5 ms·

I actually wonder what the market is like for a C++ web framework. In principle I like the idea of a framework built using a compiled language, but I imagine it

I actually wonder what the market is like for a C++ web framework. In principle I like the idea of a framework built using a compiled language, but I imagine it'd be far easier to write a vulnerable application.

nakkiel 14y ago
OkCupid use their own event-driven C++ web server framework for their website. I don't remember to what extent but it at least powers specific features such as Chat ans Search; I can't guarantee they use it for the pages of the website but I'd say they do (there are a couple of presentation but I read them long ago). > http://okws.org/ http://okws.org/
- Sidnicious 14y ago
  We do use okws for the whole website. It's more work to use than a framework like, say, Rails but it's well-designed and has some great features. For instance, it includes a templating language called Pub. A typical request hits a handler in C++-land which collects the data the page'll need into a top-level Pub object. Then it invokes a Pub template which renders the page. All of this enforces separation between your back-end logic and the design of a page. It would be awesome to see more frameworks with fresh ideas in this area, though.
dllthomas 14y ago
> I like the idea of a framework built using a compiled language[.] Check out yesod (www.yesodweb.com). > I imagine it'd be far easier to write a vulnerable application. In C++, probably, yes. In Haskell, not so much.
- kintamanimatt 14y ago
  Why is that? I know nothing about Haskell.
  - dllthomas 14y ago
    More rigid static type safety, mostly. Haskell doesn't allow you to accidentally cast something to the wrong pointer, or accidentally index off the end of an array, or similar things to which C++ is vulnerable but which modern interpreted languages protect you against. Meanwhile, Haskell's sophisticated type system lets you enforce rules that help make sure you don't accidentally pass an unescaped string to your database or user's browser, which kinds of errors are rife in even those sites developed in interpreted languages. Yesod leverages this extensively. On reflection, I think C++'s templates may be powerful enough to let you do similar, really, but 1) it is likely to be incredibly verbose, 2) you are still potentially vulnerable to the pointer or buffer related errors mentioned above, and 3) in my experience people don't generally write C++ that way - it'll be interesting to see what they've done here, though.

nakkiel 14y ago

OkCupid use their own event-driven C++ web server framework for their website. I don't remember to what extent but it at least powers specific features such as Chat ans Search; I can't guarantee they use it for the pages of the website but I'd say they do (there are a couple of presentation but I read them long ago). > http://okws.org/ http://okws.org/

Sidnicious 14y ago
We do use okws for the whole website. It's more work to use than a framework like, say, Rails but it's well-designed and has some great features. For instance, it includes a templating language called Pub. A typical request hits a handler in C++-land which collects the data the page'll need into a top-level Pub object. Then it invokes a Pub template which renders the page. All of this enforces separation between your back-end logic and the design of a page. It would be awesome to see more frameworks with fresh ideas in this area, though.

dllthomas 14y ago

> I like the idea of a framework built using a compiled language[.] Check out yesod (www.yesodweb.com). > I imagine it'd be far easier to write a vulnerable application. In C++, probably, yes. In Haskell, not so much.

kintamanimatt 14y ago
Why is that? I know nothing about Haskell.
- dllthomas 14y ago
  More rigid static type safety, mostly. Haskell doesn't allow you to accidentally cast something to the wrong pointer, or accidentally index off the end of an array, or similar things to which C++ is vulnerable but which modern interpreted languages protect you against. Meanwhile, Haskell's sophisticated type system lets you enforce rules that help make sure you don't accidentally pass an unescaped string to your database or user's browser, which kinds of errors are rife in even those sites developed in interpreted languages. Yesod leverages this extensively. On reflection, I think C++'s templates may be powerful enough to let you do similar, really, but 1) it is likely to be incredibly verbose, 2) you are still potentially vulnerable to the pointer or buffer related errors mentioned above, and 3) in my experience people don't generally write C++ that way - it'll be interesting to see what they've done here, though.