15 ms·

Building a Website with C++

95 points by daftpanda 9y ago

jkforpres 9y ago
Just FO with your c++ and stupid article. I've repeated this 1000 times and will repeat again, there's no point in using c++ in 2018 unless you want to be a moron :)
marmaduke 9y ago
I was expecting something like Wt (https://www.webtoolkit.eu/wt https://www.webtoolkit.eu/wt)
- julienfr112 9y ago
  I had good experience with WT too.
- stargrazer 9y ago
  I would suggest/recommend this as well.
happy_rust44 9y ago
why not use rust? do you want to bring all security vulnerabilities to the internet too? Man these c++ guys haven't learnt a thing from recent vuln facepalm
mfontani 9y ago
This brings me back... I was doing this exact sort of stuff at the turn of the century, although admittedly in C - not C++ - and using/linking to the Delphi CGI library. CGI in 2018 seems a bit passé...
- floatboth 9y ago
  Actually, this new hip function-as-a-service thing feels a lot like CGI/inetd… well, at least in terms of not keeping the server process up all the time, only when it's used. To combine "only running when necessary" and "not restarting for every request when there's a lot of requests", I made a thing: https://github.com/myfreeweb/soad https://github.com/myfreeweb/soad — little wrapper listens on a socket, spawns your server with the socket passed in, terminates the server when there were no new connections in a while, rinse, repeat.
  - z92 9y ago
    You can check inetd which does exactly that and comes preinstalled and pre activated with Linux installations. Or at lest it was common once upon a time. Don't know if it still is. https://en.wikipedia.org/wiki/Inetd https://en.wikipedia.org/wiki/Inetd
allover 9y ago
Am I right in thinking the main reason not to do this is memory safety (as demonstrated by Cloudbleed)?
- zebra_cross21 9y ago
  yes you are! Just imagine websites leaking other people's credentials to hackers because someone was using an undefined language haha!!
- nkozyra 9y ago
  That's part of what I'd argue is the main argument against: not reinventing the wheel. The only argument for is experimenting. These are all toy examples. I'd argue that through CGI it won't even be more performant than opcode cached interpreted languages.
zebra_cross21 9y ago
Just use rust man :| why do you want to bring all your security vulnerabilities and undefined behaviors to web?
- emerged 9y ago
  Might want to integrate an existing C++ code base into a server without developing an API or IPC in between the two. The security issues would be similar in either case and this would be much quicker to develop.
  - yodon 9y ago
    > Might want to integrate an existing C++ code base into a server without developing an API or IPC in between the two. Or perhaps you might want to use a belt sander to refinish your table without removing the tablecloth from the table first. Not all the things one “might want to do” are good ideas, even if there’s a wikihow on best ways to do them. C++ is a great language but it’s a very hard language to wield correctly. The odds there is an exploitable buffer overflow or injection attack buried deep in some part of the code are simply too high compared to memory managed languages with standard libraries designed from the ground up for web-facing applications.
  - matthewmacleod 9y ago
    this would be much quicker to develop. There is almost literally no chance that this is the case. The amount of pointless boilerplate code that you'd have to write would be many, many, many times in excess of a thin API layer.
    - contrarian_ 9y ago
      How do you suggest writing a thin API layer to expose an interactive real-time stream consumed over WebSocket?
- bcjpjk 9y ago
  Rust would be equally unsuitable to this task. Web development in C++ or Rust? Why? There may be some advantages to writing a middle tier application server in either of these languages, but using a system language to manage a web front-end is effectively like using a hatchet to shave. Sure, the hatchet is faster at cutting wood than a safety razor, and if one is careful, it could be used to remove stubble, but chances are that one is not clearly thinking about the problem at hand to suggest such a tool.
Kenji 9y ago
> Is This Even Possible? Why the hell shouldn't it be possible? C++ powers most of the stuff under the hood. The higher level languages like PHP are just sugar on top.
godbolt_com 9y ago
Every programmer who has ever written c++ knows the worst thing to do in 2018 would be to bring c++ to web. All our operating systems are plagued with undefined behaviors and buffer overflows and what not! Let's not use c++ anymore, there are many better alternatives for us :)
billconan 9y ago
I wrote a c++/Qt web framework as a hobby. https://github.com/shi-yan/Swiftly https://github.com/shi-yan/Swiftly
xiphias 9y ago
Writing C++ so that you slow it down by CGI? This looks like an example of how not to do things. Did the author really benchmark if optimized PHP environment is not faster than his solution?
giancarlostoro 9y ago
Its always interesting to see C++ but as someone else mentioned I expected to see Wt. If I want nearest to C++ speeds I rather go with D (using vibe.d) or Rust. C++ isn't my area of expertise though but those two other languages are years more approachable for me personally. Not saying I could never do C++ though. I know OkCupid is C++ using Wt iirc. I wish they'd give D a try or Rust to see how much more productive they become.
- bcjpjk 9y ago
  Why would you assume that D or Rust would be make developers more productive? If the developer already knows C++, then switching to D or Rust would make the developer significantly less productive over six months to a year, after which, the developer would likely be just as productive as he/she was when writing C++. Languages are not panaceas. Rust and D are both hard languages, as is C++. Selecting one of these only makes sense if the application warrants it. Each have advantages and disadvantages. I don't really think any of them are suited to web development, but claiming that D or Rust would be a more productive web development language than C++ seems equally silly to seriously considering C++ as a web development language.
  - jordigh 9y ago
    > Why would you assume that D or Rust would be make developers more productive? If the developer already knows C++, then switching to D Because D is very obviously C++ but better. Rust isn't, though. But D, down to the very name, has lots of things that appeal to C++ users. It has advanced metaprogramming, is multiparadigm, it compiles down to machine code, and has very similar syntax to C++. D has had other influences, but it is written by C++ compiler writers who think they can do better than C++. I say this as someone raised on C++ and who is now trying D. It is a very natural progression to make, if you're inclined to try something new. Furthermore, Vibe.d is kind of a burgeoning "killer app" for D. D's package manager, for example, was originally made for Vibe.d. This isn't the only way in which Vibe.d has influenced D development. Vibe.d is one of the most popular D libraries. It's the only D library I know that has its own published book, https://dlang.org/blog/2017/09/13/the-making-of-d-web-development/ https://dlang.org/blog/2017/09/13/the-making-of-d-web-develo...
hild_for_me 9y ago
Use RUST! The reason that C++ sucks is that it is a FAUX object-oriented language. Many things that you CAN do with an object-oriented language are impossible with C++ (unless you like hackery... no, I don't like hackery). The reason is purely about runtime speed. At the time that C++ was designed, processors were horribly slow (compared to today's). OOP runtimes were dreadful. So all of the work was put in at compile-time in order to speed up run-time. Except for one thing. It meant that it was no longer OOP but pseudo-OOP. It kinda-quacked like a duck, kinda-looked like a duck, but really wasn't a duck at all. For example, one aspect that was ripped from the hands of the developer was the ability to store the address to a function in a variable. Pretty damn useful. You can't do that in C++. There are HACKS to do it, but natively, the language can't. It is this "can't" that makes the language so bad. Sure, you might think "I don't need to store an address to a function in a variable" but try to build GUI API's without that - it's a PITA. So much so, that Qt uses a preprocessor to handle things that C++ can't do. Wow. Now we're having to write preprocessors to get over stuff the language is incapable of handling. I've written a lot of C++ code. There are parts of C++ I like. But for the most part, it is a broken language from the start. It is highly flawed. No one spent ANY time thinking through the problems with ctors or dtors (yeah, they said they did, but they didn't). It's a bad, broken, language
wtfcpp 9y ago
Why not try rust? Its faster than c++ and comes with absolutely no disadvantages... Now you might ask what are the reasons C++ is considered bad? Probably easiest to compare C++ with C. C was a beautifully designed language. The features of the C language were added with purpose. They were intended to solve a real problem and solve that problem they did. Simple arithmetic with promotion. Automatic register allocation with a portable (between compilers) ABI. A simple-but-handy preprocessor. And so on. C is also a lean language: a single person can feasibly write a C compiler in a relatively short time (tinycc is a C99-compliant C compiler written in just 65kLOC of C!). C set out to achieve a clear goal and it achieved its goal. Thanks to the cleanness of C lots of quality compilers came on the market quickly and even decent OSS solutions were available early on. In contrast, C++ never had a clear goal. The features of C++ were added almost at random. Stroustrup's original idea was essentially "C is cool and OOP is cool so let's bolt OOP onto C". Retrospectively, OOP was massively overhyped and is the wrong tool for the job for most of the people most of the time. Half of the GoF design patterns just emulate idioms from functional programming. Real OOP languages like Smalltalk and IO express many useful things that C++ cannot. The feature that C needed most was perhaps parametric polymorphism (aka generics in Java and C#, first seen in ML in the late 1970s) but instead of that C++ got templates that weren't designed to solve any particular problem but rather to kind of solve several completely unrelated problems (e.g. generics and metaprogramming). Someone actually discovered by accident that C++ templates are Turing complete and they wrote and published a program that computed prime numbers at compile time. Wow. A remarkable observation that led to decades of template abuse where people used templates to solve problems much better solved by other pre-existing solutions such Lisp macros and ML polymorphism. Worse, this abuse led to even more language features being piled on top, like template partial specialization. The massive incidental complexity in C++ made it almost impossible to write a working compiler. For example, it remains extremely difficult to write a parser for the C++ language. The syntax also has horrible aspects like List<Set<int>> being interpreted as logical shift right. None of the original C++ compilers were reliable. During my PhD in 2000-2004 I was still stumbling upon dozens of bugs in C++ compilers from GNU, Intel and SGI. Only after two decades did we start to see solid C++ compilers (by which time C++ was in decline in industry due to Java and C#). C++ is said to be fast but the reality is that C++ is essentially only fast when you write C-like code and even then it is only fast for certain kinds of programs. Due to the "you don't pay for what you don't use" attitude, C++ is generally inefficient. RAII injects lots of unnecessary function calls at the end of scope, sometimes even expensive virtual calls. These calls often require data that would otherwise be dead so the data are kept alive, increasing register pressure and spilling and decreasing performance. The C++ exception mechanism is very inefficient (~6x slower than OCaml) because it unwinds the stack frame by frame calling destructors rather than long jumping. Allocation with new and delete is slow compared to a modern garbage collector so people are encouraged to use STL collections but these pre-allocate huge blocks of memory in comparison so you've lost the memory-efficiency of C and then you are advised to write your own STL allocator which is no better than using C in the first place. One of the main long-standing advantages of C over modern languages is the unpredictable latency incurred by garbage collectors. C++ offers the worst of both worlds by not having a garbage collector (making it impossible to leverage useful concepts like purely functional data structures properly) but it encourages all destructors to avalanche so you get unbounded pause times (worse than any production GC). Although templates are abused for metaprogramming they are very poor at it and C++ has no real support for metaprogramming. For example, you cannot write an efficient portable regular expression library in C++ because there is no way to do run-time code generation and compilation as you can in Java, C# and languages dating back to Lisp (1960). So while Java and C# have had regular expressions in their standard libraries for well over 10 years, C++ only just got them and they are slow. C++ is so complicated that even world experts make rookie mistakes with it. Herb Sutter works for Microsoft and sits on the C++ standards committee where he influences the future of C++. In a lecture he gave his favorite 10-line C++ program, a thread-safe object cache. Someone pointed out that it leaks memory (Herb Sutter's favorite C++ 10-liner has a memory management bug). My personal feeling is that the new Rust programming language is what C++ should have been. It has useful known features like generics, discriminated unions and pattern matching and useful new features like memory safety without garbage collection.
mproud 9y ago
You can build a website with any language… I mean, sometimes it’s nice to go back to the basics, but aren’t there better packages and frameworks written in C++ to handle the job?
rusky123 9y ago
Why not try rust? Its faster than c++ and comes with absolutely no disadvantages... Now you might ask what are the reasons C++ is considered bad? Probably easiest to compare C++ with C. C was a beautifully designed language. The features of the C language were added with purpose. They were intended to solve a real problem and solve that problem they did. Simple arithmetic with promotion. Automatic register allocation with a portable (between compilers) ABI. A simple-but-handy preprocessor. And so on. C is also a lean language: a single person can feasibly write a C compiler in a relatively short time (tinycc is a C99-compliant C compiler written in just 65kLOC of C!). C set out to achieve a clear goal and it achieved its goal. Thanks to the cleanness of C lots of quality compilers came on the market quickly and even decent OSS solutions were available early on. In contrast, C++ never had a clear goal. The features of C++ were added almost at random. Stroustrup's original idea was essentially "C is cool and OOP is cool so let's bolt OOP onto C". Retrospectively, OOP was massively overhyped and is the wrong tool for the job for most of the people most of the time. Half of the GoF design patterns just emulate idioms from functional programming. Real OOP languages like Smalltalk and IO express many useful things that C++ cannot. The feature that C needed most was perhaps parametric polymorphism (aka generics in Java and C#, first seen in ML in the late 1970s) but instead of that C++ got templates that weren't designed to solve any particular problem but rather to kind of solve several completely unrelated problems (e.g. generics and metaprogramming). Someone actually discovered by accident that C++ templates are Turing complete and they wrote and published a program that computed prime numbers at compile time. Wow. A remarkable observation that led to decades of template abuse where people used templates to solve problems much better solved by other pre-existing solutions such Lisp macros and ML polymorphism. Worse, this abuse led to even more language features being piled on top, like template partial specialization. The massive incidental complexity in C++ made it almost impossible to write a working compiler. For example, it remains extremely difficult to write a parser for the C++ language. The syntax also has horrible aspects like List<Set<int>> being interpreted as logical shift right. None of the original C++ compilers were reliable. During my PhD in 2000-2004 I was still stumbling upon dozens of bugs in C++ compilers from GNU, Intel and SGI. Only after two decades did we start to see solid C++ compilers (by which time C++ was in decline in industry due to Java and C#). C++ is said to be fast but the reality is that C++ is essentially only fast when you write C-like code and even then it is only fast for certain kinds of programs. Due to the "you don't pay for what you don't use" attitude, C++ is generally inefficient. RAII injects lots of unnecessary function calls at the end of scope, sometimes even expensive virtual calls. These calls often require data that would otherwise be dead so the data are kept alive, increasing register pressure and spilling and decreasing performance. The C++ exception mechanism is very inefficient (~6x slower than OCaml) because it unwinds the stack frame by frame calling destructors rather than long jumping. Allocation with new and delete is slow compared to a modern garbage collector so people are encouraged to use STL collections but these pre-allocate huge blocks of memory in comparison so you've lost the memory-efficiency of C and then you are advised to write your own STL allocator which is no better than using C in the first place. One of the main long-standing advantages of C over modern languages is the unpredictable latency incurred by garbage collectors. C++ offers the worst of both worlds by not having a garbage collector (making it impossible to leverage useful concepts like purely functional data structures properly) but it encourages all destructors to avalanche so you get unbounded pause times (worse than any production GC). Although templates are abused for metaprogramming they are very poor at it and C++ has no real support for metaprogramming. For example, you cannot write an efficient portable regular expression library in C++ because there is no way to do run-time code generation and compilation as you can in Java, C# and languages dating back to Lisp (1960). So while Java and C# have had regular expressions in their standard libraries for well over 10 years, C++ only just got them and they are slow. C++ is so complicated that even world experts make rookie mistakes with it. Herb Sutter works for Microsoft and sits on the C++ standards committee where he influences the future of C++. In a lecture he gave his favorite 10-line C++ program, a thread-safe object cache. Someone pointed out that it leaks memory (Herb Sutter's favorite C++ 10-liner has a memory management bug). My personal feeling is that the new Rust programming language is what C++ should have been. It has useful known features like generics, discriminated unions and pattern matching and useful new features like memory safety without garbage collection.
CapacitorSet 9y ago
tl;dr: CGI.
cpp__guru 9y ago
I'm gonna tell you from 30 years of experience, c++ aint gonna survive any longer child. So why not try rust? Its faster than c++ and comes with absolutely no disadvantages... Now you might ask what are the reasons C++ is considered bad? Probably easiest to compare C++ with C. C was a beautifully designed language. The features of the C language were added with purpose. They were intended to solve a real problem and solve that problem they did. Simple arithmetic with promotion. Automatic register allocation with a portable (between compilers) ABI. A simple-but-handy preprocessor. And so on. C is also a lean language: a single person can feasibly write a C compiler in a relatively short time (tinycc is a C99-compliant C compiler written in just 65kLOC of C!). C set out to achieve a clear goal and it achieved its goal. Thanks to the cleanness of C lots of quality compilers came on the market quickly and even decent OSS solutions were available early on. In contrast, C++ never had a clear goal. The features of C++ were added almost at random. Stroustrup's original idea was essentially "C is cool and OOP is cool so let's bolt OOP onto C". Retrospectively, OOP was massively overhyped and is the wrong tool for the job for most of the people most of the time. Half of the GoF design patterns just emulate idioms from functional programming. Real OOP languages like Smalltalk and IO express many useful things that C++ cannot. The feature that C needed most was perhaps parametric polymorphism (aka generics in Java and C#, first seen in ML in the late 1970s) but instead of that C++ got templates that weren't designed to solve any particular problem but rather to kind of solve several completely unrelated problems (e.g. generics and metaprogramming). Someone actually discovered by accident that C++ templates are Turing complete and they wrote and published a program that computed prime numbers at compile time. Wow. A remarkable observation that led to decades of template abuse where people used templates to solve problems much better solved by other pre-existing solutions such Lisp macros and ML polymorphism. Worse, this abuse led to even more language features being piled on top, like template partial specialization. The massive incidental complexity in C++ made it almost impossible to write a working compiler. For example, it remains extremely difficult to write a parser for the C++ language. The syntax also has horrible aspects like List<Set<int>> being interpreted as logical shift right. None of the original C++ compilers were reliable. During my PhD in 2000-2004 I was still stumbling upon dozens of bugs in C++ compilers from GNU, Intel and SGI. Only after two decades did we start to see solid C++ compilers (by which time C++ was in decline in industry due to Java and C#). C++ is said to be fast but the reality is that C++ is essentially only fast when you write C-like code and even then it is only fast for certain kinds of programs. Due to the "you don't pay for what you don't use" attitude, C++ is generally inefficient. RAII injects lots of unnecessary function calls at the end of scope, sometimes even expensive virtual calls. These calls often require data that would otherwise be dead so the data are kept alive, increasing register pressure and spilling and decreasing performance. The C++ exception mechanism is very inefficient (~6x slower than OCaml) because it unwinds the stack frame by frame calling destructors rather than long jumping. Allocation with new and delete is slow compared to a modern garbage collector so people are encouraged to use STL collections but these pre-allocate huge blocks of memory in comparison so you've lost the memory-efficiency of C and then you are advised to write your own STL allocator which is no better than using C in the first place. One of the main long-standing advantages of C over modern languages is the unpredictable latency incurred by garbage collectors. C++ offers the worst of both worlds by not having a garbage collector (making it impossible to leverage useful concepts like purely functional data structures properly) but it encourages all destructors to avalanche so you get unbounded pause times (worse than any production GC). Although templates are abused for metaprogramming they are very poor at it and C++ has no real support for metaprogramming. For example, you cannot write an efficient portable regular expression library in C++ because there is no way to do run-time code generation and compilation as you can in Java, C# and languages dating back to Lisp (1960). So while Java and C# have had regular expressions in their standard libraries for well over 10 years, C++ only just got them and they are slow. C++ is so complicated that even world experts make rookie mistakes with it. Herb Sutter works for Microsoft and sits on the C++ standards committee where he influences the future of C++. In a lecture he gave his favorite 10-line C++ program, a thread-safe object cache. Someone pointed out that it leaks memory (Herb Sutter's favorite C++ 10-liner has a memory management bug). My personal feeling is that the new Rust programming language is what C++ should have been. It has useful known features like generics, discriminated unions and pattern matching and useful new features like memory safety without garbage collection.
stargrazer 9y ago
Some other libraries I have seen for http protocol based applications: https://github.com/Qihoo360/evpp https://github.com/Qihoo360/evpp - network library for developing high performance network services in TCP/UDP/HTTP protocols https://github.com/rep-movsd/see-phit https://github.com/rep-movsd/see-phit - C++ HTML template engine that uses compile time HTML parsing https://github.com/boostorg/beast https://github.com/boostorg/beast - HTTP and WebSocket built on Boost.Asio in C++11 https://github.com/emweb/wt https://github.com/emweb/wt - Wt, C++ Web Toolkit
- kakwa_ 9y ago
  Personally, I've used: https://github.com/civetweb/civetweb https://github.com/civetweb/civetweb (for implementing an RFC 3161 (crypto timestamp) service. It's a fork of https://github.com/cesanta/mongoose https://github.com/cesanta/mongoose (The Civetweb fork exists due to Mongoose license switch from MIT to GPLv2)
gumby 9y ago
> I know it sounds strange, and perhaps even an exercise in novel futility, but it isn’t. Oh come on, C++ is a systems programming language and certainly can handle this, so “futility” seems over the top. Hell, you can write cgi handlers in assembly. Around 94 I wrote Cygnus’ web interface (and then cron job too) to our big system in sh. Sure, I wouldn’t make the same choice today, but it’s hardly absurd.
sddfd 9y ago
Bevor I'd use C++ I'd take a hard look at Go, figure out whether I really need C++ performance, or whether Go is just good enough. Go is rather performant and in contrast to C++ memory safe.
- pleasecalllater 9y ago
  If you say that C++ is not memory safe you really don't know the modern C++. Of course you can use only `void *` everywhere... but you can also write your software in a totally different way. My C++ code has no pointers, just objects, which are automatically destroyed when I want to. The nice feature is that I know when the destructor is called, so the object will clear itself in a very nice way.
  - checker659 9y ago
    You're just wasting your energy man. People still think we live in the C++98 era.
  - nercury 9y ago
    It's futile battle though to achieve both performance and safety in C++: as an example, safety requires avoiding moves, using reference counting, while achieving performance means avoiding copies and passing occasional references around, among other things. That's why advertising C++ solution as fast does not work well with "but C++ can be safe too!".
    - bcjpjk 9y ago
      Moves can be safe, and copies can be dangerous. C++ is a language that can be used like a sawed-off shotgun propped against a developer's foot, and with a hair trigger. Granted, it does not _have_ to be used this way, but it can be. A good developer can be "safe by default" and can use profile-directed optimization to speed up areas that are performance critical. A great developer can build proofs that such performance improvements maintain safety guarantees. For the average developer, following modern C++ development practices creates code on par with other languages in terms of both safety and performance. For most languages, a lot can be done in terms of optimization, profiling, and security. Even in higher-level languages, an FFI is available to rewrite critical portions of code in a lower level language for performance improvements. Careful attention to detail can provide critical performance improvements in any language without compromising on safety. Getting there requires model checking or formal methods, but that is also becoming more of a part of modern development practices.
deleted 9y ago
[deleted]
booleandilemma 9y ago
Reminds me of this: https://m.imgur.com/r/ProgrammerHumor/INBvStO https://m.imgur.com/r/ProgrammerHumor/INBvStO
fuball63 9y ago
I'm in the early stages of a FaaS platform that uses CGI for the functions. As such, I have been collecting articles about general CGI development, and have them listed in my docs. If anyone is interested in writing large scale CGI apps (CGI is popping up a lot around here lately), these are some good resources: https://bigcgi.com/docs https://bigcgi.com/docs
- ddorian43 9y ago
  Isn't cgi slow ? Don't you need something like fast-cgi (which lambda does I think) ?
  - fuball63 9y ago
    CGI is slow because of the spin up time for individual processes for each request. FastCGI is fast because they run as one long running process that handles multiple requests. While plain CGI is a slower, the advantage is that you don't have long running and potentially idle processes for low traffic periods, and process isolation is a little security boost. I chose to have a slightly slower startup time, which hopefully remain constant in a load balanced cluster, to gain the advantages above.
    - dfox 9y ago
      Also the spinup time is considerably larger problem for various interpreters and virtual machines than for native code binary. I would even expect that you can write non-trivial CGI application whose startup time is smaller than the additional overhead from parsing of the FastCGI protocol.
xaduha 9y ago
If you want to use something like that for web, then use http://websocketd.com http://websocketd.com. There's no need to generate html on the server, unless you really don't want to touch JS at all.
dahart 9y ago
> In this article, I’ll explain how you can use C++ to develop a website and some concrete reasons why you might consider doing so. I only saw one reason: performance. Did I miss some? Do people have other good use cases that justify paying the dev cost of using C++ for a web server? I'd guess with caching and a decent backend, it would be fairly hard to demonstrate a true need for performance that requires C++, but I'm sure there are a few demanding applications out there that need it. Since a web page's throughput is usually network bottlenecked and not CPU bound, I'm curious (just for fun) what the max possible performance benefit of going C++ is, especially behind a CGI interface? There's probably a small latency benefit at all times, and I'd guess there's a throughput benefit that is only visible if you're doing more than a few thousand requests per second..?
- pjmlp 9y ago
  You missed IoT. Preferably one would use some kind of network protocol with a native management console, but nowadays it is fashionable to have a mini webserver exposing a Web UI instead.
  - dahart 9y ago
    > You missed IoT. I did? I just read the article again, and I don't see any mention of IOT or small or embedded devices aside from Docker, can you point me to what you saw? The article is assuming Apache is running...
    - pjmlp 9y ago
      I was replying to your question, which I should have quoted. > Do people have other good use cases that justify paying the dev cost of using C++ for a web server?
      - goldenkey 9y ago
        Most router admin panels are probably written in C++
taylorking 9y ago
You can do this with libboost with this https://github.com/ipkn/crow https://github.com/ipkn/crow
flatline 9y ago
Pion[0] is a fairly robust and well-written HTTP server implementation in C++. You can spin up a server very quickly and reverse proxy through Apache or Nginx. Microsoft has a cross-platform offering of some sort in the works using C++11, now I don’t remember the name but I think Herb Sutter has a write-up in it from a couple years ago. It’s definitely possible to write modern web applications in C++, I feel like the cgi route is pretty old school. [0] https://github.com/splunk/pion https://github.com/splunk/pion
- zura 9y ago
  > Microsoft has a cross-platform offering of some sort in the works using C++11 Casablanca, but I'm not sure how active is the project nowadays.
  - RotsiserMho 9y ago
    It's called the C++ REST SDK (https://github.com/Microsoft/cpprestsdk https://github.com/Microsoft/cpprestsdk) now and is fairly active. I've used it client-side and I've really enjoyed it.
chubot 9y ago
Really? Escaping, people! This code isn't practical or useful; it's dangerous and sloppy. cout << "<body>\n"; ... cout << getenv("QUERY_STRING"); cout << "</body>\n"; FWIW I wrote an article about HTML escaping and shell here: http://www.oilshell.org/blog/2017/09/19.html http://www.oilshell.org/blog/2017/09/19.html Followup: http://www.oilshell.org/blog/2017/09/29.html http://www.oilshell.org/blog/2017/09/29.html Also if you want to use a native language for web sites (which I don't), Go is a better choice, as the standard library has html/template which protects you from naive injections: https://golang.org/pkg/html/template/ https://golang.org/pkg/html/template/
- entropie 9y ago
  > In this article, I’ll explain how you can use C++ to develop a website and some concrete reasons why you might consider doing so. I dont find any reasons at all. That article ist just a clickbait nonsens.
  - carterehsmith 9y ago
    "Building a Website with C++" "Is This Even Possible?" We can just "flag" articles like this one.
- flatline 9y ago
  CTemplate is a not-unreasonable option for C++ as well.
- bcjpjk 9y ago
  Yeah... this example code is bad. Not to mention that CGI is slow, problematic, and chock full of potential security issues. At the very least, spawning a process per request is a DOS attack waiting to happen, even if the code were immaculate.
  - poizan42 9y ago
    Classic CGI is not the best performing interface, yes. But there's a big difference in launching a complete interpreter for every request, and running a small purpose-built native program. And remember that people did manage the former 20 years ago, sites like Slashdot were running CGI Perl scripts back then. I'm not sure about the "chock full of potential security issues". You have to be careful with trusting environment variables as the Bash guys learned, but I don't know what else there is that is specific to CGI.
utopcell 9y ago
Using CGI is silly and slow, for all but the simplest, stateless servers. If one wishes to avoid the overhead of learning a new framework, at least FastCGI should be considered. A relevant (but dated) discussion about web frameworks in C++ can be found in [1]. I am personally a big fan of CROW [2] and have used it many times in the past. [1] https://softwareengineering.stackexchange.com/questions/53624/can-c-be-used-as-a-server-side-web-development-language https://softwareengineering.stackexchange.com/questions/5362... [2] https://github.com/ipkn/crow/blob/master/README.md https://github.com/ipkn/crow/blob/master/README.md
- faragon 9y ago
  +1, FastCGI is the way to go for web services in C/C++: not only because cause of avoiding to spawn a process for each request, but because of having web services state in memory. Also, for avoiding heap fragmentation in long lived processes I recommend avoiding the STL library, and avoid using C++ strings, too.
- chubot 9y ago
  CGI isn't slow -- starting interpreters is slow. Starting Python or Ruby can easily be 1000x more expensive than starting a process in C, which takes MICROSECONDS, not hundreds of milliseconds. See this 7 year old message by Richard Hipp (of sqlite): https://www.mail-archive.com/fossil-users@lists.fossil-scm.org/msg02065.html https://www.mail-archive.com/fossil-users@lists.fossil-scm.o... https://news.ycombinator.com/item?id=3036124 https://news.ycombinator.com/item?id=3036124 This server takes over a quarter million requests per day, 10GB of traffic/day, and it does so using less than 3% of of the CPU on a virtual machine that is a 1/20th slice of a real server.
  - goldenkey 9y ago
    People just throw around qualifier attacks these days without thinking about the reality of modern processing power and what is really overoptimization. Just because CGI is slow-er- does not make it slow. So many hours are wasted on overoptimization, myself guilty of it - simply because of OCD type tendencies. I hope when I am finally on my deathbed I am not picky about the color of the sheets...
z92 9y ago
I wrote my blog site in C. Runs as CGI and works just as fast as other tech stacks, say PHP. C has very low startup time compare to say Java. And process fork-exec isn't as heavy weight under Linux as in Windows.
- pjmlp 9y ago
  Java can be C like when compiled into native code, OpenJDK isn't the only JVM around.
kelvin0 9y ago
Building parts of a web site backend in C++, maybe. Anything else with the current state of technology seems futile for a production environment.
degenerate 9y ago
What's with all the weird spam at the bottom of these comments? Someone seriously loves rust.
bsenftner 9y ago
Interested parties desiring production quality security and significanlty better performance than CGI, check out the C++11 library Restbed https://github.com/corvusoft/restbed https://github.com/corvusoft/restbed Restbed replaces Apache, or put another way puts the web server inside your application, so your C++ app is its own server. It is easy to create REST APIs with executable as small as 100K, and that is all you need - no Apache or Nginx other web server needed. I have created a fairly sophisticated facial recognition REST API that host itself, only occupies 500K and can run circles around pretty much anything - while running on a $99 Intel Compute Stick. I've created web sites and servers and web APIs in a most of the fashionable web best practices, and I gotta say Restbed blows everything away.
- bjornlouser 9y ago
  Looks great but it's AGPL unless you buy a license.
  - bsenftner 9y ago
    Sometimes, software is worth paying for...
awiesenhofer 9y ago
Reminds me of the BCHS-Stack: BSD, C, httpd, SQLite. https://learnbchs.org/ https://learnbchs.org/ I am still unsure if its satire or not.
bitoneill 9y ago
UTF-8 handling is a big reason I prefer a language like Python 3 or Go over C++ for the web.
byuu 9y ago
I run https://byuu.org https://byuu.org using C++. Not just for page generation, but also for the server itself. It's all a single package, so no CGI is involved. Although I do use nginx as an HTTP->HTTPS proxy because TLS is scary. It's handled being linked on the front page of a few major sites with no issues. In my case, I just prefer coding in that language over PHP et al. It's on a $2.50/mo VPS and I can spawn a new instance in five minutes if need be. Every memory access (for strings, vectors, etc) go through containers with bounds checking. The server/webapp itself runs as its own unprivileged user. If the server crashes, it'll stay offline and give me a core dump, which should let me find and fix the bug in my library. The code's open, too: https://gitlab.com/higan/higan/blob/master/nall/http/server.hpp https://gitlab.com/higan/higan/blob/master/nall/http/server.... It's certainly not 100% perfect security, but what really is? Between Heartbleed, Meltdown, Spectre, weekly Wordpress exploits, etc ... I don't think the risk is particularly higher. (aside: the forum runs on PHP on another VPS instance; separation of security concerns.)
- felipellrocha 9y ago
  I too like to dabble in masochism
  - byuu 9y ago
    I also write my own cryptography implementations: https://gitlab.com/higan/higan/blob/master/nall/elliptic-curve/ed25519.hpp https://gitlab.com/higan/higan/blob/master/nall/elliptic-cur... It's fun. We learn and better ourselves by making mistakes. My idols are the folks breaking through the security of the Switch et al. They had to learn somewhere: by doing things everyone else told them not to. Don't worry, I would never use this stuff in production at a company.
    - daeken 9y ago
      As someone who's been helping lead the charge on Switch hacking, you're one of my idols, haha. Come join us! You would fit in well.
- jchw 9y ago
jcelerier 9y ago
Cutelyst is a nice C++ web server with a much better api imho: https://cutelyst.org/ https://cutelyst.org/

95 points by daftpanda 9y ago

Just FO with your c++ and stupid article. I've repeated this 1000 times and will repeat again, there's no point in using c++ in 2018 unless you want to be a moron :)

marmaduke 9y ago

I was expecting something like Wt (https://www.webtoolkit.eu/wt https://www.webtoolkit.eu/wt)

julienfr112 9y ago
I had good experience with WT too.
stargrazer 9y ago
I would suggest/recommend this as well.

happy_rust44 9y ago

why not use rust? do you want to bring all security vulnerabilities to the internet too? Man these c++ guys haven't learnt a thing from recent vuln facepalm

mfontani 9y ago

This brings me back... I was doing this exact sort of stuff at the turn of the century, although admittedly in C - not C++ - and using/linking to the Delphi CGI library. CGI in 2018 seems a bit passé...

floatboth 9y ago
Actually, this new hip function-as-a-service thing feels a lot like CGI/inetd… well, at least in terms of not keeping the server process up all the time, only when it's used. To combine "only running when necessary" and "not restarting for every request when there's a lot of requests", I made a thing: https://github.com/myfreeweb/soad https://github.com/myfreeweb/soad — little wrapper listens on a socket, spawns your server with the socket passed in, terminates the server when there were no new connections in a while, rinse, repeat.
- z92 9y ago
  You can check inetd which does exactly that and comes preinstalled and pre activated with Linux installations. Or at lest it was common once upon a time. Don't know if it still is. https://en.wikipedia.org/wiki/Inetd https://en.wikipedia.org/wiki/Inetd

allover 9y ago

Am I right in thinking the main reason not to do this is memory safety (as demonstrated by Cloudbleed)?

zebra_cross21 9y ago
yes you are! Just imagine websites leaking other people's credentials to hackers because someone was using an undefined language haha!!
nkozyra 9y ago
That's part of what I'd argue is the main argument against: not reinventing the wheel. The only argument for is experimenting. These are all toy examples. I'd argue that through CGI it won't even be more performant than opcode cached interpreted languages.

zebra_cross21 9y ago

Just use rust man :| why do you want to bring all your security vulnerabilities and undefined behaviors to web?

emerged 9y ago
Might want to integrate an existing C++ code base into a server without developing an API or IPC in between the two. The security issues would be similar in either case and this would be much quicker to develop.
- yodon 9y ago
  > Might want to integrate an existing C++ code base into a server without developing an API or IPC in between the two. Or perhaps you might want to use a belt sander to refinish your table without removing the tablecloth from the table first. Not all the things one “might want to do” are good ideas, even if there’s a wikihow on best ways to do them. C++ is a great language but it’s a very hard language to wield correctly. The odds there is an exploitable buffer overflow or injection attack buried deep in some part of the code are simply too high compared to memory managed languages with standard libraries designed from the ground up for web-facing applications.
- matthewmacleod 9y ago
  this would be much quicker to develop. There is almost literally no chance that this is the case. The amount of pointless boilerplate code that you'd have to write would be many, many, many times in excess of a thin API layer.
  - contrarian_ 9y ago
    How do you suggest writing a thin API layer to expose an interactive real-time stream consumed over WebSocket?
bcjpjk 9y ago
Rust would be equally unsuitable to this task. Web development in C++ or Rust? Why? There may be some advantages to writing a middle tier application server in either of these languages, but using a system language to manage a web front-end is effectively like using a hatchet to shave. Sure, the hatchet is faster at cutting wood than a safety razor, and if one is careful, it could be used to remove stubble, but chances are that one is not clearly thinking about the problem at hand to suggest such a tool.

Kenji 9y ago

> Is This Even Possible? Why the hell shouldn't it be possible? C++ powers most of the stuff under the hood. The higher level languages like PHP are just sugar on top.

godbolt_com 9y ago

Every programmer who has ever written c++ knows the worst thing to do in 2018 would be to bring c++ to web. All our operating systems are plagued with undefined behaviors and buffer overflows and what not! Let's not use c++ anymore, there are many better alternatives for us :)

billconan 9y ago

I wrote a c++/Qt web framework as a hobby. https://github.com/shi-yan/Swiftly https://github.com/shi-yan/Swiftly

xiphias 9y ago

Writing C++ so that you slow it down by CGI? This looks like an example of how not to do things. Did the author really benchmark if optimized PHP environment is not faster than his solution?

giancarlostoro 9y ago

Its always interesting to see C++ but as someone else mentioned I expected to see Wt. If I want nearest to C++ speeds I rather go with D (using vibe.d) or Rust. C++ isn't my area of expertise though but those two other languages are years more approachable for me personally. Not saying I could never do C++ though. I know OkCupid is C++ using Wt iirc. I wish they'd give D a try or Rust to see how much more productive they become.

bcjpjk 9y ago
Why would you assume that D or Rust would be make developers more productive? If the developer already knows C++, then switching to D or Rust would make the developer significantly less productive over six months to a year, after which, the developer would likely be just as productive as he/she was when writing C++. Languages are not panaceas. Rust and D are both hard languages, as is C++. Selecting one of these only makes sense if the application warrants it. Each have advantages and disadvantages. I don't really think any of them are suited to web development, but claiming that D or Rust would be a more productive web development language than C++ seems equally silly to seriously considering C++ as a web development language.
- jordigh 9y ago
  > Why would you assume that D or Rust would be make developers more productive? If the developer already knows C++, then switching to D Because D is very obviously C++ but better. Rust isn't, though. But D, down to the very name, has lots of things that appeal to C++ users. It has advanced metaprogramming, is multiparadigm, it compiles down to machine code, and has very similar syntax to C++. D has had other influences, but it is written by C++ compiler writers who think they can do better than C++. I say this as someone raised on C++ and who is now trying D. It is a very natural progression to make, if you're inclined to try something new. Furthermore, Vibe.d is kind of a burgeoning "killer app" for D. D's package manager, for example, was originally made for Vibe.d. This isn't the only way in which Vibe.d has influenced D development. Vibe.d is one of the most popular D libraries. It's the only D library I know that has its own published book, https://dlang.org/blog/2017/09/13/the-making-of-d-web-development/ https://dlang.org/blog/2017/09/13/the-making-of-d-web-develo...

hild_for_me 9y ago

Use RUST! The reason that C++ sucks is that it is a FAUX object-oriented language. Many things that you CAN do with an object-oriented language are impossible with C++ (unless you like hackery... no, I don't like hackery). The reason is purely about runtime speed. At the time that C++ was designed, processors were horribly slow (compared to today's). OOP runtimes were dreadful. So all of the work was put in at compile-time in order to speed up run-time. Except for one thing. It meant that it was no longer OOP but pseudo-OOP. It kinda-quacked like a duck, kinda-looked like a duck, but really wasn't a duck at all. For example, one aspect that was ripped from the hands of the developer was the ability to store the address to a function in a variable. Pretty damn useful. You can't do that in C++. There are HACKS to do it, but natively, the language can't. It is this "can't" that makes the language so bad. Sure, you might think "I don't need to store an address to a function in a variable" but try to build GUI API's without that - it's a PITA. So much so, that Qt uses a preprocessor to handle things that C++ can't do. Wow. Now we're having to write preprocessors to get over stuff the language is incapable of handling. I've written a lot of C++ code. There are parts of C++ I like. But for the most part, it is a broken language from the start. It is highly flawed. No one spent ANY time thinking through the problems with ctors or dtors (yeah, they said they did, but they didn't). It's a bad, broken, language

wtfcpp 9y ago

Why not try rust? Its faster than c++ and comes with absolutely no disadvantages... Now you might ask what are the reasons C++ is considered bad? Probably easiest to compare C++ with C. C was a beautifully designed language. The features of the C language were added with purpose. They were intended to solve a real problem and solve that problem they did. Simple arithmetic with promotion. Automatic register allocation with a portable (between compilers) ABI. A simple-but-handy preprocessor. And so on. C is also a lean language: a single person can feasibly write a C compiler in a relatively short time (tinycc is a C99-compliant C compiler written in just 65kLOC of C!). C set out to achieve a clear goal and it achieved its goal. Thanks to the cleanness of C lots of quality compilers came on the market quickly and even decent OSS solutions were available early on. In contrast, C++ never had a clear goal. The features of C++ were added almost at random. Stroustrup's original idea was essentially "C is cool and OOP is cool so let's bolt OOP onto C". Retrospectively, OOP was massively overhyped and is the wrong tool for the job for most of the people most of the time. Half of the GoF design patterns just emulate idioms from functional programming. Real OOP languages like Smalltalk and IO express many useful things that C++ cannot. The feature that C needed most was perhaps parametric polymorphism (aka generics in Java and C#, first seen in ML in the late 1970s) but instead of that C++ got templates that weren't designed to solve any particular problem but rather to kind of solve several completely unrelated problems (e.g. generics and metaprogramming). Someone actually discovered by accident that C++ templates are Turing complete and they wrote and published a program that computed prime numbers at compile time. Wow. A remarkable observation that led to decades of template abuse where people used templates to solve problems much better solved by other pre-existing solutions such Lisp macros and ML polymorphism. Worse, this abuse led to even more language features being piled on top, like template partial specialization. The massive incidental complexity in C++ made it almost impossible to write a working compiler. For example, it remains extremely difficult to write a parser for the C++ language. The syntax also has horrible aspects like List<Set<int>> being interpreted as logical shift right. None of the original C++ compilers were reliable. During my PhD in 2000-2004 I was still stumbling upon dozens of bugs in C++ compilers from GNU, Intel and SGI. Only after two decades did we start to see solid C++ compilers (by which time C++ was in decline in industry due to Java and C#). C++ is said to be fast but the reality is that C++ is essentially only fast when you write C-like code and even then it is only fast for certain kinds of programs. Due to the "you don't pay for what you don't use" attitude, C++ is generally inefficient. RAII injects lots of unnecessary function calls at the end of scope, sometimes even expensive virtual calls. These calls often require data that would otherwise be dead so the data are kept alive, increasing register pressure and spilling and decreasing performance. The C++ exception mechanism is very inefficient (~6x slower than OCaml) because it unwinds the stack frame by frame calling destructors rather than long jumping. Allocation with new and delete is slow compared to a modern garbage collector so people are encouraged to use STL collections but these pre-allocate huge blocks of memory in comparison so you've lost the memory-efficiency of C and then you are advised to write your own STL allocator which is no better than using C in the first place. One of the main long-standing advantages of C over modern languages is the unpredictable latency incurred by garbage collectors. C++ offers the worst of both worlds by not having a garbage collector (making it impossible to leverage useful concepts like purely functional data structures properly) but it encourages all destructors to avalanche so you get unbounded pause times (worse than any production GC). Although templates are abused for metaprogramming they are very poor at it and C++ has no real support for metaprogramming. For example, you cannot write an efficient portable regular expression library in C++ because there is no way to do run-time code generation and compilation as you can in Java, C# and languages dating back to Lisp (1960). So while Java and C# have had regular expressions in their standard libraries for well over 10 years, C++ only just got them and they are slow. C++ is so complicated that even world experts make rookie mistakes with it. Herb Sutter works for Microsoft and sits on the C++ standards committee where he influences the future of C++. In a lecture he gave his favorite 10-line C++ program, a thread-safe object cache. Someone pointed out that it leaks memory (Herb Sutter's favorite C++ 10-liner has a memory management bug). My personal feeling is that the new Rust programming language is what C++ should have been. It has useful known features like generics, discriminated unions and pattern matching and useful new features like memory safety without garbage collection.

mproud 9y ago

You can build a website with any language… I mean, sometimes it’s nice to go back to the basics, but aren’t there better packages and frameworks written in C++ to handle the job?

rusky123 9y ago

CapacitorSet 9y ago

tl;dr: CGI.

cpp__guru 9y ago

I'm gonna tell you from 30 years of experience, c++ aint gonna survive any longer child. So why not try rust? Its faster than c++ and comes with absolutely no disadvantages... Now you might ask what are the reasons C++ is considered bad? Probably easiest to compare C++ with C. C was a beautifully designed language. The features of the C language were added with purpose. They were intended to solve a real problem and solve that problem they did. Simple arithmetic with promotion. Automatic register allocation with a portable (between compilers) ABI. A simple-but-handy preprocessor. And so on. C is also a lean language: a single person can feasibly write a C compiler in a relatively short time (tinycc is a C99-compliant C compiler written in just 65kLOC of C!). C set out to achieve a clear goal and it achieved its goal. Thanks to the cleanness of C lots of quality compilers came on the market quickly and even decent OSS solutions were available early on. In contrast, C++ never had a clear goal. The features of C++ were added almost at random. Stroustrup's original idea was essentially "C is cool and OOP is cool so let's bolt OOP onto C". Retrospectively, OOP was massively overhyped and is the wrong tool for the job for most of the people most of the time. Half of the GoF design patterns just emulate idioms from functional programming. Real OOP languages like Smalltalk and IO express many useful things that C++ cannot. The feature that C needed most was perhaps parametric polymorphism (aka generics in Java and C#, first seen in ML in the late 1970s) but instead of that C++ got templates that weren't designed to solve any particular problem but rather to kind of solve several completely unrelated problems (e.g. generics and metaprogramming). Someone actually discovered by accident that C++ templates are Turing complete and they wrote and published a program that computed prime numbers at compile time. Wow. A remarkable observation that led to decades of template abuse where people used templates to solve problems much better solved by other pre-existing solutions such Lisp macros and ML polymorphism. Worse, this abuse led to even more language features being piled on top, like template partial specialization. The massive incidental complexity in C++ made it almost impossible to write a working compiler. For example, it remains extremely difficult to write a parser for the C++ language. The syntax also has horrible aspects like List<Set<int>> being interpreted as logical shift right. None of the original C++ compilers were reliable. During my PhD in 2000-2004 I was still stumbling upon dozens of bugs in C++ compilers from GNU, Intel and SGI. Only after two decades did we start to see solid C++ compilers (by which time C++ was in decline in industry due to Java and C#). C++ is said to be fast but the reality is that C++ is essentially only fast when you write C-like code and even then it is only fast for certain kinds of programs. Due to the "you don't pay for what you don't use" attitude, C++ is generally inefficient. RAII injects lots of unnecessary function calls at the end of scope, sometimes even expensive virtual calls. These calls often require data that would otherwise be dead so the data are kept alive, increasing register pressure and spilling and decreasing performance. The C++ exception mechanism is very inefficient (~6x slower than OCaml) because it unwinds the stack frame by frame calling destructors rather than long jumping. Allocation with new and delete is slow compared to a modern garbage collector so people are encouraged to use STL collections but these pre-allocate huge blocks of memory in comparison so you've lost the memory-efficiency of C and then you are advised to write your own STL allocator which is no better than using C in the first place. One of the main long-standing advantages of C over modern languages is the unpredictable latency incurred by garbage collectors. C++ offers the worst of both worlds by not having a garbage collector (making it impossible to leverage useful concepts like purely functional data structures properly) but it encourages all destructors to avalanche so you get unbounded pause times (worse than any production GC). Although templates are abused for metaprogramming they are very poor at it and C++ has no real support for metaprogramming. For example, you cannot write an efficient portable regular expression library in C++ because there is no way to do run-time code generation and compilation as you can in Java, C# and languages dating back to Lisp (1960). So while Java and C# have had regular expressions in their standard libraries for well over 10 years, C++ only just got them and they are slow. C++ is so complicated that even world experts make rookie mistakes with it. Herb Sutter works for Microsoft and sits on the C++ standards committee where he influences the future of C++. In a lecture he gave his favorite 10-line C++ program, a thread-safe object cache. Someone pointed out that it leaks memory (Herb Sutter's favorite C++ 10-liner has a memory management bug). My personal feeling is that the new Rust programming language is what C++ should have been. It has useful known features like generics, discriminated unions and pattern matching and useful new features like memory safety without garbage collection.

stargrazer 9y ago

Some other libraries I have seen for http protocol based applications: https://github.com/Qihoo360/evpp https://github.com/Qihoo360/evpp - network library for developing high performance network services in TCP/UDP/HTTP protocols https://github.com/rep-movsd/see-phit https://github.com/rep-movsd/see-phit - C++ HTML template engine that uses compile time HTML parsing https://github.com/boostorg/beast https://github.com/boostorg/beast - HTTP and WebSocket built on Boost.Asio in C++11 https://github.com/emweb/wt https://github.com/emweb/wt - Wt, C++ Web Toolkit

kakwa_ 9y ago
Personally, I've used: https://github.com/civetweb/civetweb https://github.com/civetweb/civetweb (for implementing an RFC 3161 (crypto timestamp) service. It's a fork of https://github.com/cesanta/mongoose https://github.com/cesanta/mongoose (The Civetweb fork exists due to Mongoose license switch from MIT to GPLv2)

gumby 9y ago

> I know it sounds strange, and perhaps even an exercise in novel futility, but it isn’t. Oh come on, C++ is a systems programming language and certainly can handle this, so “futility” seems over the top. Hell, you can write cgi handlers in assembly. Around 94 I wrote Cygnus’ web interface (and then cron job too) to our big system in sh. Sure, I wouldn’t make the same choice today, but it’s hardly absurd.

sddfd 9y ago

Bevor I'd use C++ I'd take a hard look at Go, figure out whether I really need C++ performance, or whether Go is just good enough. Go is rather performant and in contrast to C++ memory safe.

pleasecalllater 9y ago
If you say that C++ is not memory safe you really don't know the modern C++. Of course you can use only `void *` everywhere... but you can also write your software in a totally different way. My C++ code has no pointers, just objects, which are automatically destroyed when I want to. The nice feature is that I know when the destructor is called, so the object will clear itself in a very nice way.
- checker659 9y ago
  You're just wasting your energy man. People still think we live in the C++98 era.
- nercury 9y ago
  It's futile battle though to achieve both performance and safety in C++: as an example, safety requires avoiding moves, using reference counting, while achieving performance means avoiding copies and passing occasional references around, among other things. That's why advertising C++ solution as fast does not work well with "but C++ can be safe too!".
  - bcjpjk 9y ago
    Moves can be safe, and copies can be dangerous. C++ is a language that can be used like a sawed-off shotgun propped against a developer's foot, and with a hair trigger. Granted, it does not _have_ to be used this way, but it can be. A good developer can be "safe by default" and can use profile-directed optimization to speed up areas that are performance critical. A great developer can build proofs that such performance improvements maintain safety guarantees. For the average developer, following modern C++ development practices creates code on par with other languages in terms of both safety and performance. For most languages, a lot can be done in terms of optimization, profiling, and security. Even in higher-level languages, an FFI is available to rewrite critical portions of code in a lower level language for performance improvements. Careful attention to detail can provide critical performance improvements in any language without compromising on safety. Getting there requires model checking or formal methods, but that is also becoming more of a part of modern development practices.

deleted 9y ago

[deleted]

booleandilemma 9y ago

Reminds me of this: https://m.imgur.com/r/ProgrammerHumor/INBvStO https://m.imgur.com/r/ProgrammerHumor/INBvStO

fuball63 9y ago

I'm in the early stages of a FaaS platform that uses CGI for the functions. As such, I have been collecting articles about general CGI development, and have them listed in my docs. If anyone is interested in writing large scale CGI apps (CGI is popping up a lot around here lately), these are some good resources: https://bigcgi.com/docs https://bigcgi.com/docs

ddorian43 9y ago
Isn't cgi slow ? Don't you need something like fast-cgi (which lambda does I think) ?
- fuball63 9y ago
  CGI is slow because of the spin up time for individual processes for each request. FastCGI is fast because they run as one long running process that handles multiple requests. While plain CGI is a slower, the advantage is that you don't have long running and potentially idle processes for low traffic periods, and process isolation is a little security boost. I chose to have a slightly slower startup time, which hopefully remain constant in a load balanced cluster, to gain the advantages above.
  - dfox 9y ago
    Also the spinup time is considerably larger problem for various interpreters and virtual machines than for native code binary. I would even expect that you can write non-trivial CGI application whose startup time is smaller than the additional overhead from parsing of the FastCGI protocol.

xaduha 9y ago

If you want to use something like that for web, then use http://websocketd.com http://websocketd.com. There's no need to generate html on the server, unless you really don't want to touch JS at all.

dahart 9y ago

> In this article, I’ll explain how you can use C++ to develop a website and some concrete reasons why you might consider doing so. I only saw one reason: performance. Did I miss some? Do people have other good use cases that justify paying the dev cost of using C++ for a web server? I'd guess with caching and a decent backend, it would be fairly hard to demonstrate a true need for performance that requires C++, but I'm sure there are a few demanding applications out there that need it. Since a web page's throughput is usually network bottlenecked and not CPU bound, I'm curious (just for fun) what the max possible performance benefit of going C++ is, especially behind a CGI interface? There's probably a small latency benefit at all times, and I'd guess there's a throughput benefit that is only visible if you're doing more than a few thousand requests per second..?

pjmlp 9y ago
You missed IoT. Preferably one would use some kind of network protocol with a native management console, but nowadays it is fashionable to have a mini webserver exposing a Web UI instead.
- dahart 9y ago
  > You missed IoT. I did? I just read the article again, and I don't see any mention of IOT or small or embedded devices aside from Docker, can you point me to what you saw? The article is assuming Apache is running...
  - pjmlp 9y ago
    I was replying to your question, which I should have quoted. > Do people have other good use cases that justify paying the dev cost of using C++ for a web server?
    - goldenkey 9y ago
      Most router admin panels are probably written in C++

taylorking 9y ago

You can do this with libboost with this https://github.com/ipkn/crow https://github.com/ipkn/crow

flatline 9y ago

Pion[0] is a fairly robust and well-written HTTP server implementation in C++. You can spin up a server very quickly and reverse proxy through Apache or Nginx. Microsoft has a cross-platform offering of some sort in the works using C++11, now I don’t remember the name but I think Herb Sutter has a write-up in it from a couple years ago. It’s definitely possible to write modern web applications in C++, I feel like the cgi route is pretty old school. [0] https://github.com/splunk/pion https://github.com/splunk/pion

zura 9y ago
> Microsoft has a cross-platform offering of some sort in the works using C++11 Casablanca, but I'm not sure how active is the project nowadays.
- RotsiserMho 9y ago
  It's called the C++ REST SDK (https://github.com/Microsoft/cpprestsdk https://github.com/Microsoft/cpprestsdk) now and is fairly active. I've used it client-side and I've really enjoyed it.

chubot 9y ago

Really? Escaping, people! This code isn't practical or useful; it's dangerous and sloppy. cout << "<body>\n"; ... cout << getenv("QUERY_STRING"); cout << "</body>\n"; FWIW I wrote an article about HTML escaping and shell here: http://www.oilshell.org/blog/2017/09/19.html http://www.oilshell.org/blog/2017/09/19.html Followup: http://www.oilshell.org/blog/2017/09/29.html http://www.oilshell.org/blog/2017/09/29.html Also if you want to use a native language for web sites (which I don't), Go is a better choice, as the standard library has html/template which protects you from naive injections: https://golang.org/pkg/html/template/ https://golang.org/pkg/html/template/

entropie 9y ago
> In this article, I’ll explain how you can use C++ to develop a website and some concrete reasons why you might consider doing so. I dont find any reasons at all. That article ist just a clickbait nonsens.
- carterehsmith 9y ago
  "Building a Website with C++" "Is This Even Possible?" We can just "flag" articles like this one.
flatline 9y ago
CTemplate is a not-unreasonable option for C++ as well.
bcjpjk 9y ago
Yeah... this example code is bad. Not to mention that CGI is slow, problematic, and chock full of potential security issues. At the very least, spawning a process per request is a DOS attack waiting to happen, even if the code were immaculate.
- poizan42 9y ago
  Classic CGI is not the best performing interface, yes. But there's a big difference in launching a complete interpreter for every request, and running a small purpose-built native program. And remember that people did manage the former 20 years ago, sites like Slashdot were running CGI Perl scripts back then. I'm not sure about the "chock full of potential security issues". You have to be careful with trusting environment variables as the Bash guys learned, but I don't know what else there is that is specific to CGI.

utopcell 9y ago

Using CGI is silly and slow, for all but the simplest, stateless servers. If one wishes to avoid the overhead of learning a new framework, at least FastCGI should be considered. A relevant (but dated) discussion about web frameworks in C++ can be found in [1]. I am personally a big fan of CROW [2] and have used it many times in the past. [1] https://softwareengineering.stackexchange.com/questions/53624/can-c-be-used-as-a-server-side-web-development-language https://softwareengineering.stackexchange.com/questions/5362... [2] https://github.com/ipkn/crow/blob/master/README.md https://github.com/ipkn/crow/blob/master/README.md

faragon 9y ago
+1, FastCGI is the way to go for web services in C/C++: not only because cause of avoiding to spawn a process for each request, but because of having web services state in memory. Also, for avoiding heap fragmentation in long lived processes I recommend avoiding the STL library, and avoid using C++ strings, too.
chubot 9y ago
CGI isn't slow -- starting interpreters is slow. Starting Python or Ruby can easily be 1000x more expensive than starting a process in C, which takes MICROSECONDS, not hundreds of milliseconds. See this 7 year old message by Richard Hipp (of sqlite): https://www.mail-archive.com/fossil-users@lists.fossil-scm.org/msg02065.html https://www.mail-archive.com/fossil-users@lists.fossil-scm.o... https://news.ycombinator.com/item?id=3036124 https://news.ycombinator.com/item?id=3036124 This server takes over a quarter million requests per day, 10GB of traffic/day, and it does so using less than 3% of of the CPU on a virtual machine that is a 1/20th slice of a real server.
- goldenkey 9y ago
  People just throw around qualifier attacks these days without thinking about the reality of modern processing power and what is really overoptimization. Just because CGI is slow-er- does not make it slow. So many hours are wasted on overoptimization, myself guilty of it - simply because of OCD type tendencies. I hope when I am finally on my deathbed I am not picky about the color of the sheets...

z92 9y ago

I wrote my blog site in C. Runs as CGI and works just as fast as other tech stacks, say PHP. C has very low startup time compare to say Java. And process fork-exec isn't as heavy weight under Linux as in Windows.

pjmlp 9y ago
Java can be C like when compiled into native code, OpenJDK isn't the only JVM around.

kelvin0 9y ago

Building parts of a web site backend in C++, maybe. Anything else with the current state of technology seems futile for a production environment.

degenerate 9y ago

What's with all the weird spam at the bottom of these comments? Someone seriously loves rust.

bsenftner 9y ago

Interested parties desiring production quality security and significanlty better performance than CGI, check out the C++11 library Restbed https://github.com/corvusoft/restbed https://github.com/corvusoft/restbed Restbed replaces Apache, or put another way puts the web server inside your application, so your C++ app is its own server. It is easy to create REST APIs with executable as small as 100K, and that is all you need - no Apache or Nginx other web server needed. I have created a fairly sophisticated facial recognition REST API that host itself, only occupies 500K and can run circles around pretty much anything - while running on a $99 Intel Compute Stick. I've created web sites and servers and web APIs in a most of the fashionable web best practices, and I gotta say Restbed blows everything away.

bjornlouser 9y ago
Looks great but it's AGPL unless you buy a license.
- bsenftner 9y ago
  Sometimes, software is worth paying for...

awiesenhofer 9y ago

Reminds me of the BCHS-Stack: BSD, C, httpd, SQLite. https://learnbchs.org/ https://learnbchs.org/ I am still unsure if its satire or not.

bitoneill 9y ago

UTF-8 handling is a big reason I prefer a language like Python 3 or Go over C++ for the web.

byuu 9y ago

I run https://byuu.org https://byuu.org using C++. Not just for page generation, but also for the server itself. It's all a single package, so no CGI is involved. Although I do use nginx as an HTTP->HTTPS proxy because TLS is scary. It's handled being linked on the front page of a few major sites with no issues. In my case, I just prefer coding in that language over PHP et al. It's on a $2.50/mo VPS and I can spawn a new instance in five minutes if need be. Every memory access (for strings, vectors, etc) go through containers with bounds checking. The server/webapp itself runs as its own unprivileged user. If the server crashes, it'll stay offline and give me a core dump, which should let me find and fix the bug in my library. The code's open, too: https://gitlab.com/higan/higan/blob/master/nall/http/server.hpp https://gitlab.com/higan/higan/blob/master/nall/http/server.... It's certainly not 100% perfect security, but what really is? Between Heartbleed, Meltdown, Spectre, weekly Wordpress exploits, etc ... I don't think the risk is particularly higher. (aside: the forum runs on PHP on another VPS instance; separation of security concerns.)

felipellrocha 9y ago
I too like to dabble in masochism
- byuu 9y ago
  I also write my own cryptography implementations: https://gitlab.com/higan/higan/blob/master/nall/elliptic-curve/ed25519.hpp https://gitlab.com/higan/higan/blob/master/nall/elliptic-cur... It's fun. We learn and better ourselves by making mistakes. My idols are the folks breaking through the security of the Switch et al. They had to learn somewhere: by doing things everyone else told them not to. Don't worry, I would never use this stuff in production at a company.
  - daeken 9y ago
    As someone who's been helping lead the charge on Switch hacking, you're one of my idols, haha. Come join us! You would fit in well.
jchw 9y ago

jcelerier 9y ago

Cutelyst is a nice C++ web server with a much better api imho: https://cutelyst.org/ https://cutelyst.org/