Hey really cool. Am proficient in Rust if you need any help.
Show HN: I'm rewriting a web server written in Rust for speed and ease of use
61–70 of 100 posts
Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use
#62Earlier quoted context omitted.
That's true, but that's not what's front and center. Curl-sudo-bash is the first thing you see on the site, all the other options are close to the bottom of the page. Defaults matter and people tend to use whatever is the first option presented to them unless they have a good reason to do otherwise.
> using repo provided by ferron This poses a similar security risk to executing the "curl-sudo-bash".
Yeah I point that out too in a sibling comment.
My personal opinion is that curl pipe to bash is not much worse than any other third-party binary installation method. (Third-party meaning from a source other than the package repo of your distro, or other than brew, or other than some kind of official App Store like thing on your platform.)
If this project isn’t already available in the official package repos of various distros, it will eventually be. And for those more cautious among us you will probably want to wait until that point in time.
For me personally I wouldn’t have any big concerns about the curl pipe bash install method on some of my servers. On my personal laptop (macOS), I’d probably rather build it from source (which is also a method available since it’s open source).
Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use
#63Great to see! Would love to try it, but I depend on graceful updates of configuration (i.e. adding and removing backends primarily). I can't find anything about that. Is it supported, either through updating configs or through API?
Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use
#64I know it's not popular to care about these things these days, but please consider a different installation mechanism than curl piped into sudo bash. It's irresponsible and normalizes a practice that never should've happened.
I care about these things.
But this is overblown. What’s your threat model here, you’re downloading a random thing from the internet and executing it. 99% of people are on single user machines, so root access doesn’t help, you’re screwed just by executing the thing if it’s malicious. Doing this is no worse than installing and running a random deb, or running npm install
Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use
#65So I have to connect my domain to your IP adres? Why there is perfectly fine HTTP auth method for let's encrypt. This is strange and not necessary.
Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use
#66So I have to connect my domain to your IP adres? Why there is perfectly fine HTTP auth method for let's encrypt. This is strange and not necessary.
Well, you're probably talking about the automatic TLS demo. People installing Ferron on their servers don't have to use this demo!
Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use
#67Earlier quoted context omitted.
That's true, but that's not what's front and center. Curl-sudo-bash is the first thing you see on the site, all the other options are close to the bottom of the page. Defaults matter and people tend to use whatever is the first option presented to them unless they have a good reason to do otherwise.
> using repo provided by ferron This poses a similar security risk to executing the "curl-sudo-bash".
Yeah, it can be risky if Ferron servers get somehow compromised...
The best bet would be using official distro repositories...
But for now, I'm providing the .deb packages, so that people can easily install Ferron on Debian and alike.
Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use
#68Earlier quoted context omitted.
But you have to. Nginx, caddy, traefik, etc cannot run without root or even if you can, it would be way more limiting
Only for binding to ports under 1024 really, like 80 (http) and 443 (https). Once it has bound to the ports it can drop down to running as a low-privilege user (usually named www or httpd or similar). On Linux you can allow your program to bind to those ports even without running the program itself as root. https://superuser.com/questions/710253/allow-non-root-proces...
When installed for example with the installer script, Ferron would run on a specialized user for running the web server. Ferron itself would also have "CAP_NET_BIND_SERVICE" capability set on its binary, so that it doesn't have to run as root.
Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use
#69Earlier quoted context omitted.
> That doesn't inspire confidence. The problems start even higher on the page in "The problem with popular web servers" section that doesn't inspire confidence either. From "nginx configs can become verbose" (because nginx is not "just" a web server [1]) to non-sequiturs like "Many popular web servers (including Apache and NGINX) are written in programming languages and use libraries that aren't designed for memory s…
its funny he mentions unsafe code in apache and nginx and then complains about openSSL bug (one thats more than 10 years old btw). if this is a sense of the logic put into the application, no memory safe language will save it from the terrible bugs!
Heartbleed might be more than 10 years old, but it was a serious vulnerability indeed...
From https://www.heartbleed.com
> The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.
Also, the program being memory-safe doesn't mean it's bug-free, other bugs not related to memory safety exist (like path traversals are due to improper sanitation or checking of the input).
Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use
#70Edit : just tried it for serving a fastapi. It's fantastic. Instant TLS via Let's Encrypt. There may be other webservers that are equally easy, but this one is certainly easier than Apache or ngninx, which I used so far. Love it. -- Reach out to the guys at Kamal. They wrote their own reverse proxy because they thought Traefik was too complex, but they might be super happy about yours if Ferron is more powerful yet e…
Thank you so much! I want to put a line from your comment on Ferron's website as social proof. :)