13 ms·

OpenBSD, C, httpd and SQLite – Web App stack

178 points by dhruvkar 8y ago

psergeant 8y ago
> because the open internet is damn inhospitable. And the answer to this is writing text-processing functions that you expose to the world, in C... skeptical face
- simion314 8y ago
  Many of the high level languages/frameworks call a C library or a C kernel or a C database
  - mvdwoord 8y ago
    Yes, in ways that were learned over many years, by many people. Roll some of your own crypto, while you're at it.
    - aneutron 8y ago
      Ain't nothing wrong with that /s What could possibly go wrong
    - simion314 8y ago
      What is your point? My point is that if you nodejs you still are running "unsafe" C somewhere. Also what is the point of calling out on projects that are not using "cool" languages? You don't agree with the developer choice that is OK, probably that developer does not agree with your choice and has other priorities and if is an open source project probably he wants also to have fun while coding it.
      - zeth___ 8y ago
        This isn't about cool this is about dangerous. C makes shooting yourself in the foot so easy and efficient it even asks for artillery support. The time and effort to secure a C program against malicious input is absolutely huge. It would be quicker to write a secure dsl that using raw C. Which brings us back to scripting languages that have that implemented already as a library you load to run your requests through.
        potta_coffee 8y ago
        C lovers are downvoting you but you're entirely right.
      - yorwba 8y ago
        The unsafe C in popular language runtimes has hopefully been written or at least reviewed by someone who knew what they were doing, and it presents a relatively controllable interface. Most people who write code in C are not that good at avoiding memory safety issues. The process is mostly to write some code, run it, then fix it until it doesn't crash immediately anymore. Have you ever been the first person to run valgrind on a codebase? Lots of uninitialized reads and use-after-free issues will be flagged, because they don't normally crash the program and therefore go undetected without using an additional checker. It can be fun to watch the error messages flow by, until you realize that now you have to file tickets for all of them. And some people won't even see the problem with those errors that don't crash the program, because potentially exploitable vulnerabilities are not as obviously bad as crashes.
        simion314 8y ago
        I agree, but this does not mean that some experienced developers can't have some fun creating some tools in C, they may even be less buggy and more performant then some of the other tools written in high level languages. Btw, I am not a C fan, in fact I think I have no favorite language, I use what I have to for the project
    - ke29bnf 8y ago
      Why did they also wrap them in new syntax and abstraction? Why not just build the ecosystem to do that and still have it all be “C”? Why not some fixes to the standard and update then old but useful code, and work on better compilers? This is what’s been confusing me for a while If you can write safe enough C for the core of an interpreted language, why not abstract that into tools and patterns that generate better, safer C and learn how to do that over the last 30 years Instead of JS and dozens of flavors, Python, ruby, lua... DRY right? My suspicion is “vanity projects generate a sense of novelty that’s easier to sell.” But if the OS and bulk of the stack are “C inside anyway” why the extra nonsense?
  - legulere 8y ago
    Most of the string manipulation and memory management happens in the safe high level languages in such cases.
  - IshKebab 8y ago
    Yes but they have well defined and well tested places where that happens. For example you could implement a string class in C++ using strlen, strdup etc. if you were feeling insane and it would probably be fine since you only use strdup once and then all the users of you class don't have to worry about getting it wrong. If you write in C you have to use strdup every time you copy a string and there's no way you get it right 1000 times.
    - tedunangst 8y ago
      It's pretty hard to get strdup wrong.
      - sunfish 8y ago
        Yet, it happens: https://nvd.nist.gov/vuln/detail/CVE-2017-14064 https://nvd.nist.gov/vuln/detail/CVE-2017-14064 https://nvd.nist.gov/vuln/detail/CVE-2015-3182 https://nvd.nist.gov/vuln/detail/CVE-2015-3182 https://nvd.nist.gov/vuln/detail/CVE-2017-13748 https://nvd.nist.gov/vuln/detail/CVE-2017-13748 etc.
        tedunangst 8y ago
        This is true. Although they did say "copy a string", not use strdup to copy a thing that is not a string. :)
        sunfish 8y ago
        Yes, that's one of the three CVE's I posted ;). You got me thinking about ways one could get strdup wrong: - input is not a string -> possible UB - input is a string, but the character encoding wasn't what you thought -> possible UB - input is a string, but it was the pointer-plus-length kind -> possible UB - input is modified by another thread -> possible UB - strdup called from within a signal handler -> possible UB - failure to handle error return values -> possible UB - failure to free the memory when it's no longer needed -> memory leak - freed the memory more than once -> possible UB - used the memory after freeing it -> possible UB I've personally seen several of these in real-world code.
  - zeth___ 8y ago
    And those c programs call binary files. Anyone who uses C is a hypster that just wants to use a cool language instead of of good old 1 and 0.
    - skolemtotem 8y ago
      > And those c programs call binary files. Uh... am I missing the joke? The C programs don't "call binary files", the C programs become the binary files through compilation.
      - zeth___ 8y ago
        >Uh... am I missing the joke? Yes, yes you are.
- kuon 8y ago
  We could argue that modern static analysis tools and the compiler itself are good at catching a lot of errors, and that high level languages have bugs too. C is a dangerous beast, but with good practices it isn't that dangerous. Of course you have to be extra careful when dealing with user content, like JSON payload, but many decoders in other languages are written in C. Rust is a good solution, but it isn't trivial to learn, and might not suite all situations. I think it's great to have a C solution like this.
  - zeth___ 8y ago
    When your messaging protocol is Turing complete you have no hope of a secure web server.
    - peterkelly 8y ago
      JSON is not Turing complete
  - gaius 8y ago
    C is a dangerous beast, but with good practices it isn't that dangerous. Of course you have to be extra careful when dealing with user content, like JSON payload, but many decoders in other languages are written in C. It isn't hard to build tools like Valgrind and AFL into your C workflow. I would take that over simply taking for granted that a higher-level language was secure just because it is interpreted. After all it's probably C under the hood anyway.
    - marmaduke 8y ago
      This is a good point: you can CI run tests under Valgrind with various sanitizers and -Wall -Wextra. In a small codebase with a few cores, one can compile and run a test suite faster than it takes for a Django app to start.
  - unrealhoang 8y ago
    I don’t think any non-gc language is trivial to learn, C also. Manual memory management is hard, and either you learn from the system (C way) or learn it upfront from the language (Rust way), it’s still the same amount of concept you have to digest to write practical software.
- yani 8y ago
  It says hipster-free which will imply to me that it is not for the typical startup developer
  - jeremyjh 8y ago
    Is there anyone other than hipsters consciously trying to avoid being a hipster?
    - 1_player 8y ago
      Exactly. Who would code a web app in 2018 in C? That's right, hipsters. Seasoned developers would use a tool more fit for the job, like Java, Python or even PHP. Seasoned hipsters would use Node, Clojure or Elixir.
      - chris_wot 8y ago
        Normally I would consider this to be an unhelpful comment, but actually in this case, you're right.
- potta_coffee 8y ago
  I'm 95% that the whole thing is an elaborate joke.
bitofhope 8y ago
I find the site a little tongue-in-cheek, but I genuinely like the ideas behind it. I honest-to-$DEITY prefer programming in C to any sort of Javascript. C is kinda hellish for large, complex projects, which is good. The world needs fewer large and complex websites. OpenBSD also provides very good security features that mitigate the inherent security challenges of writing C. pledge(2) is just a very good idea. I generally think websites should do their processing in the backend, whenever possible. Running code to generate the website should not be the user's problem. This also comes with the advantage of not being constrained to *Script languages. C is alright, but if you're of the defeatist camp who thinks writing C safely is impossible, you can adapt the BCHS philosophy just as well to C++, Rust, Go, D, Python, AWK, Common Lisp…
- rileymat2 8y ago
  C is also hellish for string processing. From memory management to buffer overflows to understanding the encoding types.
  - mpweiher 8y ago
    Objective-C with a reasonable Foundation is such a great language for this... It has essentially the predictability and simplicity of C, just with a minimal amount of dynamic binding to make it comfortable. And NSString variants tend to take care of string handling and encodings.
    - okket 8y ago
      At that level, you can just switch to the clang compiler based Swift language, which is much nicer/modern. And look, there are already Swift web frameworks like https://vapor.codes https://vapor.codes
      - gkya 8y ago
        I really dislike the Swift/Scala/Rust/Dart/Kotlin etc. style, heavy and centralised syntax. ObjC is not very beautiful, but it has an elegant way of combining composable primitives (functions and objects). The same kinda sorta goes for Perl too, which I think is a nicer alternative to C in this stack.
tannhaeuser 8y ago
I'm loving the spirit if not the snark, but it's still odd OpenBSD's httpd (not to be confused with Apache httpd) calls it's CGI gateway "slowcgi" (and kindof derides CGI programming). I mean, it being slow is entirely the fault of the O/S isn't it ?: And using C gets a whole level more challenging with long-running processes and async I/O because of manual memory management. Native CGI programming IMHO is best enjoyed with a reverse cache if you can help it, such as with Apache's mod_cache.
- notaplumber 8y ago
  It's slowcgi.. you know, as opposed to fastcgi. It's just a name. It was implemented so that httpd(8) didn't have to support executing CGI programs itself and could speak only FastCGI. You don't /have/ to use it, but it's safer. http://man.openbsd.org/slowcgi http://man.openbsd.org/slowcgi
  - tannhaeuser 8y ago
    I was referring to the release announcement back in 2014 or so which I'm unfortunately not able to find (there was more than a bit snarkiness towards CGI programming). I'm aware what FastCGI is ;) Btw. if you're interested in native HTTP I'd be looking into nghttp2 rather than FastCGI and OBSD's httpd. Edit: see also https://ef.gy/fastcgi-is-pointless https://ef.gy/fastcgi-is-pointless and https://news.ycombinator.com/item?id=9202039 https://news.ycombinator.com/item?id=9202039 (previous discussion of OBSD's httpd)
    - bigato 8y ago
      how can i trust a lib which still uses openssl in this day and age?
- ekr 8y ago
  It's slow because of its design, i.e. spawning a new process for each request; so it's not because of the OS.
  - 8y ago
notaplumber 8y ago
Important pieces of the puzzle are Kristaps' kcgi (perhaps kwebapp/ksql). https://kristaps.bsd.lv/kcgi/ https://kristaps.bsd.lv/kcgi/ And also OpenBSD pledge / "sandboxing" on other OSs https://man.openbsd.org/pledge https://man.openbsd.org/pledge https://learnbchs.org/pledge.html https://learnbchs.org/pledge.html https://kristaps.bsd.lv/kcgi/tutorial6.html https://kristaps.bsd.lv/kcgi/tutorial6.html
- krylon 8y ago
  I really hope other systems will adopt pledge. Of all the selective privilege dropping mechanisms I know of, pledge seems to be the least complicated to use.
  - pjmlp 8y ago
    Mojave has a new security aware runtime for its applications. Bringing sandboxing to all applications and requiring listing of entitlements and digital signing. Microsoft has decided if the apps don't come to the store, the store goes to the apps, and are merging Win32 with UWP sandboxing concepts via Windows containers and the new MSIX package format. Android sandboxing is still the most complicated one.
jmartrican 8y ago
Two points. Would be nice if there was an AMI on AWS for this stack. Second point. We do a lot of RESTful microservices. Which might be good for this in the sense that with C you would want to keep your code small (cause no classes and manual mem-management). But what people do not always appreciate at first about microservices is that you need to rely heavily on libraries (either custom or external like Spring Security) to handle cross cutting concerns, else you are writing the same code multiple times. Essentially if you write a peice of code that you expect will go on more than one microservice, then it should go into library. So my concern is how easily would it be to create custom libraries to deal with cross cutting concerns like logging, and security in this stack, AND does C ecosystem offer external libraries for dealing with these common concerns that a modern RESTful microservice would encounter?
- pjmlp 8y ago
  And most important how sure can one be that those libraries have been propely sanitized.
hellofunk 8y ago
I am seeing SQLite pop up more and more in articles that tout its effectiveness and simplicity for many use cases over popular alternatives like PostgreSQL. It has definitely persuaded me to consider it on future projects.
- gaius 8y ago
  SQLite is a beautiful little jewel! Every time I think "does it have X feature" it always delights me that it does! And the code is exemplary as well, you can learn loads from just reading it. If you don't need concurrent writers, then SQLite goes a very, very long way.
- dom96 8y ago
  Oh yeah. SQLite is incredibly versatile and for most web applications it's more than enough. The only pain point I have with it is that all data is stored as a string no matter the table schema types specified, this can lead to some bugs, but if you have a good library in your language for SQLite then it's not a problem.
  - hellofunk 8y ago
    I am currently working with a data set that is billions of rows and tens of GB. Will be interesting to see how SQLite handles it, which I plan to try. All of that in one DB file!
    - xyproto 8y ago
      Should be fine. SQLite is fast and capable.
    - dagw 8y ago
      The main place you might run into problems is if doing lots of simultaneous writes. As long you're mostly dealing with reads then it should work.
  - hellofunk 8y ago
    > all data is stored as a string no matter the table schema types specified The docs seem to suggest otherwise: > if a column is of type INTEGER and you try to insert a string into that column, SQLite will attempt to convert the string into an integer. If it can, it inserts the integer instead. From: https://www.sqlite.org/faq.html#q3 https://www.sqlite.org/faq.html#q3
reacharavindh 8y ago
As much as I align myself philosophically to most things this project stands for, I wouldn't trust myself to write public facing web applications in C. The same philosophy could still be held up while replacing the last components with a less dangerous language like Rust(with the trade off of developing complexity, and possibly giving up a bit of control). OpenBSD as a base operating system, running relayd and httpd to face the hostile web proxying for efficient services written in Rust would be my ideal choice. SQLite for most simple data store needs, and Postgres if the data management gets big enough that it might spill to another machine.
usgroup 8y ago
Lol, about 10 years ago I wrote a CGI framework in C. It was fun and the minimalist in me loves the lark but for productive work especially working with other people, opting for a stack with next to no abstraction is crazy. Put it this way; Would you invest in s startup intending to use this stack ? Can this stack ever be the result of pragmatic decision making? If you can genuinely answer yes to both in your use case , then why not ...
- stevekemp 8y ago
  People generally invest in startups because they believe the sales/customer numbers. Not because they pay attention to the implementation of every single component which is used by the company. That said OkCupid famously used a custom HTTP-server to power their site: https://github.com/OkCupid/okws https://github.com/OkCupid/okws
sbr464 8y ago
The example says no mysticism but is using at least 4 undeclared variables. I’m not a C developer so I’m sure I’m completely wrong, but where do pledge, puts, EXIT SUCCESS/FAILURE come from? I assume from importing stdlib etc, which probably give you additional variables to use, that you would need to know about explicitly. One thing I like about zeit.co’s micro server (js) was the argument about not using bodyparser and magically having res.body available, but using async/await and assigning it to a variable. This is popping up more with things like es module imports, render props in react, etc. They make it clear where variables come from and allow you to avoid stepping on existing variables. What other 10-100 variables can I step on potentially with global patterns as a new user?
- beefhash 8y ago
  > I’m not a C developer so I’m sure I’m completely wrong, but where do pledge, puts, EXIT SUCCESS/FAILURE come from? - pledge: unistd.h[1] - puts: stdio.h[2] - EXIT_SUCCESS and EXIT_FAILURE: stdlib.h[3] You can probably safely assume a C programmer is familiar with puts and EXIT_SUCCESS/EXIT_FAILURE and that an OpenBSD programmer has heard of pledge(2). [1] https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2 [2] ISO C11, § 7.21.7.9 no. 1; https://man.openbsd.org/puts.3 https://man.openbsd.org/puts.3 [3] ISO C11, § 7.22 no. 3
  - sbr464 8y ago
    Thanks for that info. I do need to learn C still.
- cpmouter 8y ago
  It's surprising to me that someone could be a programmer without knowing anything about C.
  - scandox 8y ago
    The best programmer in the world may never have even seen a computer for all we know.
ghapereira__ 8y ago
> "man pages and "-Wall -Wextra" are your new best friends" These guys are more likely friends with "-pedantic"
- bitofhope 8y ago
  And nothing wrong with that. Stricter compiler is a good thing if you don't need it to be laxer. My favourite flag in clang is -weverything. Everything I write in C I compile with it and fix whatever I reasonably can.
- kworker 8y ago
  I wonder if it can compile with -pedantic-errors That would be awesome.
alexhutcheson 8y ago
Doing anything on the web with a language that doesn’t have a string type seems like masochism.
- kizer 8y ago
  A character array seems like a natural way to me to represent a string of characters. But Unicode though...
  - deleted 8y ago
    [deleted]
  - fulafel 8y ago
    As C functions can't take arrays as arguments, you don't get very far this way.
    - kizer 8y ago
      ...you pass in a pointer to the first character. Arrays in C are simply contiguous spans of memory.
      - fulafel 8y ago
        Thid then has the problem that thr length is unknown, leading to well known problems.
        petee 8y ago
        Well if you wrote the array, or your program did, then you do know the length. Not a problem. Would it be nice if an array internally stored that? Sure. Does it? No. Is that a real problem? No, not really - its been solved and worked around for decades
    - petee 8y ago
      This is incorrect; a quick search with your first sentence will answer that
jokoon 8y ago
How will does it run on a raspberry pi?
- sgt 8y ago
  It should run just fine, but I haven't tested it myself. OpenBSD has support for the Raspberry Pi (BCM2837): https://www.openbsd.org/arm64.html https://www.openbsd.org/arm64.html
qwerty456127 8y ago
I can imagine an even more weird one: DOS, ASM, dBase... (;,;) > C is a straightforward Indeed, what can be more straightforward than manual memory management and pointer arithmetic...
hedora 8y ago
I suspect “unsafe” C leads to safer server side code when combined with a few, simple libraries. One issue that seems to fly over the head of “safe” high level language proponents are that you need to know what data types you are manipulating in order to write safe code. Also, language-level isolation is much harder to implement correctly than process-level isolation (and OpenBSD has spent tons of time hardening process-level isolation). I’d love to see a security bake off of a few mature applications built with this and random-language-de-jour.
- okket 8y ago
  > I suspect “unsafe” C leads to safer server side code when combined with a few, simple libraries. As many mentioned this might be true, but only if you don't have to deal with user input, strings, unicode and anything but extremely simple manual memory management. The essence is, C and similar languages like Rust are great for writing an OS or a browser, but you really, really, really do not want to write complex server side web apps in those languages. Sure, you can force your way through and if you have 30+ years of C in your head, it might even be safe. But it is not reasonable nor advisable for the general case. IMHO.
  - efficax 8y ago
    Rust brigade engage! Not sure why you're lumping Rust in with C here. Rust has automatic memory management as part of the language, without a runtime, and it has excellent libraries for dealing with Strings, unicode, and concurrency and asynchronous functions. It's a perfect language for writing a complex server side web app.
    - okket 8y ago
      Sorry, my ignorance. I've had only a brief look at Rust, it did't 'click' in my head. On a second thought, it seems much more viable than this plain C mockery. Especially with the right support e.g. https://rocket.rs https://rocket.rs
ronreiter 8y ago
If you want simplicity as your #1 objective then I would recommend Flask and Python. If speed is your #1 objective then you can try Go. Maintaining a C webapp is terrible. You don't have any primitives, you need to manage your own memory which is extremely dangerous, and the amount of best practices you need to learn so you won't shoot yourself in n the foot and create an exploitable/unstable application is immense.
- hedora 8y ago
  Python is the opposite of simple. If you want good performance, then, for non-trivial sites, you cannot afford to spawn the interpeter on each request, so you have to use some asynchronous tooling. Similarly, spawning connections is much heavier weight than it should be, so you end up with backend connection pools. At work, we used fabric for this, and it blew up in our face at scale, and we had to rewrite. In order to get off the ground, you also need to use pip, which causes an inordinate number of problems vs. the bsd ports tree or .deb files. Managing dependencies and versions between the host os and pip space still seems to be an open problem. You can use virtual environments for each script, but then patching zero days becomes infeasible. If you want basic type safety, you need to rely on external tooling. In my experience, third party python libraries evolve types and api’s without warning. This shows up at runtime, so it introduces security holes. I could go on for hours.
  - dsies 8y ago
    So, what did you rewrite your application in?
    - hedora 8y ago
      Considering C++ or Rust. (Rewrote big chunks in python multiple times...)
      - sam0x17 8y ago
        You should really check out Crystal / Amber Framework. Based on what you've tried you might really like it.
UncleEntity 8y ago
> C is a straightforward, non-mustachioed language Maybe non-mustachioed out of the box but I've done the mustachio thing to generate code for my ASDL parser backend. Well...I guess it was a C++ library since it was "header only" but I'm sure I could have found a C library if part of the project wasn't to learn boost::spirit.
kizer 8y ago
I may be young and dumb, but C programming seems very simple and straightforward to me. With abstraction comes lack of knowledge of implementation in favor of ease of use; but in C you can build your own abstractions quickly and reach a level close to even JS (opaque types, function pointers). At least in C you know exactly what is going on. Can someone briefly summarize the security issues in C? If you manage memory properly and take a conservative approach to handling input, where is the risk? Like I said, I'm young and have only be programming in C for ~3 years.
- petee 8y ago
  C's biggest issue is well-warned (lazy?) programmers repeating the same mistakes that have been documented ages ago. In the analogy of shooting yourself in the foot, why is anyone using a gun without the safety training first?? If you're serious about writing safer C code, certainly check up the following two resources from Robert Seacord: - SEI CERT C Coding Standard: https://wiki.sei.cmu.edu/confluence/display/c/SEI+CERT+C+Coding+Standard https://wiki.sei.cmu.edu/confluence/display/c/SEI+CERT+C+Cod... - Secure Coding in C and C++: https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=30581 https://resources.sei.cmu.edu/library/asset-view.cfm?assetid...
- pjmlp 8y ago
  In C you think you know what is going on, specially bad when developers mix the compiler specific behavior with the standard and then try to write portable code. - Decays of arrays into pointers. - Decays of enumeration into numeric types - Default signess is implementation defined - Implicit conversions - Currently ISO C11 lists about 200 UB cases, C2X plans to list even more - Strings are a pointer to somewhere in memory that you hope the caller actually terminated them. - While the pre-processor seems basic, compared with real macros, you can still be very creative with it - No way to validate security issues in binary libraries The LLVM and PVS Studio blogs have quite a few examples of C gotchas.
  - earenndil 8y ago
    > While the pre-processor seems basic, compared with real macros, you can still be very creative with it That sounds like a benefit, not a downside. See, for instance, http://libcello.org/ http://libcello.org/
blueside 8y ago
I love this; we are definitely in the territory of Poe's law here. I strangely really like the css formatting used in the website's source code (e.g. https://github.com/kristapsdz/bchs/blob/master/json.css https://github.com/kristapsdz/bchs/blob/master/json.css)
- ape4 8y ago
  That formatting is cool. Why would they not want radio buttons to display? `input[type=radio] { display: none; }`
kizer 8y ago
Basically, if you don't use this stack you're a pussy.
ohazi 8y ago
I really don't like OpenBSD's httpd. Last I checked (three months ago?), it couldn't do something as simple as adding a custom header to a static file. Why you'd use it over Apache or nginx is beyond me.
- petee 8y ago
  I'd love to know what header you desperately need just for a static file, that would necessitate a behemoth such as nginx, or apache and all it's CVEs? Simply having all the bells, whistles and free candy, doesn't determine 'toy' status
  - ohazi 8y ago
    X-some-signal-to-tell-aws-that-its-okay-to-use-this-file: true "Why would anyone need this" was also the typical dismissive response I got when looking around for help.
    - petee 8y ago
      It's definitely a legitimate question - not everybody knows that AWS needs some silly header, nor why. OpenBSD people will be the first to call out unnecessary/outlandish requests unless you can back it up with a good reason outright. I appreciate the fact that httpd doesn't attempt to be the end-all server for everybody - its primarily a lightweight way to run things like the BGPd looking glass, other tools, a simple website, or something via fastcgi. The term they use often when denying pull requests is 'Featuritis', which Apache & Nginx suffer from.
      - abiox 8y ago
        what would you recommend for someone needing to add headers?
        sedachv 8y ago
        I had the same issue (wanted to add a Content-Security-Policy header to a site hosted on OpenBSD httpd) and switched to https://www.lighttpd.net/ https://www.lighttpd.net/
sfifs 8y ago
Expose a C program with all the language's subtle undefined states and manual memory management to the big bad web! What could go wrong...
- petee 8y ago
  Well untrained programmers who have no business writing C apps in the first place, for starters. Everyone here is completely glossing over this as if it were suggested that this is intended for everybody, for every solution. If you're not extremely confident in your C skills, or have the experience to back it up, This is NOT for you! If you think you can only do it with another language, then This is NOT for you! If you think you're gonna write the next Amazon, This is NOT for you! And lets not forgot just how many things are written in C and still running the internet. It's just another tool in your toolbox.
  - brokencode 8y ago
    Everybody makes mistakes, no matter how confident they are in C. And while there are numerous things written in C, there is also a continuous stream of bugs and vulnerabilities as well. That’s not to say that other languages are perfect, but there are much safer options that are still very fast, such as Rust, or even C# or Java.
  - moosingin3space 8y ago
    Linus Torvalds is "extremely confident in his C skills". Doesn't stop hundreds of CVEs per year targeted at the kernel. Sick of the C Apologism Task Force's idea that "if only rockstar programmers wrote code we wouldn't have any problems", completely ignoring the reality of software development and the evidence of 50 years of exploits.
    - petee 8y ago
      50 years of the same bugs over and over - the language might let you shoot yourself, but that doesn't abdicate the programmer from continuing education, code review, or testing. Seacord has a whole book on avoiding these; arguably anyone without it isn't doing all they can to write safe code, and might as well be considered uneducated. You can write unsafe code in any language if you don't know what's going on, or not a 'rockstar' As for Linus, the kernel was written when he was a student, and I doubt he personally still makes the same low hanging fruit vulnerabilities that are the big issue.
deleted 8y ago
[deleted]
kworker 8y ago
Any example site with huge traffic, or is it just a "joke" project?
kazinator 8y ago
If you want to do web backend in C, this approach is far from the only game in town. For instance, there is this: https://kore.io/ https://kore.io/ I like the idea of a web framework having a C API. We can make bindings to it in different languages and have a kind of semantic standard across the board, like is done with numerous other things: numeric libraries, crypto, GUI, ...
deleted 8y ago
[deleted]
potta_coffee 8y ago
Please...I'm convinced this "BCHS Stack" is just an elaborate joke.
aaakjsd_____ 8y ago
C++17 is better though. incoming.
yellowapple 8y ago
If you're looking to develop a website exclusively with the tools that ship with OpenBSD, Perl would probably be a much saner choice than C, not to mention one with a long history of use in web development.

178 points by dhruvkar 8y ago

> because the open internet is damn inhospitable. And the answer to this is writing text-processing functions that you expose to the world, in C... skeptical face

simion314 8y ago
Many of the high level languages/frameworks call a C library or a C kernel or a C database
- mvdwoord 8y ago
  Yes, in ways that were learned over many years, by many people. Roll some of your own crypto, while you're at it.
  - aneutron 8y ago
    Ain't nothing wrong with that /s What could possibly go wrong
  - simion314 8y ago
    What is your point? My point is that if you nodejs you still are running "unsafe" C somewhere. Also what is the point of calling out on projects that are not using "cool" languages? You don't agree with the developer choice that is OK, probably that developer does not agree with your choice and has other priorities and if is an open source project probably he wants also to have fun while coding it.
    - zeth___ 8y ago
      This isn't about cool this is about dangerous. C makes shooting yourself in the foot so easy and efficient it even asks for artillery support. The time and effort to secure a C program against malicious input is absolutely huge. It would be quicker to write a secure dsl that using raw C. Which brings us back to scripting languages that have that implemented already as a library you load to run your requests through.
      - potta_coffee 8y ago
        C lovers are downvoting you but you're entirely right.
    - yorwba 8y ago
      The unsafe C in popular language runtimes has hopefully been written or at least reviewed by someone who knew what they were doing, and it presents a relatively controllable interface. Most people who write code in C are not that good at avoiding memory safety issues. The process is mostly to write some code, run it, then fix it until it doesn't crash immediately anymore. Have you ever been the first person to run valgrind on a codebase? Lots of uninitialized reads and use-after-free issues will be flagged, because they don't normally crash the program and therefore go undetected without using an additional checker. It can be fun to watch the error messages flow by, until you realize that now you have to file tickets for all of them. And some people won't even see the problem with those errors that don't crash the program, because potentially exploitable vulnerabilities are not as obviously bad as crashes.
      - simion314 8y ago
        I agree, but this does not mean that some experienced developers can't have some fun creating some tools in C, they may even be less buggy and more performant then some of the other tools written in high level languages. Btw, I am not a C fan, in fact I think I have no favorite language, I use what I have to for the project
  - ke29bnf 8y ago
    Why did they also wrap them in new syntax and abstraction? Why not just build the ecosystem to do that and still have it all be “C”? Why not some fixes to the standard and update then old but useful code, and work on better compilers? This is what’s been confusing me for a while If you can write safe enough C for the core of an interpreted language, why not abstract that into tools and patterns that generate better, safer C and learn how to do that over the last 30 years Instead of JS and dozens of flavors, Python, ruby, lua... DRY right? My suspicion is “vanity projects generate a sense of novelty that’s easier to sell.” But if the OS and bulk of the stack are “C inside anyway” why the extra nonsense?
- legulere 8y ago
  Most of the string manipulation and memory management happens in the safe high level languages in such cases.
- IshKebab 8y ago
  Yes but they have well defined and well tested places where that happens. For example you could implement a string class in C++ using strlen, strdup etc. if you were feeling insane and it would probably be fine since you only use strdup once and then all the users of you class don't have to worry about getting it wrong. If you write in C you have to use strdup every time you copy a string and there's no way you get it right 1000 times.
  - tedunangst 8y ago
    It's pretty hard to get strdup wrong.
    - sunfish 8y ago
      Yet, it happens: https://nvd.nist.gov/vuln/detail/CVE-2017-14064 https://nvd.nist.gov/vuln/detail/CVE-2017-14064 https://nvd.nist.gov/vuln/detail/CVE-2015-3182 https://nvd.nist.gov/vuln/detail/CVE-2015-3182 https://nvd.nist.gov/vuln/detail/CVE-2017-13748 https://nvd.nist.gov/vuln/detail/CVE-2017-13748 etc.
      - tedunangst 8y ago
        This is true. Although they did say "copy a string", not use strdup to copy a thing that is not a string. :)
        sunfish 8y ago
        Yes, that's one of the three CVE's I posted ;). You got me thinking about ways one could get strdup wrong: - input is not a string -> possible UB - input is a string, but the character encoding wasn't what you thought -> possible UB - input is a string, but it was the pointer-plus-length kind -> possible UB - input is modified by another thread -> possible UB - strdup called from within a signal handler -> possible UB - failure to handle error return values -> possible UB - failure to free the memory when it's no longer needed -> memory leak - freed the memory more than once -> possible UB - used the memory after freeing it -> possible UB I've personally seen several of these in real-world code.
- zeth___ 8y ago
  And those c programs call binary files. Anyone who uses C is a hypster that just wants to use a cool language instead of of good old 1 and 0.
  - skolemtotem 8y ago
    > And those c programs call binary files. Uh... am I missing the joke? The C programs don't "call binary files", the C programs become the binary files through compilation.
    - zeth___ 8y ago
      >Uh... am I missing the joke? Yes, yes you are.
kuon 8y ago
We could argue that modern static analysis tools and the compiler itself are good at catching a lot of errors, and that high level languages have bugs too. C is a dangerous beast, but with good practices it isn't that dangerous. Of course you have to be extra careful when dealing with user content, like JSON payload, but many decoders in other languages are written in C. Rust is a good solution, but it isn't trivial to learn, and might not suite all situations. I think it's great to have a C solution like this.
- zeth___ 8y ago
  When your messaging protocol is Turing complete you have no hope of a secure web server.
  - peterkelly 8y ago
    JSON is not Turing complete
- gaius 8y ago
  C is a dangerous beast, but with good practices it isn't that dangerous. Of course you have to be extra careful when dealing with user content, like JSON payload, but many decoders in other languages are written in C. It isn't hard to build tools like Valgrind and AFL into your C workflow. I would take that over simply taking for granted that a higher-level language was secure just because it is interpreted. After all it's probably C under the hood anyway.
  - marmaduke 8y ago
    This is a good point: you can CI run tests under Valgrind with various sanitizers and -Wall -Wextra. In a small codebase with a few cores, one can compile and run a test suite faster than it takes for a Django app to start.
- unrealhoang 8y ago
  I don’t think any non-gc language is trivial to learn, C also. Manual memory management is hard, and either you learn from the system (C way) or learn it upfront from the language (Rust way), it’s still the same amount of concept you have to digest to write practical software.
yani 8y ago
It says hipster-free which will imply to me that it is not for the typical startup developer
- jeremyjh 8y ago
  Is there anyone other than hipsters consciously trying to avoid being a hipster?
  - 1_player 8y ago
    Exactly. Who would code a web app in 2018 in C? That's right, hipsters. Seasoned developers would use a tool more fit for the job, like Java, Python or even PHP. Seasoned hipsters would use Node, Clojure or Elixir.
    - chris_wot 8y ago
      Normally I would consider this to be an unhelpful comment, but actually in this case, you're right.
potta_coffee 8y ago
I'm 95% that the whole thing is an elaborate joke.

bitofhope 8y ago

I find the site a little tongue-in-cheek, but I genuinely like the ideas behind it. I honest-to-$DEITY prefer programming in C to any sort of Javascript. C is kinda hellish for large, complex projects, which is good. The world needs fewer large and complex websites. OpenBSD also provides very good security features that mitigate the inherent security challenges of writing C. pledge(2) is just a very good idea. I generally think websites should do their processing in the backend, whenever possible. Running code to generate the website should not be the user's problem. This also comes with the advantage of not being constrained to *Script languages. C is alright, but if you're of the defeatist camp who thinks writing C safely is impossible, you can adapt the BCHS philosophy just as well to C++, Rust, Go, D, Python, AWK, Common Lisp…

rileymat2 8y ago
C is also hellish for string processing. From memory management to buffer overflows to understanding the encoding types.
- mpweiher 8y ago
  Objective-C with a reasonable Foundation is such a great language for this... It has essentially the predictability and simplicity of C, just with a minimal amount of dynamic binding to make it comfortable. And NSString variants tend to take care of string handling and encodings.
  - okket 8y ago
    At that level, you can just switch to the clang compiler based Swift language, which is much nicer/modern. And look, there are already Swift web frameworks like https://vapor.codes https://vapor.codes
    - gkya 8y ago
      I really dislike the Swift/Scala/Rust/Dart/Kotlin etc. style, heavy and centralised syntax. ObjC is not very beautiful, but it has an elegant way of combining composable primitives (functions and objects). The same kinda sorta goes for Perl too, which I think is a nicer alternative to C in this stack.

tannhaeuser 8y ago

I'm loving the spirit if not the snark, but it's still odd OpenBSD's httpd (not to be confused with Apache httpd) calls it's CGI gateway "slowcgi" (and kindof derides CGI programming). I mean, it being slow is entirely the fault of the O/S isn't it ?: And using C gets a whole level more challenging with long-running processes and async I/O because of manual memory management. Native CGI programming IMHO is best enjoyed with a reverse cache if you can help it, such as with Apache's mod_cache.

notaplumber 8y ago
It's slowcgi.. you know, as opposed to fastcgi. It's just a name. It was implemented so that httpd(8) didn't have to support executing CGI programs itself and could speak only FastCGI. You don't /have/ to use it, but it's safer. http://man.openbsd.org/slowcgi http://man.openbsd.org/slowcgi
- tannhaeuser 8y ago
  I was referring to the release announcement back in 2014 or so which I'm unfortunately not able to find (there was more than a bit snarkiness towards CGI programming). I'm aware what FastCGI is ;) Btw. if you're interested in native HTTP I'd be looking into nghttp2 rather than FastCGI and OBSD's httpd. Edit: see also https://ef.gy/fastcgi-is-pointless https://ef.gy/fastcgi-is-pointless and https://news.ycombinator.com/item?id=9202039 https://news.ycombinator.com/item?id=9202039 (previous discussion of OBSD's httpd)
  - bigato 8y ago
    how can i trust a lib which still uses openssl in this day and age?
ekr 8y ago
It's slow because of its design, i.e. spawning a new process for each request; so it's not because of the OS.
- 8y ago

notaplumber 8y ago

Important pieces of the puzzle are Kristaps' kcgi (perhaps kwebapp/ksql). https://kristaps.bsd.lv/kcgi/ https://kristaps.bsd.lv/kcgi/ And also OpenBSD pledge / "sandboxing" on other OSs https://man.openbsd.org/pledge https://man.openbsd.org/pledge https://learnbchs.org/pledge.html https://learnbchs.org/pledge.html https://kristaps.bsd.lv/kcgi/tutorial6.html https://kristaps.bsd.lv/kcgi/tutorial6.html

krylon 8y ago
I really hope other systems will adopt pledge. Of all the selective privilege dropping mechanisms I know of, pledge seems to be the least complicated to use.
- pjmlp 8y ago
  Mojave has a new security aware runtime for its applications. Bringing sandboxing to all applications and requiring listing of entitlements and digital signing. Microsoft has decided if the apps don't come to the store, the store goes to the apps, and are merging Win32 with UWP sandboxing concepts via Windows containers and the new MSIX package format. Android sandboxing is still the most complicated one.

jmartrican 8y ago

Two points. Would be nice if there was an AMI on AWS for this stack. Second point. We do a lot of RESTful microservices. Which might be good for this in the sense that with C you would want to keep your code small (cause no classes and manual mem-management). But what people do not always appreciate at first about microservices is that you need to rely heavily on libraries (either custom or external like Spring Security) to handle cross cutting concerns, else you are writing the same code multiple times. Essentially if you write a peice of code that you expect will go on more than one microservice, then it should go into library. So my concern is how easily would it be to create custom libraries to deal with cross cutting concerns like logging, and security in this stack, AND does C ecosystem offer external libraries for dealing with these common concerns that a modern RESTful microservice would encounter?

pjmlp 8y ago
And most important how sure can one be that those libraries have been propely sanitized.

hellofunk 8y ago

I am seeing SQLite pop up more and more in articles that tout its effectiveness and simplicity for many use cases over popular alternatives like PostgreSQL. It has definitely persuaded me to consider it on future projects.

gaius 8y ago
SQLite is a beautiful little jewel! Every time I think "does it have X feature" it always delights me that it does! And the code is exemplary as well, you can learn loads from just reading it. If you don't need concurrent writers, then SQLite goes a very, very long way.
dom96 8y ago
Oh yeah. SQLite is incredibly versatile and for most web applications it's more than enough. The only pain point I have with it is that all data is stored as a string no matter the table schema types specified, this can lead to some bugs, but if you have a good library in your language for SQLite then it's not a problem.
- hellofunk 8y ago
  I am currently working with a data set that is billions of rows and tens of GB. Will be interesting to see how SQLite handles it, which I plan to try. All of that in one DB file!
  - xyproto 8y ago
    Should be fine. SQLite is fast and capable.
  - dagw 8y ago
    The main place you might run into problems is if doing lots of simultaneous writes. As long you're mostly dealing with reads then it should work.
- hellofunk 8y ago
  > all data is stored as a string no matter the table schema types specified The docs seem to suggest otherwise: > if a column is of type INTEGER and you try to insert a string into that column, SQLite will attempt to convert the string into an integer. If it can, it inserts the integer instead. From: https://www.sqlite.org/faq.html#q3 https://www.sqlite.org/faq.html#q3

reacharavindh 8y ago

As much as I align myself philosophically to most things this project stands for, I wouldn't trust myself to write public facing web applications in C. The same philosophy could still be held up while replacing the last components with a less dangerous language like Rust(with the trade off of developing complexity, and possibly giving up a bit of control). OpenBSD as a base operating system, running relayd and httpd to face the hostile web proxying for efficient services written in Rust would be my ideal choice. SQLite for most simple data store needs, and Postgres if the data management gets big enough that it might spill to another machine.

usgroup 8y ago

Lol, about 10 years ago I wrote a CGI framework in C. It was fun and the minimalist in me loves the lark but for productive work especially working with other people, opting for a stack with next to no abstraction is crazy. Put it this way; Would you invest in s startup intending to use this stack ? Can this stack ever be the result of pragmatic decision making? If you can genuinely answer yes to both in your use case , then why not ...

stevekemp 8y ago
People generally invest in startups because they believe the sales/customer numbers. Not because they pay attention to the implementation of every single component which is used by the company. That said OkCupid famously used a custom HTTP-server to power their site: https://github.com/OkCupid/okws https://github.com/OkCupid/okws

sbr464 8y ago

The example says no mysticism but is using at least 4 undeclared variables. I’m not a C developer so I’m sure I’m completely wrong, but where do pledge, puts, EXIT SUCCESS/FAILURE come from? I assume from importing stdlib etc, which probably give you additional variables to use, that you would need to know about explicitly. One thing I like about zeit.co’s micro server (js) was the argument about not using bodyparser and magically having res.body available, but using async/await and assigning it to a variable. This is popping up more with things like es module imports, render props in react, etc. They make it clear where variables come from and allow you to avoid stepping on existing variables. What other 10-100 variables can I step on potentially with global patterns as a new user?

beefhash 8y ago
> I’m not a C developer so I’m sure I’m completely wrong, but where do pledge, puts, EXIT SUCCESS/FAILURE come from? - pledge: unistd.h[1] - puts: stdio.h[2] - EXIT_SUCCESS and EXIT_FAILURE: stdlib.h[3] You can probably safely assume a C programmer is familiar with puts and EXIT_SUCCESS/EXIT_FAILURE and that an OpenBSD programmer has heard of pledge(2). [1] https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2 [2] ISO C11, § 7.21.7.9 no. 1; https://man.openbsd.org/puts.3 https://man.openbsd.org/puts.3 [3] ISO C11, § 7.22 no. 3
- sbr464 8y ago
  Thanks for that info. I do need to learn C still.
cpmouter 8y ago
It's surprising to me that someone could be a programmer without knowing anything about C.
- scandox 8y ago
  The best programmer in the world may never have even seen a computer for all we know.

ghapereira__ 8y ago

> "man pages and "-Wall -Wextra" are your new best friends" These guys are more likely friends with "-pedantic"

bitofhope 8y ago
And nothing wrong with that. Stricter compiler is a good thing if you don't need it to be laxer. My favourite flag in clang is -weverything. Everything I write in C I compile with it and fix whatever I reasonably can.
kworker 8y ago
I wonder if it can compile with -pedantic-errors That would be awesome.

alexhutcheson 8y ago

Doing anything on the web with a language that doesn’t have a string type seems like masochism.

kizer 8y ago
A character array seems like a natural way to me to represent a string of characters. But Unicode though...
- deleted 8y ago
  [deleted]
- fulafel 8y ago
  As C functions can't take arrays as arguments, you don't get very far this way.
  - kizer 8y ago
    ...you pass in a pointer to the first character. Arrays in C are simply contiguous spans of memory.
    - fulafel 8y ago
      Thid then has the problem that thr length is unknown, leading to well known problems.
      - petee 8y ago
        Well if you wrote the array, or your program did, then you do know the length. Not a problem. Would it be nice if an array internally stored that? Sure. Does it? No. Is that a real problem? No, not really - its been solved and worked around for decades
  - petee 8y ago
    This is incorrect; a quick search with your first sentence will answer that

jokoon 8y ago

How will does it run on a raspberry pi?

sgt 8y ago
It should run just fine, but I haven't tested it myself. OpenBSD has support for the Raspberry Pi (BCM2837): https://www.openbsd.org/arm64.html https://www.openbsd.org/arm64.html

qwerty456127 8y ago

I can imagine an even more weird one: DOS, ASM, dBase... (;,;) > C is a straightforward Indeed, what can be more straightforward than manual memory management and pointer arithmetic...

hedora 8y ago

I suspect “unsafe” C leads to safer server side code when combined with a few, simple libraries. One issue that seems to fly over the head of “safe” high level language proponents are that you need to know what data types you are manipulating in order to write safe code. Also, language-level isolation is much harder to implement correctly than process-level isolation (and OpenBSD has spent tons of time hardening process-level isolation). I’d love to see a security bake off of a few mature applications built with this and random-language-de-jour.

okket 8y ago
> I suspect “unsafe” C leads to safer server side code when combined with a few, simple libraries. As many mentioned this might be true, but only if you don't have to deal with user input, strings, unicode and anything but extremely simple manual memory management. The essence is, C and similar languages like Rust are great for writing an OS or a browser, but you really, really, really do not want to write complex server side web apps in those languages. Sure, you can force your way through and if you have 30+ years of C in your head, it might even be safe. But it is not reasonable nor advisable for the general case. IMHO.
- efficax 8y ago
  Rust brigade engage! Not sure why you're lumping Rust in with C here. Rust has automatic memory management as part of the language, without a runtime, and it has excellent libraries for dealing with Strings, unicode, and concurrency and asynchronous functions. It's a perfect language for writing a complex server side web app.
  - okket 8y ago
    Sorry, my ignorance. I've had only a brief look at Rust, it did't 'click' in my head. On a second thought, it seems much more viable than this plain C mockery. Especially with the right support e.g. https://rocket.rs https://rocket.rs

ronreiter 8y ago

If you want simplicity as your #1 objective then I would recommend Flask and Python. If speed is your #1 objective then you can try Go. Maintaining a C webapp is terrible. You don't have any primitives, you need to manage your own memory which is extremely dangerous, and the amount of best practices you need to learn so you won't shoot yourself in n the foot and create an exploitable/unstable application is immense.

hedora 8y ago
Python is the opposite of simple. If you want good performance, then, for non-trivial sites, you cannot afford to spawn the interpeter on each request, so you have to use some asynchronous tooling. Similarly, spawning connections is much heavier weight than it should be, so you end up with backend connection pools. At work, we used fabric for this, and it blew up in our face at scale, and we had to rewrite. In order to get off the ground, you also need to use pip, which causes an inordinate number of problems vs. the bsd ports tree or .deb files. Managing dependencies and versions between the host os and pip space still seems to be an open problem. You can use virtual environments for each script, but then patching zero days becomes infeasible. If you want basic type safety, you need to rely on external tooling. In my experience, third party python libraries evolve types and api’s without warning. This shows up at runtime, so it introduces security holes. I could go on for hours.
- dsies 8y ago
  So, what did you rewrite your application in?
  - hedora 8y ago
    Considering C++ or Rust. (Rewrote big chunks in python multiple times...)
    - sam0x17 8y ago
      You should really check out Crystal / Amber Framework. Based on what you've tried you might really like it.

UncleEntity 8y ago

> C is a straightforward, non-mustachioed language Maybe non-mustachioed out of the box but I've done the mustachio thing to generate code for my ASDL parser backend. Well...I guess it was a C++ library since it was "header only" but I'm sure I could have found a C library if part of the project wasn't to learn boost::spirit.

kizer 8y ago

I may be young and dumb, but C programming seems very simple and straightforward to me. With abstraction comes lack of knowledge of implementation in favor of ease of use; but in C you can build your own abstractions quickly and reach a level close to even JS (opaque types, function pointers). At least in C you know exactly what is going on. Can someone briefly summarize the security issues in C? If you manage memory properly and take a conservative approach to handling input, where is the risk? Like I said, I'm young and have only be programming in C for ~3 years.

petee 8y ago
C's biggest issue is well-warned (lazy?) programmers repeating the same mistakes that have been documented ages ago. In the analogy of shooting yourself in the foot, why is anyone using a gun without the safety training first?? If you're serious about writing safer C code, certainly check up the following two resources from Robert Seacord: - SEI CERT C Coding Standard: https://wiki.sei.cmu.edu/confluence/display/c/SEI+CERT+C+Coding+Standard https://wiki.sei.cmu.edu/confluence/display/c/SEI+CERT+C+Cod... - Secure Coding in C and C++: https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=30581 https://resources.sei.cmu.edu/library/asset-view.cfm?assetid...
pjmlp 8y ago
In C you think you know what is going on, specially bad when developers mix the compiler specific behavior with the standard and then try to write portable code. - Decays of arrays into pointers. - Decays of enumeration into numeric types - Default signess is implementation defined - Implicit conversions - Currently ISO C11 lists about 200 UB cases, C2X plans to list even more - Strings are a pointer to somewhere in memory that you hope the caller actually terminated them. - While the pre-processor seems basic, compared with real macros, you can still be very creative with it - No way to validate security issues in binary libraries The LLVM and PVS Studio blogs have quite a few examples of C gotchas.
- earenndil 8y ago
  > While the pre-processor seems basic, compared with real macros, you can still be very creative with it That sounds like a benefit, not a downside. See, for instance, http://libcello.org/ http://libcello.org/

blueside 8y ago

I love this; we are definitely in the territory of Poe's law here. I strangely really like the css formatting used in the website's source code (e.g. https://github.com/kristapsdz/bchs/blob/master/json.css https://github.com/kristapsdz/bchs/blob/master/json.css)

ape4 8y ago
That formatting is cool. Why would they not want radio buttons to display? `input[type=radio] { display: none; }`

kizer 8y ago

Basically, if you don't use this stack you're a pussy.

ohazi 8y ago

I really don't like OpenBSD's httpd. Last I checked (three months ago?), it couldn't do something as simple as adding a custom header to a static file. Why you'd use it over Apache or nginx is beyond me.

petee 8y ago
I'd love to know what header you desperately need just for a static file, that would necessitate a behemoth such as nginx, or apache and all it's CVEs? Simply having all the bells, whistles and free candy, doesn't determine 'toy' status
- ohazi 8y ago
  X-some-signal-to-tell-aws-that-its-okay-to-use-this-file: true "Why would anyone need this" was also the typical dismissive response I got when looking around for help.
  - petee 8y ago
    It's definitely a legitimate question - not everybody knows that AWS needs some silly header, nor why. OpenBSD people will be the first to call out unnecessary/outlandish requests unless you can back it up with a good reason outright. I appreciate the fact that httpd doesn't attempt to be the end-all server for everybody - its primarily a lightweight way to run things like the BGPd looking glass, other tools, a simple website, or something via fastcgi. The term they use often when denying pull requests is 'Featuritis', which Apache & Nginx suffer from.
    - abiox 8y ago
      what would you recommend for someone needing to add headers?
      - sedachv 8y ago
        I had the same issue (wanted to add a Content-Security-Policy header to a site hosted on OpenBSD httpd) and switched to https://www.lighttpd.net/ https://www.lighttpd.net/

sfifs 8y ago

Expose a C program with all the language's subtle undefined states and manual memory management to the big bad web! What could go wrong...

petee 8y ago
Well untrained programmers who have no business writing C apps in the first place, for starters. Everyone here is completely glossing over this as if it were suggested that this is intended for everybody, for every solution. If you're not extremely confident in your C skills, or have the experience to back it up, This is NOT for you! If you think you can only do it with another language, then This is NOT for you! If you think you're gonna write the next Amazon, This is NOT for you! And lets not forgot just how many things are written in C and still running the internet. It's just another tool in your toolbox.
- brokencode 8y ago
  Everybody makes mistakes, no matter how confident they are in C. And while there are numerous things written in C, there is also a continuous stream of bugs and vulnerabilities as well. That’s not to say that other languages are perfect, but there are much safer options that are still very fast, such as Rust, or even C# or Java.
- moosingin3space 8y ago
  Linus Torvalds is "extremely confident in his C skills". Doesn't stop hundreds of CVEs per year targeted at the kernel. Sick of the C Apologism Task Force's idea that "if only rockstar programmers wrote code we wouldn't have any problems", completely ignoring the reality of software development and the evidence of 50 years of exploits.
  - petee 8y ago
    50 years of the same bugs over and over - the language might let you shoot yourself, but that doesn't abdicate the programmer from continuing education, code review, or testing. Seacord has a whole book on avoiding these; arguably anyone without it isn't doing all they can to write safe code, and might as well be considered uneducated. You can write unsafe code in any language if you don't know what's going on, or not a 'rockstar' As for Linus, the kernel was written when he was a student, and I doubt he personally still makes the same low hanging fruit vulnerabilities that are the big issue.

deleted 8y ago

[deleted]

kworker 8y ago

Any example site with huge traffic, or is it just a "joke" project?

kazinator 8y ago

If you want to do web backend in C, this approach is far from the only game in town. For instance, there is this: https://kore.io/ https://kore.io/ I like the idea of a web framework having a C API. We can make bindings to it in different languages and have a kind of semantic standard across the board, like is done with numerous other things: numeric libraries, crypto, GUI, ...

deleted 8y ago

[deleted]

potta_coffee 8y ago

Please...I'm convinced this "BCHS Stack" is just an elaborate joke.

aaakjsd_____ 8y ago

C++17 is better though. incoming.

yellowapple 8y ago

If you're looking to develop a website exclusively with the tools that ship with OpenBSD, Perl would probably be a much saner choice than C, not to mention one with a long history of use in web development.