Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AsmBB – a lightweight web forum engine written in assembly language

asmbb.org

Post reply on HN
Print view View original

41–50 of 131 posts

Re: AsmBB – a lightweight web forum engine written in assembly language

#41

Post by ChuckMcM »

I like this, and kudos for going for assembly language. It is certainly true that reducing dependencies reduces the attack surface for something, that does not, in and of itself, make it "secure". But yes, in a probabilistic sort of way it reduces the chances of exploits. Of course assembly language has zero memory safety or other guarantees which probabilistically increases risk. I can't say if I think they balance out one way or the other. Still, I love me some assembly language applications. For extra credit transpile it to aarch64 and then you can run it on a Pi-Zero (or Pi-W) in a wall wart :-).

I have been researching, off and on, distributed forums. As forums like the one created here became the "go to" after Usenet fell out of favor I have thought a replacement would have both the distribution/replication features of Usenet and the user experience of phpBB (the grandparent of most forum software).

Making it distributed, and eventually consistent, is an excellent distributed systems challenge. So it is kind of like relaxing to a puzzle. If you, gentle reader, have written something along those lines I'd love to have a look.

Re: AsmBB – a lightweight web forum engine written in assembly language

#42

Post by abestic9 »

tasn wrote: post #37

This is super cool, though I very much doubt the following statement: > AsmBB is very secure web application, because of the internal design and the reduced dependencies. There's a lot of value in using well tested dependencies, and even Chuck Norris will have bugs writing complex software in assembly. Especially when doing string manipulation which this project should be doing a lot of.

I was rubbed the wrong way with that line too, such claims usually set off red flags, but the OP appears to not write English natively so they might have legitimately missed out some tempering.

e.g. "AsmBB focuses on security in its design and reduced reliance on dependencies."

Re: AsmBB – a lightweight web forum engine written in assembly language

#43

Post by 10000truths »

ChuckMcM wrote: post #41

I like this, and kudos for going for assembly language. It is certainly true that reducing dependencies reduces the attack surface for something, that does not, in and of itself, make it "secure". But yes, in a probabilistic sort of way it reduces the chances of exploits. Of course assembly language has zero memory safety or other guarantees which probabilistically increases risk. I can't say if I think they balance…

> Of course assembly language has zero memory safety or other guarantees which probabilistically increases risk. I can't say if I think they balance out one way or the other.

I would posit that assembly + Linux kernel ABI is safer than the traditional C/C++ stack because they are not littered with nearly as much "undefined behavior". Signed arithmetic overflows and underflows as expected. Memory allocation with mmap + MAP_ANONYMOUS initializes it to 0 as expected. Accessing unmapped memory in your address space (including address 0) triggers a SIGSEGV as expected. Your assembler makes much fewer assumptions than your C compiler and doesn't try to be half as clever, so it's more likely to crash and burn on error instead of silently subverting your expectations.

Re: AsmBB – a lightweight web forum engine written in assembly language

#45

Post by Karrot_Kream »

jansommer wrote: post #18

Processing time is insanely fast according to the footer. But the time it takes to transfer the document to Denmark is 500 - 1000ms. Seems like a CDN is better than performant code in this case... Still an impressive feat.

Coming from leading response time initiatives at a Big Tech, ouch. 1s is painful. Obviously transit time is a big part of that but if that's considered "good", well oof.

Re: AsmBB – a lightweight web forum engine written in assembly language

#47

Post by mgaunard »

tasn wrote: post #37

This is super cool, though I very much doubt the following statement: > AsmBB is very secure web application, because of the internal design and the reduced dependencies. There's a lot of value in using well tested dependencies, and even Chuck Norris will have bugs writing complex software in assembly. Especially when doing string manipulation which this project should be doing a lot of.

I disagree; dependencies are more of a liability than anything else.

Re: AsmBB – a lightweight web forum engine written in assembly language

#48

Post by mgaunard »

10000truths wrote: post #43
ChuckMcM wrote: post #41

I like this, and kudos for going for assembly language. It is certainly true that reducing dependencies reduces the attack surface for something, that does not, in and of itself, make it "secure". But yes, in a probabilistic sort of way it reduces the chances of exploits. Of course assembly language has zero memory safety or other guarantees which probabilistically increases risk. I can't say if I think they balance…

> Of course assembly language has zero memory safety or other guarantees which probabilistically increases risk. I can't say if I think they balance out one way or the other. I would posit that assembly + Linux kernel ABI is safer than the traditional C/C++ stack because they are not littered with nearly as much "undefined behavior". Signed arithmetic overflows and underflows as expected. Memory allocation with mmap…

This isn't a problem in practice because C++ developers are expected to know the rules of their language and respect them.

Re: AsmBB – a lightweight web forum engine written in assembly language

#49

Post by nineteen999 »

pengaru wrote: post #25
andoando wrote: post #9

Man how do you even connect to a db with assembly code? Are there assembly libraries? In theory I understand it but the monumental amount of effort it would take to write such “simple” things would take so much time

C is generally first compiled into assembly anyways. When you program in assembly you're basically just doing the job of the compiler, and can call all the same library functions C code can. You just have to follow the calling conventions of the architecture. It's cumbersome and tedious, but nowhere near impossible. x64 made calling functions more annoying by using registers then spilling over into the stack after ex…

> x32 was more pleasant by far, since it only used the stack

Maybe I misunderstand you, but this is completely dependent on compiler, operating system etc, there are multiple calling conventions for x86-32, eg. cdecl, fastcall ...

https://en.wikipedia.org/wiki/X86_calling_conventions

Re: AsmBB – a lightweight web forum engine written in assembly language

#50

Post by kristianp »

pengaru wrote: post #25
andoando wrote: post #9

Man how do you even connect to a db with assembly code? Are there assembly libraries? In theory I understand it but the monumental amount of effort it would take to write such “simple” things would take so much time

C is generally first compiled into assembly anyways. When you program in assembly you're basically just doing the job of the compiler, and can call all the same library functions C code can. You just have to follow the calling conventions of the architecture. It's cumbersome and tedious, but nowhere near impossible. x64 made calling functions more annoying by using registers then spilling over into the stack after ex…

> C is generally first compiled into assembly anyways.

I don't think that's right. C is compiled into an intermediate representation first. It's true that you can ask GCC etc. to generate assembly output, but it's not the default.

Post reply on HN