Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rocket – Simple, Fast, Type-Safe Web Framework for Rust

rocket.rs

Post reply on HN
Print view View original

41–49 of 49 posts

Re: Rocket – Simple, Fast, Type-Safe Web Framework for Rust

#41

Post by Shish2k »

Shish2k wrote: post #9

From a quick glance it seems still vulnerable to trivial slowloris’ing D: Is anybody actually exposing their rust-based websites to the internet? I want to, but it seems that for some reason every rust web framework keeps TCP connections open _forever_, meaning that even with file descriptors bumped to 64000, my web server runs out of FDs and needs to be killed and restarted every 3 hours or so. The standard advice s…

As a point of reference, Go was considered “safe to expose to the internet” in 2016, and I’d really like Rust to be in the same position: https://blog.cloudflare.com/exposing-go-on-the-internet/

Re: Rocket – Simple, Fast, Type-Safe Web Framework for Rust

#42

Post by piperswe »

Shish2k wrote: post #40
ecmascript wrote: post #10

Earlier quoted context omitted.

How do you handle https if you don't? Do you use certs directly in code? Also, do you use LetsEncrypt or do you actually pay for certs? I have been developing websites all my grown life and I always put them behind a reverse-proxy. That has never been the culprit of any slowdowns in my experience and nginx is very, very fast and supports everything you may want to have. I usually nowadays reach for caddy just because…

> How do you handle https if you don't? All of the code is here: https://github.com/shish/shm-cached/blob/main/src/tcp.rs Two async functions - one listens on port 80, and forwards requests into the business logic; one listens on port 443 (grabbing a certificate from Let’s Encrypt if it doesn’t have an up-to-date one in the cache), decrypts the SSL, and forwards requests into the business logic. Before I gave up and…

Cloudflare R2 might work well for you for serving the image files themselves, there's a per-request fee ($0.36/million GETs) but no bandwidth fees. AFAIK there's no restriction on NSFW content on any Cloudflare service, as long as it's legal.

Disclaimer: I work for CF, but not on a team related to R2. I'm just speaking as a CF enthusiast here.

Re: Rocket – Simple, Fast, Type-Safe Web Framework for Rust

#43

Post by Shish2k »

piperswe wrote: post #42
Shish2k wrote: post #40

Earlier quoted context omitted.

> How do you handle https if you don't? All of the code is here: https://github.com/shish/shm-cached/blob/main/src/tcp.rs Two async functions - one listens on port 80, and forwards requests into the business logic; one listens on port 443 (grabbing a certificate from Let’s Encrypt if it doesn’t have an up-to-date one in the cache), decrypts the SSL, and forwards requests into the business logic. Before I gave up and…

Cloudflare R2 might work well for you for serving the image files themselves, there's a per-request fee ($0.36/million GETs) but no bandwidth fees. AFAIK there's no restriction on NSFW content on any Cloudflare service, as long as it's legal. Disclaimer: I work for CF, but not on a team related to R2. I'm just speaking as a CF enthusiast here.

Interesting~ Last time I spoke to somebody from CF we were too big for the regular plans and too small for the “call us on the phone and we’ll discuss a custom contract” plan, but it has been a couple of years so maybe worth looking at the newer services :)

Re: Rocket – Simple, Fast, Type-Safe Web Framework for Rust

#44

Post by piperswe »

Shish2k wrote: post #43
piperswe wrote: post #42

Earlier quoted context omitted.

Cloudflare R2 might work well for you for serving the image files themselves, there's a per-request fee ($0.36/million GETs) but no bandwidth fees. AFAIK there's no restriction on NSFW content on any Cloudflare service, as long as it's legal. Disclaimer: I work for CF, but not on a team related to R2. I'm just speaking as a CF enthusiast here.

Interesting~ Last time I spoke to somebody from CF we were too big for the regular plans and too small for the “call us on the phone and we’ll discuss a custom contract” plan, but it has been a couple of years so maybe worth looking at the newer services :)

I'd say R2's definitely worth a look, since it works quite well standalone (without other CF services). If the public pricing works well for you, there's no real benefit to an Enterprise contract or anything; the product should Just Work and arbitrarily scale.

Re: Rocket – Simple, Fast, Type-Safe Web Framework for Rust

#45

Post by remram »

Shish2k wrote: post #9

From a quick glance it seems still vulnerable to trivial slowloris’ing D: Is anybody actually exposing their rust-based websites to the internet? I want to, but it seems that for some reason every rust web framework keeps TCP connections open _forever_, meaning that even with file descriptors bumped to 64000, my web server runs out of FDs and needs to be killed and restarted every 3 hours or so. The standard advice s…

On the one hand, it would be nice to be able to handle clients connections directly, for a lot of special use cases or performance-sensitive situations.

On the other hand, I don't know if it makes sense to have to expose all those security or rate-limiting settings for every application. Every app would have its own way to set supported ciphers, rate limits, request duration and size limits, revocation lists, etc.

Re: Rocket – Simple, Fast, Type-Safe Web Framework for Rust

#46

Post by lemper »

bluejekyll wrote: post #39
lemper wrote: post #18

Earlier quoted context omitted.

rocket and flight terms. mount? is it a horse? launch? well, it's a rocket. fairings? good thing they don't introduce cable installation. i'd rather use haskellin instead of rust if we're talking about "correctness" and "stability", whatever those are.

Then why not use Haskell?

you bet i do.

Re: Rocket – Simple, Fast, Type-Safe Web Framework for Rust

#47

Post by ecmascript »

estebank wrote: post #32
ecmascript wrote: post #14

What got me interested in Rocket was from this talk (a great talk btw): https://youtu.be/lBQHrj6vwAo?feature=shared&t=1934 (A Case for Oxidation) The main selling point for me was that Rocket made security threats (XSS, SQL injection etc) impossible by guarantees which was a bit mind blowing imo. It is a bit like database guarantees which is insanely useful as an application grows. Is this still the case with Rocket…

> I mean, Rust is fast and secure and makes my software "unhackable" for the price of a bit slower development? Seems like an obvious choice then. Something being written in Rust doesn't mean it's unhackable. It lowers the likelihood of memory safety errors to the point of them being negligible, and a lot libraries will have APIs that encourage correct usage by default. But your application can still have a bug, and…

I know, I think you misread what I meant. I mean that even if it isn't unhackable due to bugs you can do in runtime, that it can guarantee stuff like no SQL Injection and possible no XSS if it compiles is pretty amazing.

But maybe that is pretty much the same as other frameworks in other languages provide also but the difference is that it's not guaranteed by the compiler.

Re: Rocket – Simple, Fast, Type-Safe Web Framework for Rust

#48

Post by eYrKEC2 »

Shish2k wrote: post #41
Shish2k wrote: post #9

From a quick glance it seems still vulnerable to trivial slowloris’ing D: Is anybody actually exposing their rust-based websites to the internet? I want to, but it seems that for some reason every rust web framework keeps TCP connections open _forever_, meaning that even with file descriptors bumped to 64000, my web server runs out of FDs and needs to be killed and restarted every 3 hours or so. The standard advice s…

As a point of reference, Go was considered “safe to expose to the internet” in 2016, and I’d really like Rust to be in the same position: https://blog.cloudflare.com/exposing-go-on-the-internet/

It is fine to expose Rust to the internet. We do so at my company. The python api at our company is more worrysome than the rust-written api.

Re: Rocket – Simple, Fast, Type-Safe Web Framework for Rust

#49

Post by pdimitar »

satvikpendem wrote: post #35

I know they recently released 0.5 which finally works with stable Rust, among other things, but it really is "too little, too late" for me, as I've since moved onto first Actix Web then onto Axum. There is something to be said for rapid development rather than waiting to release big releases every other year. This is similar to the discussion of Elm a few days ago, where I left it because we needed critical bugs to b…

Would you be so kind so as to share why did you move from ActixWeb to Axum?
Post reply on HN