Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: I'm rewriting a web server written in Rust for speed and ease of use

ferron.sh

Post reply on HN
Print view View original

91–100 of 100 posts

Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use

#91

Post by sim7c00 »

dorianniemiec wrote: post #69
sim7c00 wrote: post #24

Earlier quoted context omitted.

its funny he mentions unsafe code in apache and nginx and then complains about openSSL bug (one thats more than 10 years old btw). if this is a sense of the logic put into the application, no memory safe language will save it from the terrible bugs!

Heartbleed might be more than 10 years old, but it was a serious vulnerability indeed... From https://www.heartbleed.com > The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual…

still doesnt have anything to do with the webservers that used openSSL. If ferror was sanely coded and super secure but used openssl (or another vulnerable library for similar purposes --- does ferron roll its own crypto??) then it would be similarly impacted. it's memory safety features not useful since its using FFI to go into openssl.

not sure if there is already a true rust TLS implementation - that might be useful for such a case but would also make the point a moot-point since its just evading the risk by not using it, not by solving the issue of memory issues being present in third-party libraries.

Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use

#92

Post by npodbielski »

dorianniemiec wrote: post #85
npodbielski wrote: post #84

Earlier quoted context omitted.

No, I do not think so. In the linked page there is mention: "Point a subdomain named ferrondemo of your domain name (for example, ferrondemo.example.com) to either: CNAME demo.ferron.sh or A 194.110.4.223" This is really strange and make my Spidey sense tingle. If the goal is to just point your domain to this server it should not require DNS auth. Just HTTP is fine. DNS sure if you want optimize reverse proxy, becaus…

> If you just need some www server quickly pointing your domain to some other dude domain is not the way to go. Yeah. But as I said before, people installing Ferron on their servers don't need to use this demo. Oh, and people using this demo don't need to install Ferron on their servers. I just added two notices to this demo: > Note: After completing the demo, it's recommended to delete the subdomain you have just cr…

Oh you are the author.

I think we do not understand each other. Look at this: https://letsencrypt.org/docs/challenge-types/#http-01-challe...

If this is for demo, even more DNS is not necessary. Just code your web server to serve challenge for that particular Uri, and you are done. I do not think so that you need wildcard cert for the demo. Just fixed subdomain is fine. Also you do not have to wait for DNS to propagate with HTTP method.

Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use

#93

Post by dorianniemiec »

sim7c00 wrote: post #91
dorianniemiec wrote: post #69

Earlier quoted context omitted.

Heartbleed might be more than 10 years old, but it was a serious vulnerability indeed... From https://www.heartbleed.com > The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual…

still doesnt have anything to do with the webservers that used openSSL. If ferror was sanely coded and super secure but used openssl (or another vulnerable library for similar purposes --- does ferron roll its own crypto??) then it would be similarly impacted. it's memory safety features not useful since its using FFI to go into openssl. not sure if there is already a true rust TLS implementation - that might be usef…

Ferron uses a different library for TLS - Rustls.

You can read how Rustls compares to other TLS implementations, when it comes to implementation vulnerabilities, from the Rustls manual: https://docs.rs/rustls/latest/rustls/manual/_01_impl_vulnera...

Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use

#94

Post by dorianniemiec »

HumanOstrich wrote: post #90

Your title is confusing. It sounds like you are rewriting a web server _already_ written in Rust to a _different_ language. Now that I'd be in favor of. "It's written in Rust so it's memory safe!"

Ah... I also saw one more person confused about the title...

By the way the rewrite is still in Rust.

Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use

#95

Post by renshijian »

Ferron provides a concise and efficient way to handle state management in front-end frameworks. It adopts a responsive design concept and can greatly simplify the development process of complex applications. Its clear API and lightweight architecture allow developers to quickly implement dynamic interfaces without sacrificing performance. Overall, it is a tool worth paying attention to in modern front-end development, especially for projects with high performance requirements

Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use

#96

Post by alexnewman »

dns_snek wrote: post #52
alexnewman wrote: post #49

Earlier quoted context omitted.

Read how Tls works. Many people Can mitm. That’s why we sign applications

If they can MITM the installation script delivered over HTTPS, they can also MITM the website delivered over HTTPS. You can have 10 step instructions for users to add your PGP signing key and install your APT repository, but what difference does it make? None at all. A malicious website will copy your instructions and replace the signing key and the repository URL with their own.

No because the apps are signed and have it's own chain of trust independent of tls

Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use

#97

Post by alexnewman »

Sohcahtoa82 wrote: post #86
alexnewman wrote: post #49

Earlier quoted context omitted.

Read how Tls works. Many people Can mitm. That’s why we sign applications

I've read how TLS works. No, you can't MITM it unless your server or client have been altered to be deliberately insecure (ie, having a server with a self-signed certificate or a client that doesn't verify certificates). If you could, the entire internet would be broken.

What happens when your certificate authority goes after you

Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use

#98

Post by earthnail »

dorianniemiec wrote: post #70
earthnail wrote: post #2

Edit : just tried it for serving a fastapi. It's fantastic. Instant TLS via Let's Encrypt. There may be other webservers that are equally easy, but this one is certainly easier than Apache or ngninx, which I used so far. Love it. -- Reach out to the guys at Kamal. They wrote their own reverse proxy because they thought Traefik was too complex, but they might be super happy about yours if Ferron is more powerful yet e…

Thank you so much! I want to put a line from your comment on Ferron's website as social proof. :)

Absolutely, go for it. Feel free to use my real name if you want to: https://linkedin.com/in/tcwalther

I previously founded and sold an AI startup to Spotify; that doesn't actually make me smarter than the average HN user (mostly just more lucky) but it probably looks nice on a social proof section.

Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use

#99

Post by dorianniemiec »

renshijian wrote: post #95

Ferron provides a concise and efficient way to handle state management in front-end frameworks. It adopts a responsive design concept and can greatly simplify the development process of complex applications. Its clear API and lightweight architecture allow developers to quickly implement dynamic interfaces without sacrificing performance. Overall, it is a tool worth paying attention to in modern front-end development…

But Ferron isn't a state management library for front-end frameworks, it's a web server!
Post reply on HN