13 ms·
BCHS software stack: BSD, C, httpd, SQLite
- pgraf 3y ago“BCHS is a stable, developer-oriented platform. Get used to minimalism and security” With all the memory-safety issues you can introduce by improperly using C, is this page meant to be taken sarcastically or are they really serious about this claim?
- chrsw 3y agoThey're serious. C doesn't have to be insecure.
- wyldfire 3y agoIt's just extraordinarily difficult to make it so, and to convince yourself that you've made it so.
- loeg 3y agoOften easier to convince yourself you've made it secure than to actually do so. Which is part of the problem.
- Mikhail_Edoshin 3y agoIf Python is considered secure yet CPython is written in C, then, perhaps, it is not that difficult?
- rychco 3y agoWhy wouldn’t it be serious? C has been used to write safe, stable, & portable software for decades. Compiler warnings & static analysis tools have come a long way to preventing the vast majority of safety issues in (new) C projects.
- rollcat 3y agoKristaps is an OpenBSD developer. These guys are notorious for having five heads each - two remote holes in 30 years, OpenSSH, PF, etc. That said, the actual secret is to write simpler code. (And maybe use pledge+unveil, if your OS has it.)
- formerly_proven 3y agoZero network services with open ports by default (not even sshd) also helps for that number.
- rollcat 3y agoYes, "simpler" often means "don't do things you don't have to". A laptop doesn't really need sshd, and OpenBSD makes for an OK laptop OS.
- throwawaaarrgh 3y ago[flagged]
- nequo 3y agoA response with substance would be something we could learn from but a meme isn’t.
- User23 3y agoYou might want to take a few dozen hours to dig through John Regehr’s work to understand the current state of the art of C programming.
- nequo 3y agoIs there a particular entry point into his work that you would recommend?
- acuozzo 3y agoAny of his articles covering undefined behavior.
- User23 3y agoHis work on fuzzing and test case reduction is really interesting too.
- User23 3y agoThis[1] is one possible start. Bear in mind though his approach is academic so don’t expect a tidy list of what the working C programmer needs to know. [1] https://blog.regehr.org/archives/1520 https://blog.regehr.org/archives/1520
- WhereIsTheTruth 3y agoThe illusion of security start by believing your software is "safe" because written in a new "safe" language https://nvd.nist.gov/vuln/detail/CVE-2023-22466 https://nvd.nist.gov/vuln/detail/CVE-2023-22466
- tialaramex 3y agoI don't really see a connection here. Rust doesn't magically solve all problems, it just makes lot of them less likely, which means we can successfully build larger systems.
- bsdpufferfish 3y agoIf that’s the case then @safety” isn’t binary it’s a gradient and debating C++ vs Rust is a matter of degree instead of a moral imperative.
- WhereIsTheTruth 3y agoYou don't because you are not competent enough, nothing wrong with that C has the same tools, they however do not run with the compiler, but accomplish the same goal Both, are still not immune to incompetence, the user is often the issue, hence the link
- habibur 3y agoDid something similar. But instead of adding plain-text to HTML output, wrote a DOM parser in C that loads a HTML template and then adds the response into proper place of the DOM tree.
- actionfromafar 3y agoThat sounds hard!
- gchamonlive 3y agoDid you use regex for the html part?
- habibur 3y agoWrote a code parser. Not regexp. Found the old code on disk, snapshot here. The DOM parser, manipulator and free was 240 LOC. https://codeshare.io/X8RQxl https://codeshare.io/X8RQxl
- actionfromafar 3y agoWitchcraft! ;-) This is incredible.
- slmjkdbtl 3y agoWhat's the benefit of parsing an HTML template, over just putting HTML string together with the data from the backend like "<p>your name: " + name + "</p>"?
- habibur 3y agoIn DOM you can add content gradually and asynchronously, which gets harder using HTML template. Further you can read back previously added contents and make additional chagnes based on those. Like summing up table columns, or adding links to the first column values, or removing or fixing links based on authorization, to name a few.
- 3y ago
- ezequiel-garzon 3y agoDoes anybody know the motivation behind using `curl -sD- -o/dev/null` instead of `curl -I` on the landing page?
- CharlesW 3y agoThe former appears to retrieve headers via a standard GET request. Apparently, with the latter method, there's a chance you may get different results than you would see from a GET request. (I'm not an expert, so this is just what I discovered after digging a bit for curiosity's sake.)
- giantrobot 3y agoI think this is the exact difference. `curl -I` makes a HEAD request while the other is making a GET request and showing the response header. Just as a f'instance against a machine running nginx on my local network: the GET response sends me a Transfer-Encoding in the response header while a HEAD request does not. I can see a lot of configurations where a HEAD request returns different headers than a GET.
- chrismorgan 3y agoAs a matter of standards compliance <https://www.rfc-editor.org/rfc/rfc9110#section-9.3.2-2 https://www.rfc-editor.org/rfc/rfc9110#section-9.3.2-2>: > However, a server MAY omit header fields for which a value is determined only while generating the content. I find omitting Transfer-Encoding quite understandable and reasonable; the whole purpose of HEAD is to say “don’t bother doing the work that GET would trigger, I don’t care about exactness, I’m just getting a general idea”. Though I do find cases where Content-Length is omitted, even on static resources, disappointing. Saw that happen for I think the first time a few weeks ago (that is, a Content-Length that was present in GET but absent in HEAD). But certainly I’ve seen more than a few 405 Method Not Allowed responses to HEAD, which is definitely bad.
- CAP_NET_ADMIN 3y agoI feel like interacting with the internet using C is nowadays as productive as changing your JS framework every other year.
- actionfromafar 3y agoSo, peak productivity!
- deleted 3y ago[deleted]
- bionhoward 3y agoLooks really cool, some feedback from a noob to optionally improve the “trivial” example: 1. can you put a link to the running http file served by the example so we could see how the result looks? 2. Defining CGI would be helpful because I looked it up and found “computer generated imagery” which doesn’t seem like what you meant. 3. Might be good for this example to load the html from a file or SQLite to fully trivialize the whole stack, as this example doesn’t include the S in the acronym. sometimes I think the Next.js examples folder at https://github.com/vercel/next.js/tree/canary/examples https://github.com/vercel/next.js/tree/canary/examples is just an amazing example of how best to market a software product to developers because it’s such a rich source of integrations, almost anyone can find a good starting point for a web app project in there, if BCHS had the 80:20 of examples ready to roll then maybe it could blow up, because BCHS a great idea to use the most battle tested solutions in existence! Keep it up! bravo!
- marcus0x62 3y ago> 2. Defining CGI would be helpful because I looked it up and found “computer generated imagery” which doesn’t seem like what you meant. Common Gateway Interface. It’s how we generated dynamic web content back in 1995. Doing it with C is extremely painful.
- unwind 3y agoIt's typically common gateway interface [1] in the context of web serving. [1]: https://en.m.wikipedia.org/wiki/Common_Gateway_Interface https://en.m.wikipedia.org/wiki/Common_Gateway_Interface
- ReactiveJelly 3y agohttps://en.wikipedia.org/wiki/Common_Gateway_Interface https://en.wikipedia.org/wiki/Common_Gateway_Interface The most primitive version is just launching one process per request, piping the HTTP request into stdin, and piping the response out of stdout. It works, but you can imagine the startup latency is rough and it takes a lot of resources. There are faster variations that try to reduce the overhead. Ironically FaaS is sort of a rebirth of CGI
- pram 3y ago
- alberth 3y agoPosted 13-times to HN This is the post with most comments (149) [0] https://news.ycombinator.com/from?site=learnbchs.org https://news.ycombinator.com/from?site=learnbchs.org [1] https://news.ycombinator.com/item?id=29988951 https://news.ycombinator.com/item?id=29988951
- lelanthran 3y agoIt makes sense, to me, that the recent posts would have the most comments. More people are online with each passing day, and some percentage of them join HN.
- throwawaaarrgh 3y agoCGI in C (well, not CGI itself, but web apps) is super annoying. I spent 3 months writing web apps in C, took forever. There's a lot of convenient web app stuff in other languages that C doesn't make easy. Do not recommend.
- giantrobot 3y agoSeemingly a million years ago I tried making a CGI application in C. It was a complete pain in the ass. I'm no C wizard (and was even further from that 25 years ago) but it was just an awful experience. Not only did it take me an inordinate amount of time to write it had memory management issues and inexplicable crashes. Total shit show and a waste of time. I redid the whole project in a weekend in Perl and it was not only a better development experience but worked more reliably and was all around better. I miss CGI for developing web apps. It's straightforward and can easily (or at least in a straightforward way) be tested the same as a CLI tool. A lot of the problems were my deficiencies in C and just general inexperience. I'm sure today there's a lot of nice CGI helper libraries that would make the process a lot easier. I also have a lot more experience in C so I'm confident I'd just do a better job writing such an app. I have no interest in it though. I'd rather "waste" cycles in a higher level language and solve problems in the domain rather than the tooling. But more power to the crazy diamonds writing web apps in C.
- marcus0x62 3y agoOnce, I somehow got roped into writing a CGI application in C that I was supposed to write and test on a Linux system but that was going to run on a SunOS 4 system that I had no access to. That was...fun.
- giantrobot 3y agoI see many 500 errors in your past.
- marcus0x62 3y agoOnly after all the compile-time errors. The development process, such as it was, involved me writing and testing some part the program, then emailing it to someone (who had access to the sunos box) who would try to compile/run the program and who would email me back any errors, often several hours later. I recall imagining that what I was experiencing must have been similar to what early programmers submitting batch jobs went through. 0/10. Do not recommend.
- whalesalad 3y agofrom the FAQ: > Is BCHS a joke? > Software development is full of jokes. This is not one of them.
- deleted 3y ago[deleted]
- bosky101 3y agoI remember hooking up opencv with the embeddable server mongoose 15 years back. Today i would have considered mongoose(10k+ stars) which is also a mature c/c++ web server[1] if not the licence. Also check out this thread(290+ pts) on tiny http servers in C. [2] [1] https://github.com/cesanta/mongoose/tree/master/examples https://github.com/cesanta/mongoose/tree/master/examples [2] https://news.ycombinator.com/item?id=26671851 https://news.ycombinator.com/item?id=26671851
- marcrosoft 3y agoThis is close to my stack which is a single Go binary, SQLite db and either OpenBSD or Linux with a side of htmx.
- doodlesdev 3y agoMuch prefer your stack, yours operates at a higher level of abstraction, the one which I would consider correct for web services (your website or REST api doesn't need to do syscalls, or allocate memory manually), while not sacrificing too much performance or simplicity.
- edvinbesic 3y agoThis has become my go-to stack for playing around with for the last few months. Go/sqlite(bun)/templ/htmx with a sprinkle of proto-actors. Feels pretty close to phoenix framework with a few helper functions honestly but with the benefit of incredibly fast compilation of Go. Single binary for distribution with assets/migrations embedded. Still need to build something substantial so I am sure there are edge cases/rough edges but so far it feels like a breath of fresh air compared to nodejs ecosystem.
- whalesalad 3y agoDo you have any demo repos of this on gh
- kopirgan 3y agoVery interested in this too.. not clear at what point something like Postgres will become necessary. Just writing a simple hello world in node/express downloads a gazillion dependencies and code that'll all be points of failure or mystery for lack of understanding. To understand them all to be able to write non trivial stuff is likely no different from doing httpd in c on Linux. I've done stuff in go and it makes it lot easier to code.
- dang 3y agoRelated: BCHS: OpenBSD, C, httpd and SQLite web stack - https://news.ycombinator.com/item?id=29988951 https://news.ycombinator.com/item?id=29988951 - Jan 2022 (149 comments) BCHS stack – BSD, C, httpd, SQLite - https://news.ycombinator.com/item?id=28269399 https://news.ycombinator.com/item?id=28269399 - Aug 2021 (58 comments) BCHS: The BSD, C, httpd, SQLite stack for the web - https://news.ycombinator.com/item?id=23148871 https://news.ycombinator.com/item?id=23148871 - May 2020 (1 comment) OpenBSD, C, httpd and SQLite – Web App stack - https://news.ycombinator.com/item?id=17272225 https://news.ycombinator.com/item?id=17272225 - June 2018 (174 comments) BCHS stack – BSD, C, httpd, SQLite - https://news.ycombinator.com/item?id=14580746 https://news.ycombinator.com/item?id=14580746 - June 2017 (75 comments) Kwebapp: rapid BCHS web app development - https://news.ycombinator.com/item?id=14454381 https://news.ycombinator.com/item?id=14454381 - May 2017 (1 comment) BCHS Stack - BSD, C, Httpd, SQLite - https://news.ycombinator.com/item?id=11763888 https://news.ycombinator.com/item?id=11763888 - May 2016 (68 comments)
- doodlesdev 3y agoI am a huge fan of simplicity when it comes to software development (although I must admit I'm not always great at achieving it), but I wonder whether the BCHS stack really offers anything that couldn't be achieved with a more "modern" stack. httpd would be one of the things I'd look at, it's absolutely great software, but I wonder whether it really achieves the most simplicity from a developer point of view. For instance, in simpler deployments I would generally reach for Caddy [0], which does things such as certificate renewal automatically for me. However, the part of the stack that really irks me is C. I'm a huge fan of C in an ideal world (where developers are perfect), and I respect the language for its role in the history of software development, and in the context of UNIX, however I just don't understand why use it in 2023 for something such as a web service. A web service is going to handle untrusted user input, deal with network boundaries, and is security-critical. A memory-unsafe language, where undefined behavior is easy to create but hard to find, which doesn't provide a lot of (useful) abstraction primitives other languages would provide, seems like the wrong choice. That's even before we start talking about how cumbersome it is to handle "strings" in C. I'd wager Golang or Rust are always going to be better alternatives to C when it comes to developing web services. Golang makes deployment specially easy, while Rust provides similar or better performance than C, but provides more safety (memory and UB) and better abstraction primitives. I believe I understand the purpose of this stack, and roughly who is going to enjoy it, just wondering whether I'm overlooking something, as I must admit I have never actually built a production service using CGI/C/httpd. I see this stack as something that's more philosophical rather than pragmatic towards development, if that makes sense, which is something I respect but wouldn't use (other than if I'm doing it just for fun). [0]: https://caddyserver.com/ https://caddyserver.com/
- bawolff 3y ago> I must admit I have never actually built a production service using CGI/C/httpd Nor would you probably want to. In addition to the security nightmere that hooking an inexperienced c programmer's c program directly to the internet is, CGI is not really known for scaling all that well. Like if you were really doing this on a real high performance site you'd probably want to use FastCGI. But also you just wouldn't do this. If you want to be low level, at least use rust.
- thesuperbigfrog 3y agoSimiplicity is nice, but there are reasons why Perl and PHP were the popular choices for web stacks in the early 2000's--they are faster and easier to develop with than C and likely safer than C too. mod_perl (https://perl.apache.org/ https://perl.apache.org/) and mod_php (https://cwiki.apache.org/confluence/plugins/servlet/mobile?contentId=115522403#content/view/115522403 https://cwiki.apache.org/confluence/plugins/servlet/mobile?c...) helped to make Apache httpd (https://httpd.apache.org/ https://httpd.apache.org/) the number one web server in the early days of the web.
- bkallus 3y agoI've spent the better part of the year messing around with every HTTP server I could get my hands on. I would not recommend OpenBSD httpd. It's supposed to be simple, and it is simple compared to Apache, but it also has way fewer eyes on it. Ultimately, a big pile of string-handling C is likely to have some problems. There was a trivial-to-exploit server-crashing segfault in httpd's FastCGI implementation that was only fixed in the last month or so. There were also recent issues related to null bytes and line feeds in headers causing strange, exploitable misinterpretations of incoming requests in relayd. Much of this is now fixed, but I wouldn't be at all surprised if there were more low-hanging fruit remaining. If you're looking for a lightweight HTTP server written in C, I recommend Lighttpd. It's older, more widely-used, and more standards-compliant. I'm not trying to dump on OpenBSD; I run it on my primary laptop. I just wouldn't use their HTTP tools for anything mission-critical yet.
- alberth 3y agoI never understood why httpd is included in the base of OpenBSD, by an OS that strips all non-essential code out for sake of security.
- MuffinFlavored 3y ago[flagged]
- ninjin 3y agoBecause they used to have Apache in base from 1998 to 2014 (the 5.6 release) and found it frustrating to maintain? Given the developers and what they do with the operating system, I can understand why they would consider having an HTTP server in base something within the scope of the project. It is an open source project with both commits and discussion happening in the open (tech@ in particular), so the barrier to understanding is reasonably acceptable. At some point it was also debated to move to nginx, but in the end httpd(8) was championed as a natural offshoot from relayd(8) which was already in base.
- alberth 3y ago
- deleted 3y ago[deleted]
- bawolff 3y ago> "[C] has full access to the kernel's system calls" rofl, exactly what i'm looking for in a web framework. I honestly can't tell if this post is meant as satire or serious.
- jhatemyjob 3y agoNot satire. 100% serious. It's made for people like you.
- deleted 3y ago[deleted]
- layer8 3y ago> C is a straightforward, non-mustachioed language. Don’t all the curly braces count as mustaches?