22 ms·
Rust for the Web
- vvanders 9y agoNice overview, it might be worth mentioning that Emscripten isn't a tier 1 platform[1]. We've seen some asserts thrown in LLVM when building debug but go away when build release. I've been trying to isolate it down to a reproducible sample but haven't nailed down exactly what's causing it yet. Even with that issue it's been great to work with. I find myself so much more productive with Rust compared to C/C++. [1] https://forge.rust-lang.org/platform-support.html https://forge.rust-lang.org/platform-support.html
- dbaupp 9y agoIf you've got something large that asserts consistently, you could consider throwing some CPU time at it via creduce. It is designed for C, but Rust is close enough that a lot of its heuristics still work just fine. Alternatively, since setting up/running creduce can be bit fiddly, if the code is open source, I suspect that someone would do it for you if you filed a bug against Rust pointing to an exact commit that demonstrates the problem with `cargo build --target=...` (or xargo) and requested/suggested creduce.
- vvanders 9y agoThanks, I'll give that a shot. Unfortunately the code which is why I was trying to pair it down to a simple sample.
- thinbeige 9y agoThe 'Client-sode JS in Rust' part is a promising showcase for WebAssembly and I hope to see more languages compiling to WebAssembly soon. But looking closer at the code which does not a lot compared to its size I rather prefer the JS version.
- jrs95 9y agoIn practice, I don't think Rust is really particularly well suited for this use case (especially the frontend stuff). But this is a really cool demo nonetheless, and the underlying WebAssembly will be something a lot of languages can use someday.
- huydotnet 9y agoYeah, the only convenience in this approach is to give you an ability to write JS right inside your Rust code. Somebody already starts implementing VIrtualDOM and something so we can expect more in the future.
- ryan-allen 9y agoI do believe big change is coming over the next few years, as we can develop reliable solutions on Web Assembly we're going to be able to use better languages. It's going to be glorious!
- modalduality 9y agoWeb developers may be also interested in https://gotham.rs/ https://gotham.rs/, which was released very recently and looks to be a promising competitor to Rocket.
- huydotnet 9y agoYeah, Gotham looks promising, and it has even better document than Rocket. It's always good to see more competitors coming around.
- runevault 9y agoAnd for those who care, unlike Rocket it runs on stable rust. IMO that is useful as I personally prefer running on stable than nightly.
- PascalW 9y agoGreat to see a few new web frameworks popping up. It seems that the older frameworks like Iron and Nickel.rs are not (yet) catching the async train.
- bb-z 9y agoI'm one of the developers of Gotham. Don't hesitate to reach out if you have any questions about it.
- jackblack8989 9y agoThis is all good and dandy but I don't like the webpage font-color! Can we have more of black on black so that it's even more modern and minimal? Or white-on-white which is more of a trend these days?
- huydotnet 9y ago;(
- jackblack8989 9y agoLol, I'm sorry it was a bit snarky! You've obviously done a great job but if anything the jab was not at you but at the trend...
- lsh 9y ago+1 for the snark, however I think the site looks good and the contrast is just right. there is an official Chrome plugin that lets you meddle with a site's contrast these days if you're having trouble (like me) with this awful trend that's approaching white-on-white: https://chrome.google.com/webstore/detail/high-contrast/djcfdncoelnlbldjfhinnjlhdjlikmph?hl=en https://chrome.google.com/webstore/detail/high-contrast/djcf...
- deleted 9y ago[deleted]
- spankalee 9y agoThis makes no mention of the size of these applications. Given the recent focus on shipping less JavaScript to the browser to better support mobile and slow networks, I wonder how feasible this project even is?
- gfodor 9y agoI guess unless the author made size reduction a priority it doesn't really make too much sense to judge the project on those characteristics. It seems like an interesting path.
- anotherbrownguy 9y agoWell, that focus is if you are looking to market your apps in those markets. If your market has ubiquitous fast affordable internet, shipping more javascript is not that much of an issue, specially if it makes your web application faster and easier to run or develop or provides other benefits.
- RussianCow 9y agoJust a small nitpick, but #3 is not actually an isomorphic app, it's just a regular server-rendered one. Isomorphic typically means that the app is rendered in the same way (e.g. via React) on both the frontend and backend, and the frontend degrades gracefully when JS isn't enabled. More on-topic: I just recently started a new web app using Rust on the backend. Though there is definitely a lot still missing, it's amazing how far the language and its ecosystem have come in the past year or so. I expect that within a couple years, Rust will be a viable alternative to Python and Ruby for backend web development.
- ricardobeat 9y agoIt _is_ isomorphic since he is shipping the rust code to the browser using web assembly.
- RussianCow 9y agoIt could be, hypothetically, but the description and example given don't do that.
- ricardobeat 9y agoSee the first section on 'stdweb', and check the Github repo linked - the code is all there for DOM manipulation in the browser. EDIT: what is going on here with the downvotes? Care to explain?
- mathw 9y agoThe author's "isomorphic" application is only stated as being the third section, where they're just rendering templates on the server side, and there's no client-side Rust at all.
- Drdrdrq 9y ago> I expect that within a couple years, Rust will be a viable alternative to Python and Ruby for backend web development I like Rust, but I don't see this happening. Python, Ruby and PHP/Node.js languages became popular (and thus useful) because their learning curve is not steep - which is not something one can say about Rust. I consider myself capable developer but I struggled with many concepts. It's true that I didn't use it for a real project though, it might have been easier if I had clear goal in my mind.
- anhtran 9y agoRust is cool. But I don't think it's good for web backend at this time. I will try it when working with WebAssembly.
- littlestymaar 9y agoI don't understand why you are downvoted : that's absolutely true, Rust isn't quite the best choice for web backend ATM, by far. It's way better than last summer though, rocket and the recently announced gotham framework look great, and I'm really excited to see how it evolves in the next few months.
- pankajdoharey 9y agoMan Rust is super hard already! I mean people told me it would be harder to think functionally but after clojure, i think lisps are super easy. But i feel Rust is way harder than anything. Infact i feel Haskell is comparatively easier than Rust. So i am not sure why one wants to use it for web. I think Rust has a place and that is to replace C++ for system software, possibly even C for writing Kernels because why not? But definitely not for web. Go is probably the right choice for that sort of performance scenario in the backend. But for frontend neither Go or Rust are good simply because of the huge size of the runtimes. Clojure-script comparatively has a smaller runtime than either Go or Rust runtimes compiled to JS.
- haskellandchill 9y agoHaskell has more concepts than Rust (like higher kinder types) and should get linear types soon. Rust seems like Go with some Java and the great borrow checking system.
- pcwalton 9y agoAssociated types put Rust beyond Java and far beyond Go in terms of type system features, even without counting anything lifetime-related.
- haskellandchill 9y agoInteresting, didn't know it had something like type families. Thanks!
- moomin 9y agoWith the best will in the world, linear types are still going to take some serious work. Look at the guy doing a linear type streaming library. And that's just at the language level. You then need pervasive library support. And then you need more GHC work on optimisation, work out how you interoperate with levity polymorphism and so on and so on. And _after_ all this work is done, I seriously doubt you'll be able to control memory usage as well as Rust does now. I love Haskell to bits, but there's no way it's going to beat Rust at what Rust's good at for a long time to come.
- Animats 9y agoIt's cool that you can do this, but it's probably not something you want to do unless you have an unusual application. A reasonable application might be a heavily used API at the HTTP level, where the web-facing part is really a subroutine call interface, performance may be a big issue, and safety against bad parameters is a big issue.
- EugeneOZ 9y agoYou are cool, and it's all is amazing work. I bet it was very interesting to implement. But reading comments I think people don't understand that it's just demonstration of how much Rust evolved, not a tutorial of what they should do to use Rust for the Web. Kind of overkill :)
- Siilwyn 9y agoNice blog! Do you have a RSS feed? Can't find any...
- IshKebab 9y ago> NamedFile::open(Path::new("www/").join(file)).ok() Is this vulnerable to the classic "../../../../../../../etc/passwd"?
- rahkiin 9y agoI was thinking the exact same thing. Rust being a more memory-safe language does not mean it is a secure one. Still needs proper input validation. EDIT: I opened the documentation and found https://api.rocket.rs/rocket/request/trait.FromSegments.html https://api.rocket.rs/rocket/request/trait.FromSegments.html I don't fully understand if the checking they do on '..' fixes the attack vector here.
- SpaceManiac 9y agoBased on a quick read of the source, the conversion from a "<param..>" input to a "PathBuf" type strips leading ".." components automatically.
- sqeaky 9y agoSo would this still work? ValidDir/../../../../../../../etc/passwd
- anonova 9y agoSlashes aren't allowed, so wouldn't be able to do any path traversals: https://api.rocket.rs/src/rocket/request/param.rs.html#298 https://api.rocket.rs/src/rocket/request/param.rs.html#298
- e12e 9y agoAfaik remember windows will parse additional dots beyond the two first as another level up? Cross-platform secure coding is hard... (Not sure about this code though, just making an observation).
- DiThi 9y ago> On Windows, decoded segment contains any of: '\' And on Japanese and Korean windows? It uses the yen symbol as path separator. Depending on how the path is read or interpreted, filtering the yen may be necessary. https://msdn.microsoft.com/en-us/library/dd374047(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/dd374047(v=vs.85).a...
- jbg_ 9y agoI built https://dtmf.io/ https://dtmf.io/ using Rust. The first prototype was using the Iron framework but then after fighting some parts of Iron, I pared it back to just using async hyper & handlebars-rs directly for the HTTP and templating. The glue to put them together is really minimal. Overall, I've been really impressed with Rust.
- roywiggins 9y agoI can't help thinking something like Wt, but in Rust, would be an awfully handy way to write webapps.