3 ms·
>nginx run behind it. It removes a lot of complexity from your code. There are good intentions with that advice but I think it's misleading. It doesn't take i
by jasode 9y ago
>nginx run behind it. It removes a lot of complexity from your code.
There are good intentions with that advice but I think it's misleading. It doesn't take into account how http libraries like this one (and similar ones for C++ such as Proxygen[1] and Silicon[2]) are supposed to be used.
The intended use case is to add an embedded webserver to your executable that's communicating with friendly and internal systems. That would be things like microservices and dashboards.
You don't use those libraries to create external public-facing websites that would be under attack from hostile agents. You're correct: Do not re-invent NGINX by using the C http library.
As an example proper use case, let's say you write an internal C program to process terabytes of image files. You think it might be nice to have a visual status of its progress/errors/throughput/etc. Instead of adding a GTK GUI to the code, you use the http library to expose a "web dashboard". You can then point an employee browser on the internal network at it to see its progress. For this use case, avoiding the http library and adding NGINX into the stack makes it more complicated.
Another use case without HTML gui is exposing http endpoints for microservices. Again, it's internal communication between friendly agents.
tldr: http libraries that are compiled into executables vs NGINX are for different use cases.
[1] https://github.com/facebook/proxygen https://github.com/facebook/proxygen
[2] http://siliconframework.org/ http://siliconframework.org/
- gtcode 9y agoYour described use case for a "friendly / internal" system has a limited definition in any non-trivial sized organization. It would only apply when all users of the embedded webserver already have root access to that server. This might make sense, for instance, in a small development team with a flat security hierarchy, but would be a red flag, security wise, otherwise.
- jasode 9y ago>Your described use case for a "friendly / internal" system has a limited definition in any non-trivial sized organization. Facebook is a non-trivial size company that has lots of internal private-facing programs with embedded http connectivity. From that experience, they open sourced Proxygen http library which is one of the links I mentioned in the previous comment. Also, see the comment from VikingCoder which in turn links to reddit thread mentioning another big company like Google doing similar use cases with http libraries: https://news.ycombinator.com/item?id=15671936 https://news.ycombinator.com/item?id=15671936
- gtcode 9y agoFacebook is a mixed bag as far as being a model of good behavior on many things. The company is founded on irresponsible social principles. For how long did general internal employees have access to users' private data? This is no longer the case, though, correct? Sorry to get OT. Maybe these libs are well-vetted, after all. My mistake. Thanks for the info.
- freedomben 9y agoI mostly agree with you, but I think it's worth considering defense in depth. Assuming only friendly requests could make your service a great pivot point.