5 ms·

If you want simplicity as your #1 objective then I would recommend Flask and Python. If speed is your #1 objective then you can try Go. Maintaining a C webapp

If you want simplicity as your #1 objective then I would recommend Flask and Python. If speed is your #1 objective then you can try Go. Maintaining a C webapp is terrible. You don't have any primitives, you need to manage your own memory which is extremely dangerous, and the amount of best practices you need to learn so you won't shoot yourself in n the foot and create an exploitable/unstable application is immense.

hedora 8y ago
Python is the opposite of simple. If you want good performance, then, for non-trivial sites, you cannot afford to spawn the interpeter on each request, so you have to use some asynchronous tooling. Similarly, spawning connections is much heavier weight than it should be, so you end up with backend connection pools. At work, we used fabric for this, and it blew up in our face at scale, and we had to rewrite. In order to get off the ground, you also need to use pip, which causes an inordinate number of problems vs. the bsd ports tree or .deb files. Managing dependencies and versions between the host os and pip space still seems to be an open problem. You can use virtual environments for each script, but then patching zero days becomes infeasible. If you want basic type safety, you need to rely on external tooling. In my experience, third party python libraries evolve types and api’s without warning. This shows up at runtime, so it introduces security holes. I could go on for hours.
- dsies 8y ago
  So, what did you rewrite your application in?
  - hedora 8y ago
    Considering C++ or Rust. (Rewrote big chunks in python multiple times...)
    - sam0x17 8y ago
      You should really check out Crystal / Amber Framework. Based on what you've tried you might really like it.
    - xtrapolate 8y ago
      > "Considering C++ or Rust." You've mentioned many issues you've had with your Python code base. Would you kindly expand on how/why C++ or Rust solve those in your particular case?
- xtrapolate 8y ago
  > "you cannot afford to spawn the interpeter on each request" You mention this as a case against using Python, but this is entirely unrelated to Python as a framework. In other words, had they used PHP or Node or %s, they'd still have to face the issue of optimizing the request-to-response path. This relates much more to the issues that often come with the common practice of separating your webserver, from your business logic (Flask, in our case). > "so you have to use some asynchronous tooling" Solutions such as mod_cgi and wsgi have been the standard for years at this point. That's, in many ways, a solved problem. > "In order to get off the ground, you also need to use pip, which causes an inordinate number of problems vs. the bsd ports tree or .deb files." Any specific issues you can expand on? Because this is a rather vague form of criticism. Using pip is ridiculously easy. I've been using Python extensively in various production environments and rarely had to point a finger at pip. Package and dependency management in Python are solid (that isn't to say things can't improve). > "You can use virtual environments for each script, but then patching zero days becomes infeasible." Again, this is an entirely subjective form of criticism. I haven't had any issues with keeping my virtualenvs up to date. > "If you want basic type safety, you need to rely on external tooling." Again, you just seem to favor strongly typed languages and that's fine, but that's hardly a point against using Python here. Type safety is simply not a Python thing, much like weak typing is not a C thing. > "In my experience, third party python libraries evolve types and api’s without warning. This shows up at runtime, so it introduces security holes." Developers will sometimes break APIs. How is this a Python-specific issue? These things are literally happening everywhere.
  - bqe 8y ago
    > Again, this is an entirely subjective form of criticism. I haven't had any issues with keeping my virtualenvs up to date. What tools do you use keep all of your virtualenvs up to date?
    - xtrapolate 8y ago
      I can recommend Snyk[0] (I am not affiliated, have used their products with clients before). They've got a fully functional free tier, and they have a ton of relevant features. And yes, there are other, competing products out there you could use. [0] https://snyk.io/docs/snyk-for-python https://snyk.io/docs/snyk-for-python
- vbernat 8y ago
  > If you want good performance, then, for non-trivial sites, you cannot afford to spawn the interpeter on each request, so you have to use some asynchronous tooling. Which Python framework is spawning one interpreter on each request? Most frameworks rely on WSGI where requests are served from a fixed number of interpreters. This approach achieves some honest performance. See for example https://klen.github.io/py-frameworks-bench/ https://klen.github.io/py-frameworks-bench/. > At work, we used fabric for this, and it blew up in our face at scale, and we had to rewrite. What is fabric? In Python, this is an automation tool for SSH. Unlikely to solve the problem of serving web requests.
  - cup-of-tea 8y ago
    That "framework" would be CGI. You have to call a program to get its standard output.
- deleted 8y ago
  [deleted]
hedora 8y ago
Also, here is a page with the tooling this stack provides: https://learnbchs.org/tools.html https://learnbchs.org/tools.html This set of tooling is much more powerful than what I’ve seen deployed in large python environments. BHCS has static and dynamic analysis out of the box, automatic penetration testing, hardware-assited, os level sandboxing and privilege whitelisting. The framework provides performant and hardened process management, and hardened json and sql processing out of the box.
sam0x17 8y ago
I would recommend Crystal via the Amber Framework. Really no trade-offs there as you get ruby-like syntax with C performance, type checking, and a compiled language.
icedchai 8y ago
If simplicity is your objective, use PHP. Nothing makes building web apps easier. Yeah, the language sucks...
- laumars 8y ago
  PHP makes building web pages easy. I'm not so convinced it makes building web applications easy as they require another level of performance, security and tooling that a web page does not. While you can obviously write a web app in PHP (heck, you could write one in CGI/Bash if you felt inclined) there are far better suited languages to get that job done. And ultimately once you factor in the extended requirements and maintainability, what was previously seen as easy can quickly become problematic
  - icedchai 8y ago
    Agreed. However, there are frameworks like Laravel that make this pretty manageable.
eftychis 8y ago
Still surprised, when I hear from friends about C, C# etc codebases (for web development). There are out there. Edit: Reading through depends on what you need. I suggest you take some time to look at the tooling provided and what you need (if you have prior experience on the field great). Don't let the hype carry you. Yet, good idea to listen, read or chat with people that had a similar problem to solve (with a grain of salt).
- engrefoobiz 8y ago
  I use C# in combination with Razor views and kestrel server. Why is that strange? To me it seem so natural.

hedora 8y ago

Python is the opposite of simple. If you want good performance, then, for non-trivial sites, you cannot afford to spawn the interpeter on each request, so you have to use some asynchronous tooling. Similarly, spawning connections is much heavier weight than it should be, so you end up with backend connection pools. At work, we used fabric for this, and it blew up in our face at scale, and we had to rewrite. In order to get off the ground, you also need to use pip, which causes an inordinate number of problems vs. the bsd ports tree or .deb files. Managing dependencies and versions between the host os and pip space still seems to be an open problem. You can use virtual environments for each script, but then patching zero days becomes infeasible. If you want basic type safety, you need to rely on external tooling. In my experience, third party python libraries evolve types and api’s without warning. This shows up at runtime, so it introduces security holes. I could go on for hours.

dsies 8y ago
So, what did you rewrite your application in?
- hedora 8y ago
  Considering C++ or Rust. (Rewrote big chunks in python multiple times...)
  - sam0x17 8y ago
    You should really check out Crystal / Amber Framework. Based on what you've tried you might really like it.
  - xtrapolate 8y ago
    > "Considering C++ or Rust." You've mentioned many issues you've had with your Python code base. Would you kindly expand on how/why C++ or Rust solve those in your particular case?
xtrapolate 8y ago
> "you cannot afford to spawn the interpeter on each request" You mention this as a case against using Python, but this is entirely unrelated to Python as a framework. In other words, had they used PHP or Node or %s, they'd still have to face the issue of optimizing the request-to-response path. This relates much more to the issues that often come with the common practice of separating your webserver, from your business logic (Flask, in our case). > "so you have to use some asynchronous tooling" Solutions such as mod_cgi and wsgi have been the standard for years at this point. That's, in many ways, a solved problem. > "In order to get off the ground, you also need to use pip, which causes an inordinate number of problems vs. the bsd ports tree or .deb files." Any specific issues you can expand on? Because this is a rather vague form of criticism. Using pip is ridiculously easy. I've been using Python extensively in various production environments and rarely had to point a finger at pip. Package and dependency management in Python are solid (that isn't to say things can't improve). > "You can use virtual environments for each script, but then patching zero days becomes infeasible." Again, this is an entirely subjective form of criticism. I haven't had any issues with keeping my virtualenvs up to date. > "If you want basic type safety, you need to rely on external tooling." Again, you just seem to favor strongly typed languages and that's fine, but that's hardly a point against using Python here. Type safety is simply not a Python thing, much like weak typing is not a C thing. > "In my experience, third party python libraries evolve types and api’s without warning. This shows up at runtime, so it introduces security holes." Developers will sometimes break APIs. How is this a Python-specific issue? These things are literally happening everywhere.
- bqe 8y ago
  > Again, this is an entirely subjective form of criticism. I haven't had any issues with keeping my virtualenvs up to date. What tools do you use keep all of your virtualenvs up to date?
  - xtrapolate 8y ago
    I can recommend Snyk[0] (I am not affiliated, have used their products with clients before). They've got a fully functional free tier, and they have a ton of relevant features. And yes, there are other, competing products out there you could use. [0] https://snyk.io/docs/snyk-for-python https://snyk.io/docs/snyk-for-python
vbernat 8y ago
> If you want good performance, then, for non-trivial sites, you cannot afford to spawn the interpeter on each request, so you have to use some asynchronous tooling. Which Python framework is spawning one interpreter on each request? Most frameworks rely on WSGI where requests are served from a fixed number of interpreters. This approach achieves some honest performance. See for example https://klen.github.io/py-frameworks-bench/ https://klen.github.io/py-frameworks-bench/. > At work, we used fabric for this, and it blew up in our face at scale, and we had to rewrite. What is fabric? In Python, this is an automation tool for SSH. Unlikely to solve the problem of serving web requests.
- cup-of-tea 8y ago
  That "framework" would be CGI. You have to call a program to get its standard output.
deleted 8y ago
[deleted]

hedora 8y ago

Also, here is a page with the tooling this stack provides: https://learnbchs.org/tools.html https://learnbchs.org/tools.html This set of tooling is much more powerful than what I’ve seen deployed in large python environments. BHCS has static and dynamic analysis out of the box, automatic penetration testing, hardware-assited, os level sandboxing and privilege whitelisting. The framework provides performant and hardened process management, and hardened json and sql processing out of the box.

sam0x17 8y ago

I would recommend Crystal via the Amber Framework. Really no trade-offs there as you get ruby-like syntax with C performance, type checking, and a compiled language.

icedchai 8y ago

If simplicity is your objective, use PHP. Nothing makes building web apps easier. Yeah, the language sucks...

laumars 8y ago
PHP makes building web pages easy. I'm not so convinced it makes building web applications easy as they require another level of performance, security and tooling that a web page does not. While you can obviously write a web app in PHP (heck, you could write one in CGI/Bash if you felt inclined) there are far better suited languages to get that job done. And ultimately once you factor in the extended requirements and maintainability, what was previously seen as easy can quickly become problematic
- icedchai 8y ago
  Agreed. However, there are frameworks like Laravel that make this pretty manageable.

eftychis 8y ago

Still surprised, when I hear from friends about C, C# etc codebases (for web development). There are out there. Edit: Reading through depends on what you need. I suggest you take some time to look at the tooling provided and what you need (if you have prior experience on the field great). Don't let the hype carry you. Yet, good idea to listen, read or chat with people that had a similar problem to solve (with a grain of salt).

engrefoobiz 8y ago
I use C# in combination with Razor views and kestrel server. Why is that strange? To me it seem so natural.