5 ms·

Excited to see the code. C isn't known for being great for writing high level applications like this, so I'm really curious what the source looks like. Especial

• userbinator 11y ago
  I wonder if it has no buffer overflows either. ;-) C is definitely not known for easy and safe string processing, so I'm quite curious to see how it accomplishes that.
  • jhallenworld 11y ago
    It's not too hard if you are willing to use fixed length buffers and safe calls like: strlcpy, strlcat, and snprintf. Also not terribly hard to write a small arbitrary length string library as part of the project.
    • jheriko 11y ago
      its still not as easy as in languages with modern libraries. a = "foo" + "bar"; is very useful so is b = a.split( "," ); or a = b.trim(); etc. C strings are rarely so convenient. its more obvious with the more high level things you want. to do something like b = a.split( "," ); on a string that is not know until runtime you need dynamic allocations and you could use strtok to fill that memory with the results, but its an error-prone ballache by comparison.
      • krapp 11y ago
        Someone should totally build a dynamically typed language around C which is specifically meant for dealing with HTTP and serving HTML.
        • frik 11y ago
          It's called PHP
          • mtdewcmu 11y ago
            I was going to say that.
        • speps 11y ago
          Go works pretty well for that :)
      • kbenson 11y ago
        I still maintain that + is a terrible operator for concatenating strings, and results in quite a few types of bugs that are pervasive in many languages (usually from trying to automatically coerce non-matching operands).
        • mtdewcmu 11y ago
          I think I agree. PHP uses ., and I can't recall ever having a problem with that. However, I've been bitten by +.
        • jheriko 11y ago
          i can accept that argument. basic used & and php uses . as mentioned by another comment. :)
    • vardump 11y ago
      Not all implementations of snprintf behave the same way. Many are subtly broken. Some don't nul terminate the string if it's longer than the destination buffer. Also the return value can be -1 (correct behavior on failure, but it's often left unchecked) or more than destination buffer size! Fun times if you accumulate total written without range checking snprintf return value...
      • vardump 11y ago
        To add, notably this: _snprintf, _snprintf_l, _snwprintf, _snwprintf_l -> https://msdn.microsoft.com/en-us/library/2ts7cx93.aspx https://msdn.microsoft.com/en-us/library/2ts7cx93.aspx "If len > count, count characters are stored in buffer, no null-terminator is appended, and a negative value is returned." Uh, what? I guess that's why it is _snprintf and not snprintf, huh? They do provide secure [1] versions too, but you need to be careful which one you pick. Those secure versions terminate execution in some cases if buffer length is exceeded. [1]: https://msdn.microsoft.com/en-us/library/f30dzcf6.aspx https://msdn.microsoft.com/en-us/library/f30dzcf6.aspx - better remember that _TRUNCATE flag.
  • ronsor 11y ago
    All data is checked to see whether it is larger than 3768 (the buffers are 4096)
• jheriko 11y ago
  you may be surprised how easy it is to write a http server that replies with html in C... its all just text going over sockets after all. i did it myself a lot a long time ago by teaching myself, but you are right that using some full featured server and some high level language targetting web development has much more convenience, especially if you care about rich features and security.
  • teaearlgraycold 11y ago
    They claim it's got no dependencies though - so somehow they've got their own sockets implementation crammed in there.
    • jheriko 11y ago
      i doubt it tbh, i bet he means no /3rd party/ dependencies other than the ones that came with the development environment. the C standard library and the usual set of headers and os functions that you get in most C environments is not what people tend to mean by dependencies....
      • fit2rule 11y ago
        POSIX? Its quite possible to have a C-based sockets-/signals- handler in a single source file, say .. 48k lines of code or so. I've seen many robust system daemons with just such an implementation. 3rd party dependencies are definitely an issue that very few languages have managed to promote, since languages either want to promote (or demote) such circumstances as mass-package (i.e. mass usage of the language) in a broad commercial/industrial/social context. But its not naive to write such things as a Wiki and a Blog in C. Just .. dangerous. I imagine there are, however, some good 3rd-party C libraries available to do less-dangerous implementations, however...
        • jheriko 11y ago
          it never seems to actually be posix, but yeah that kind of stuff. it is interesting stuff.