Show HN: unsafehttp – tiny web server from scratch in C, running on an orange pi • Hacker News Board

Re: Show HN: unsafehttp – tiny web server from scratch in C, running on an orange pi

#51

Post by SJC_Hacker » Mon, Aug 18, 2025, 3:17 AM UTC

integralid wrote: post #45

SJC_Hacker wrote: post #34

Easiest way to make it safe is 1) Run it in a container 2) Isolate it through a reverse proxy, probably nginx

This doesn't make it safe. It can still be exploited and used to join a botnet, as a proxy, to mine cryptocurrency, to spy on requests or redirect users to malicious websites or phish them, to host malware...

Maybe but at least the damage is isolated … can always just restart container

Also I’m curious how a bonnet can get through a container … outgoing connections should be blocked by default

Re: Show HN: unsafehttp – tiny web server from scratch in C, running on an orange pi

#52

Post by tom_ » Mon, Aug 18, 2025, 9:25 AM UTC

integralid wrote: post #46

tom_ wrote: post #28

Earlier quoted context omitted.

Parsing HTTP is entirely unnecessary. That's the web client's job.

Do you mean parsing HTML? HTTP is the protocol they use to communicate, so both client and server must speak it. Or did I misunderstand you?

No, brain fart on my part. You can use llhttp, which is pretty easy to use: https://github.com/nodejs/llhttp

Re: Show HN: unsafehttp – tiny web server from scratch in C, running on an orange pi

#53

Post by chuckadams » Wed, Aug 20, 2025, 5:19 PM UTC

contingencies wrote: post #16

Are you near Sydney? I noted a possible link to the Central Coast. I will contribute a smaller device if you're game to host it. PS. You may be unaware that your shortened domain name 'benren' from your whois-available real name means "stupid person" in Mandarin. Only noted because there is a company registered with the same name since 1999. On the off chance it's yours, probably not the best marketing in a global wo…

Considering how much of even the English-speaking world is using a version control system named git…

Re: Show HN: unsafehttp – tiny web server from scratch in C, running on an orange pi

#54

Post by binaryturtle » Fri, Aug 22, 2025, 9:30 PM UTC

201984 wrote: post #12

binaryturtle wrote: post #10

Earlier quoted context omitted.

If they are behind a NAT/ stateful firewall there is just so much connections it will handle at once. I think OpenWRT has like 16K max by default, f.ex. So for less than 16K requests by different users/IPs… each is kept for about 1 minute I think… it quickly will go down, I guess. :) cat /proc/sys/net/netfilter/nf_conntrack_max Should give some details.

Do you know if using the DMZ feature on most routers instead of port forwarding would get around this limit, or if there's any other way?

With OpenWRT we can increase the limit, if needed. But it's a delicate process you need to balance out carefully depending on your router. I doubled my slots and it works fine:

It's done via /etc/sysctl.conf

> net.netfilter.nf_conntrack_max=32768

Afterwards "sysctl -p" to apply/ reload the config file. But increasing blindly is a bad idea… it needs to be done with ip_conntrack_buckets in sync for proper balance (memory use, CPU usage). Best to read upon it.

But just going from 16K to 32K shouldn't be any problem for most routers these days.