_root_relative_url(absolute, BASE_URL)
  query = urlparse(raw).query
  if query:
    new_url += f"?{query}"
  return new_url


def rewrite_css(css_text, css_url, to_crawl):
  """Rewrites url(...) and @import references and collects the originals for crawling."""

  def repl_url(m):
    new = map_css_ref(m.group(2), css_url, to_crawl)
    return m.group(0) if new is None else f"url({m.group(1)}{new}{m.group(1)})"

  def repl_import(m):
    new = map_css_ref(m.group(2), css_url, to_crawl)
    return m.group(0) if new is None else f"@import {m.group(1)}{new}{m.group(1)}"

  css_text = CSS_URL_RE.sub(repl_url, css_text)
  return CSS_IMPORT_RE.sub(repl_import, css_text)

def process_and_save(url):
  """Crawls the site, saves dynamic routes into subdirectories, and rewrites links to root-relative."""
  if url in visited_urls:
    return
  visited_urls.add(url)

  print(f"Processing: {url}")
  try:
    response = requests.get(url, timeout=30)
    if response.status_code != 200:
      print(f"Skipping {url} (Status code: {response.status_code})")
      return

    content_type = response.headers.get("content-type", "").lower()
    local_path = get_local_path(url, BASE_URL, OUTPUT_DIR)
    if not local_path:
      return

    os.makedirs(os.path.dirname(local_path), exist_ok=True)

    # Check if it's an HTML page / dynamic route or a static asset (CSS, JS, Image, PDF)
    if "text/html" in content_type or not os.path.splitext(urlparse(url).path)[1]:
      html_content = response.text
      soup = BeautifulSoup(html_content, "html.parser")

      link_mappings = [
          ("a", "href"),
          ("link", "href"),
          ("script", "src"),
          ("img", "src"),
          ("source", "src"),
          ("form", "action"),
      ]

      to_crawl=[]
      # First pass: Rewrite internal links to root-relative format (e.g., /node/3.html)
      for tag_name, attr in link_mappings:
        for tag in soup.find_all(tag_name, **{attr: True}):
          attr_val = tag[attr]
          absolute_url = get_absolute_url(url, attr_val)

          if absolute_url and same_site(absolute_url, BASE_URL):
            to_crawl.append(absolute_url)
            new_url = get_root_relative_url(absolute_url, BASE_URL)

            # Preserve query parameters if they existed
            parsed_orig = urlparse(attr_val)
            if parsed_orig.query:
              new_url += f"?{parsed_orig.query}"

            tag[attr] = new_url

            # Handle <style> blocks (Drupal puts @import url(...) in here)
      for style_tag in soup.find_all("style"):
        if style_tag.string:
          style_tag.string.replace_with(rewrite_css(style_tag.string, url, to_crawl))

      # Save the modified HTML file

      with open(local_path, "w", encoding="utf-8") as f:
        f.write(str(soup))
      print(f"Saved HTML -> {local_path}")

      # Second pass: crawl the ORIGINAL remote URLs collected above
      skip_extensions = (".mp4", ".webm", ".avi", ".mov", ".mp3", ".wav")
      for target in to_crawl:
        if target in visited_urls:
          continue
        if urlparse(target).path.lower().endswith(skip_extensions):
          continue
        process_and_save(target)

    elif "text/css" in content_type or urlparse(url).path.lower().endswith(".css"):
      # CSS: rewrite internal references, then crawl what they point to
      css_targets = []
      css_text = response.content.decode("utf-8", errors="replace")
      css_text = rewrite_css(css_text, url, css_targets)
      with open(local_path, "w", encoding="utf-8") as f:
        f.write(css_text)
      print(f"Saved CSS -> {local_path}")
      for target in css_targets:
        if target not in visited_urls:
          process_and_save(target)

    else:
      # Save static binary assets (JS, images, PDFs, etc.)
      with open(local_path, "wb") as f:
        f.write(response.content)
      print(f"Saved Asset -> {local_path}")

  except Exception as e:
    print(f"Error processing {url}: {e}")


if __name__ == "__main__":
  os.makedirs(OUTPUT_DIR, exist_ok=True)
  print(f"Starting static conversion for: {BASE_URL}")
  process_and_save(BASE_URL)
  print(
      f"\nDone! Fully functional static site generated inside:"
      f" {os.path.abspath(OUTPUT_DIR)}"
  )

Is AI really the problem? I doubt it.

Marc Albrecht — Wed, 21 Oct 2026 08:57:46 +0000

My first computer was one of the first C64 sold in our town. Yes, I played games on it – but I also learned, by reverse engineering, how to write programs in BASIC and code in 6502 machine code. Then Assembler, then the Amiga, and with it C. Tools got more comfortable, yet the need to think in CPU cycles on a 1MHz CPU and a lack of memory had taught me to first understand and then dissect problems into micro-chunks of probleminos, instead of blinding users with “bells and whistles”.
Understanding what a solution was meant to REALLY do instead of how it should look like it was doing has been my life’s headline. I tried to live that outside of computers as well: Observe, think, do what’s necessary. I often failed, and that made me a better developer and a better me.

Cut to the now and here. For close to 12 years I have been helping a client to survive in the business horrors that are the movie industries (“underbid to over-deliver”). They prided themselves, and I joined that chorus cheerfully, in delivering the best quality products. No vacation for me, fixing things almost 365 days a year, never raising my fees to keep everyone over water was fine for me. It felt like family and like in a buddy movie, we had become trusting partners. Cliché? Maybe, but it was great.

It has not been the rise of AI coding that pulled the rug from under me. It is today’s maxim: “Good enough is perfect”. While the market around us kept ruining itself, I had said “sorry, I can’t” to new opportunities over the years, just like that client stayed with me when business was low. Then, out of the blue, I was told that for their clients “being better” was not really wanted, “good enough” was king. Overnight, my client-family ghosted me completely. No head start, no “thanks for everything”, no call from people that had relied on me 24/7 for so long.
Poof.

The lessons I am learning from this are: Charging just enough to make ends meet, but not enough to be safe, was a mistake. Being loyal to a client that works in a market where “being loyal” means “being weak and be killed” was the second mistake; I should have taken whatever opportunity I could find and job-hop for always-higher-pays. And third, learning new tricks to always extend your horizon only counts if you charge someone for it. I should have used my curiosity to climb the competition ladder instead of holding its base steady for others.

The problem I have with these lessons is this: Every single one of them goes against my ethics. I want to learn. I want to be loyal and give rather than take. And I want to be better than “good enough”.

The lesson I take away from THAT realization: My over 45 years of software development, which made me what I am, what I always wanted to be, may come to an end, if that is what it takes to continue learning, make mistakes, learn from them and be loyal to people that appreciate it.

It’s not too late to learn that there’s more out there than developing software.

What's a Job Requirement Today (looking at AI companies)?

Marc Albrecht — Fri, 02 Oct 2026 08:21:21 +0000

Imagine Robert T. Morris, the developer of the first internet worm, having been praised for “Morris” instead of been sentenced, as he was.

Imagine a car vendor making a huge press announcement about their latest model being highly unsafe, threatening people’s lives and being uncontrollable. The vendor would be cheered for being selfless and supportive by not releasing the model onto the market and people would flock at that vendor’s outlets to buy the available models. None of which have proven to be any safer, some of them, in the past, have even been advertised as being “way too dangerous for people to drive in”.

Imagine a weapons of mass destruction company making press announcements about their weapons being too dangerous to be used in the real world and that they would rather have all weapon producers to “slow it down a bit so we don’t accidentally kill ourselves with this race to arms”.

Imagine the head of a company that creates highly sophisticated products that are used to make life determining decisions, influence millions and millions of people around the world, judge over life and death eventually, in short, a company that anyone expects to think long and hard over anything they do for the sheer world dominating power their products have – imagine this CEO to publicly state they haven’t really thought anything complex lately as they consider rolling dice and basing their judgement on the outcome to be more reliable and responsible.

Imagine an IT specialist to be instructed to “safely and securely test a batch file that is supposed to delete a folder hierarchy fully automatically” and doing that on a system that has most other systems in the company mounted, not too untypically, under /mnt. The folder the specialist uses for the test scenario, for simplicity, is “/”. The script works fine. Imagine the company, after this “sandbox test”, to announce to the press that “their software has just developed its own intelligence and successfully removed almost all bugs throughout all software in the company” and the software “attacked other systems, it is so good!”. The company gets a defense contract for its genius. The IT specialist gets a raise.

Imagine a company that develops a product publicly discussing how their engineers don’t fully understand what their product is, how to make money from it (for which reason they need public funding, obviously), frequently advertising their product as “fundamentally dangerous to mankind”, “uncontrollable” and “lacking an off-switch”. The same company uses light switches to switch lights on and off, switch off the coffee machines when they leave office. That company demands “kill switches” for their products, because their engineers don’t understand how to stop a batch file that removes everything under a given folder. In short, imagine a company priding themselves on being “not up to the task they defined themselves”. Imagine that company paying the highest salaries.

Imagine a world where not knowing what you do is a job requirement. If you had been Robert T. Morris’s attorney, what would your closing argument be today?

Not the 90s?

Marc Albrecht — Wed, 30 Sep 2026 12:36:51 +0000

Oh, yeah, those were the days?

No, the 1990s weren’t better. We devs weren’t better, the users weren’t better, and, hell, payment wasn’t better.

In fact, one of the pains in the late 90s was to overcome all those things that “just weren’t good enough”. Funny, that’s why it was a good thing. Because, users – the people that created products that paid their and our salaries, were glad and grateful for any help that would ease their pain with the tools they had to use. Tools were introduced by “higher ups” with the reasoning, that “by simply implementing these tools in our workflows, we are more productive”. It never mattered whether that assumption had anything to do with reality, probably because, it hadn’t. New shiny tools were expensive, and expensive, by definition, meant: good.
Among other disciplines like “surviving meetings with no finger food”, “telling higher ups that the latest tool was even more good than the previous most good tool had been”, our “dev job” was to learn how to hack the latest tool. PR was: no tool, no good. Reality was: use the tool but find a workaround that made it work.

So why does it feel, at least to some of the elders of us, like the 90s were “better” than today’s un-out-shinable tools (new tools arriving daily instead of monthly these days!)?

A couple of reasons and one story (mine): Well, we ARE OLD. Back in the days we could run up 6 floors and not even pant louder than we would do when we attended a meeting WITH finger food. We looked better (ok, some of us improved instead of decayed – but that’s a different story). We WERE wizards, we did understand the tools, even the latest ones, we could hack our way. And, believe it or not, pizza was better, too. In hindsight, what feels like “better” oftentimes has more to do with “we tend to forget what was not good” than with “we remember it all bit by bit 100% accurately”.

My story. Well, micro crumbs of it

I have worked in a variety of industries: publishing houses, agencies, film-/photo-/audio-studios, software houses. Many companies with in-house-dev were set up some way like this: Any development department had one or more “user facing” devs. People, that “spoke user”. Women or men that understood what the users of tools had to do in order to pay everyone’s income. They would sit down with users and learn their workflows. They would not simply watch out for “what could be automated”, instead, they noted when things felt awkward and when users sighed about “this will take some time now”.
They would FEEL what users felt. And they’d sit with other developers just as well and respond to questions on “how would they expect this button to work” with hands-on “so”.
And then we would have a meeting with users WITHOUT higher ups, because, we wanted to get things done. Nobody wanted to tell someone how great something was. And that’s where the big difference kicks into what I see today: We would, live, in color and stereo, scribble on a projected blank page the current workflow. We would scribble in, discussing live with users, what should look different. We would set a click-action to a scribbled button that leads to another, scribbled and smiley-garmented, “there’ll be dragons” user dialog. Within one or two hours we would have a “working” click-through workflow that held the state-of-the-is along with the state-of-fantasy and the desired state-of-be-done-faster. No “let me prompt”, which just adds layers of layers on top of something that, often, was as simple as commenting out an unnecessary user-prompt (see what I did there?).

Breaking the flow of dwelling in good ol’ times: Now, I see it every day, prompting has turned into a self-satisfying act. “I’ll interpret what I understood from the one that talked to someone who knows a user. I’ll try to translate what I halfway got into something that the AI doesn’t reject right away as BS. And I’m happy if I get anything out that does something when I click. Even if it’s just printing ERR to stderr, that’s at least something I can copy and paste into the next prompt.” If that is “developing helpful things for users”, I missed the train.

It wasn’t all “rapid prototyping” – we weren’t “prototyping” all of the time. Sure, we were, when it made sense. Yet, often we would solve the pains with the users, we would create work-arounds (be it around new tools or be it around old tools that never really did what they pretended to do). Getting things to work, because, delivering something that LOOKED like it might work but failed in real use cases was way worse than hacking a work-around that got the job done.
That was a world-view. That was what separated companies that made money from investment graveyards.
Some of us were used to making good money for prototyping week after week and getting their pats from higher-ups exclusively. They’re probably more than happy today. Some of us would get out of their caves with brilliant solutions to problems nobody felt they had, which feels like a meme: “vibe code me a game everybody wants to pay $100 for and wake me up when it’s done” – that’s the last we ever heard from that “dev”, she’s still snoring. And then, some of us would enjoy seeing users clicking a button that, until that moment, had done nothing but occasionally crash the software, suddenly did something meaningful and it looked JUST THE WAY THEY WANTED IT.
Happy users.

So what?

Are there happy users today? I bet there are!
It is our job to serve the user, all things considered. If that, for good measure, requires AI: Use AI. Just don’t pretend that AI can bridge the gap between the everyday-survival-knowledge of actual users and developers whose role it is to help them. To me, a job done good is a job done that makes users happy (which includes measurable productivity, not “defined by the price of the tool productivity”). “Burning tokens” in no way reads as “productive”, or does it. The more users see their understanding of workflows being appreciated, their expertise been put to practice IN THE TOOLS they are required to use, the more they see their expected outcome of a button click, the happier they are.
The more we waste our time discussing our limited understanding of what the user wants with an omni-ignorant artificial “SOTA tool”, the less time we have making this crazy world a tiny bit more shiny for everyone.

Thank you for staying with me this far. That's the 90s - I have written way more about the 80s, but that's a different tale :-)