9 ms·
I'd be fine with this, even totally on-board, if C weren't so awful with respect to text. You don't even have to worry too much about free()ing your malloc()s i
by dleslie 5y ago
I'd be fine with this, even totally on-board, if C weren't so awful with respect to text. You don't even have to worry too much about free()ing your malloc()s if you design around short-lived processes. But this is just asking for security concerns among the tangled web of string and input processing your bespoke C routines are likely to develop into.
Pair it with a better, more modern, and safer native-compiled language and get the same effect. Zig, Nim, Go, hell even Carp.
- lazyfuture 5y agoSame guy wrote a rad tool that will generate server code, schema, frontend using a markup language called ORT. Will generate Rust and typescript if ya want.
- newlisp 5y agoOne of the most rewarding parts of back-end web application development is re-writing the same database routines and same JSON export routines over and over. Then changing the requirements and starting over. It's what makes web application developers such well-balanced folks, right? Unfortunately, in the flux of user requirements—each addition or modification of a table column changing select routines, insertions, validation, exporting, regression tests, and even (especially?) front-end JavaScript—we make mistakes. What BCHS tools beyond the usual can help in this perennial test of our patience? ;) https://learnbchs.org/kwebapp.html https://learnbchs.org/kwebapp.html
- synergy20 5y agowell there are still many large software written in C, e.g. nginx, lighttpd, even linux kernel. I checked BCHS a few years back, the key piece is that it's Openbsd, if it's Linux it might have caught on, due to linux's popularity, good or bad. This could be useful for embedded device for example, but not so many embedded devices running OpenBSD, if any at all.
- _wolfie_ 5y agoThe C library used (https://github.com/kristapsdz/kcgi https://github.com/kristapsdz/kcgi) is portable and working on linux as well. Putting this behind nginx as fastcgi seems very well doable.
- synergy20 5y agothere are also qdecoder or cgic or fcgi etc are totally linux ready for CGI, which by the way, all worked well. CGI is still perfect for a deeply embedded linux device.
- the_only_law 5y agoI just wish there were better tools for navigating C codebases. There’s been more than one time where I’m in some large auto tools based project trying to figure something out and there’s a call out to some dependencies I have no idea of. Also many of the projects lack and sort of documentation or source code commenting. These aren’t someones pet project either. One of them was from a notable name in the open source community and the other one was a de-facto driver in a certain hardware space.
- loeg 5y agoHave you tried ctags for navigation? Or clang-lsp?
- jhallenworld 5y agoTry cscope.
- pjmlp 5y agoUsing an IDE like VS/Clion/CDT/.. would already be of help. Then there are tools like SourceGraph, CppDepend among others.
- Too 5y agoUse clang to generate a compilation db. Most IDEs support this format out of the box, otherwise via plugin or routed through youcompleteme. https://clang.llvm.org/docs/JSONCompilationDatabase.html https://clang.llvm.org/docs/JSONCompilationDatabase.html
- deleted 5y ago[deleted]
- jimbob45 5y agoWhy would you ever choose C anymore? The killer feature of C++ is “you don’t pay for what you don’t use”. There’s virtually no reason ever not to use C++.
- LeFantome 5y agoIsn’t “C++ is too complex for me” a decent reason?
- 1ris 5y agoIt totally is, as long as you don't use C instead. There are plenty of good, less complex languages than C++ out there: Java is quite close and way, way less complex, for example. But C is non of them. Pointers are more complex in C than in C++ (pointer provenance). Casts are more complicated in C than in C++, as C++ named casts are less powerful and therefore give you less opportunity to shoot yourself in the foot. Strings (I'd guess quite important part of web programming) are a minefield in C, and they are so much better in C++. Resource management, memory ownership, object lifetimes. All very hairy in C++, all a good reason to not use C++. but also reasons to not use C. Types are a mess in C++. C is even weaker typed, making it worse. If you like procedural programming and dislike the complexities of C++, i suggest you write C++ without member functions, without inheritance and compiler disabled exceptions. It will feel similar, but it will be better. I suggest using a c++ compiler to write C with enum classes, std::span, either a typed std::span wrapper for malloc or std::vector<std::char8_t>, std::string, std::string_view,using, std::variant, std::unique_ptr, std::fmt, std::optional, templates, std::vector for your types, in that order. And don't use C style var-args and C style enums, C style unions. You can have very C-Like code, that is way less complex than C.
- RTFM_PLEASE 5y agoYeah, I'm just going to keep writing C. Thanks.
- deleted 5y ago[deleted]
- littlestymaar 5y ago> Pair it with a better, more modern, and safer native-compiled language and get the same effect. Zig, Nim, Go, hell even Carp. I love how trollish it is not to talk about Rust in that context.
- teaearlgraycold 5y agoMaybe they didn’t want to bring forth the Rust stans
- FpUser 5y agoYour message looks like a perfect example of trolling to me.
- scrame 5y agoThis entire thread is a troll, or a demonstration of Poe's law.
- _ofdw 5y agoIf we'd just rewrite all of the things in Rust we could solve computer bugs forever, and world hunger too.
- WesolyKubeczek 5y agoAnd end mortality!
- hutrdvnj 5y agoTwice
- msandford 5y agoAh, the ol' double-free bug!
- littlestymaar 5y ago
- zephyr9 5y agoIs there a good string-manipulation C library?
- lanstin 5y agoNo? Asking for code nav and you get three answers. Asking for this and you get crickets. In the 90s I worked at a place where we embedded TCL into all the apps, and rolled our own templating systems. I had to do a little string stuff in C after few years of go, and it sucked. Ugg. buf[len] = ‘\0’; Using go, I thought I was getting back to low level stuff but this C experience made me appreciate strings in Go. Web servers in C are crazy bad idea, especially if they are spitting out html. Lisp would be better. Node would be better. Go would be better.
- foxfluff 5y ago> buf[len] = ‘\0’; So why didn't you use one of the bazillion library functions or third party libraries that terminate strings for you? I feel like most of the criticism is coming from people who punish themselves by rejecting library functions and then telling that strings are hard. Doh.
- lanstin 5y agoI like to see the terminating nul in there, just in case my math was off earlier. I had strdup and so on. I was just way more work than go. And I was writing a LD_PRELOAD that I didn’t want to drag in any extra dependencies other than libc. Trust me, it is faster and safer and more fun in Go than C.
- foxfluff 5y agoAlright, yea, if you're working under constraints like that, C sucks more than it has to. It just doesn't feel fair to criticize C without mentioning that your experience comes from working under such unusual constraints. "Strings are hard, C sucks" is quite different from "strings are hard, C sucks when you can't rely on libraries." Also feels unfair to say you get crickets when you ask for a lib but actually you weren't even willing to use one. (There are tons of string libraries for C, it's impossible to miss them if you look around.) Even then, if you're stuck working with only libc and your own code, there's a very high chance you're doing something wrong if you're doing math on strings and terminating them manually. There's a fair selection of libc functions that do all the math for you and will always output a properly terminated string if your inputs are a buffer & valid size and strings.
- pjmlp 5y agoIf using C is a must, having static analysis as part of CI/CD pipeline and using libraries like SDS should be considered a requirement. Otherwise, yes using anything safer, where lack of bounds checking isn't considered a feature is a much better option.
- rkagerer 5y agoYou don't even have to worry too much about free()ing your malloc()s *gasp!* Such lack of symmetry... it disturbs something deep in my soul.
- vbezhenar 5y agoIt's just a well known arena allocator pattern, implemented on OS level.
- pcranaway 5y agoNever heard of Carp, looks cool!
- tharne 5y agoIt does seem sometimes that a lot of folks use C for philosophical rather than practical reasons. That being said, I love seeing a push for simple stacks like this.
- ainar-g 5y agoConsidering that it's a stack that uses OpenBSD, my first thought would be Perl, although it's not a language that one could call “modern”, heh. It's included into the base system and has rich libraries for text processing, (Fast)?CGI, HTML, and all that.
- kloch 5y agoI wrote my first web app in 2000 using C/mysql. It was Insanely fast but very awkward to implement. I used C because it was (and still is) the only language I knew well. At least if you are going to use C, you (should) know to be extremely paranoid about how you process anything received from the user. That doesn't remove the risk but at least you are focused on it.
- tinus_hn 5y agoThis is the same in any language. You can cause security issues in other languages as well if you trust the user/attacker.