Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A fast and static web server for serving web apps

shortfin.io

Post reply on HN
Print view View original

41–50 of 135 posts

Re: A fast and static web server for serving web apps

#41

Post by tlrobinson »

ChuckMcM wrote: post #36

Close. Can add this to the list like thttpd. Something I keep thinking I'll build is a fast, high connection count, limited HTTP server, something that is essentially a wrapper around a program that works like 'regular' and emits HTML. It is a corner case in a custom corner, but the target it something which is essentially a 'transponder.' In the 'Internet of Things' I want to build a wrapper/environment such that my…

"easily wrapped around a 'regular' program"

Sounds like you want CGI :)

Re: A fast and static web server for serving web apps

#42

Post by lstamour »

tlrobinson wrote: post #32
ebbv wrote: post #27

Earlier quoted context omitted.

It's a lot worse than the standard configure, make and make install. For one, it's only requiring one simple script to get compromised and replaced to compromise your entire machine. At least when I download the tarball, unpack it, etc. I've got several steps before I even get to the make install that I would run as root. And I might not even do that depending on my install target. If I do, I have ample opportunity t…

"Provide an install tarball and provide a checksum of it that we can verify." https://github.com/timothyej/Shortfin My point was the people who are going to blindly run curl/sh commands are also going to blindly download the source tarball and run configure/make/make install, and the people who want to do more verification are certainly free to do so.

I wonder how much work it would be to modify that one-liner to include an MD5 or SHA1 check? Of course it might then be shell and OS-specific...

Unless curl or wget can confirm the sha1? Oh... found it! http://superuser.com/questions/453823/is-there-a-tool-that-a...

Re: A fast and static web server for serving web apps

#43

Post by ebbv »

tlrobinson wrote: post #32
ebbv wrote: post #27

Earlier quoted context omitted.

It's a lot worse than the standard configure, make and make install. For one, it's only requiring one simple script to get compromised and replaced to compromise your entire machine. At least when I download the tarball, unpack it, etc. I've got several steps before I even get to the make install that I would run as root. And I might not even do that depending on my install target. If I do, I have ample opportunity t…

"Provide an install tarball and provide a checksum of it that we can verify." https://github.com/timothyej/Shortfin My point was the people who are going to blindly run curl/sh commands are also going to blindly download the source tarball and run configure/make/make install, and the people who want to do more verification are certainly free to do so.

Yes people are going to dumb things. But that doesn't mean you need to encourage and facilitate it. That's my point. If you know better you should be facilitating the proper way to do it, not the worst way.

Re: A fast and static web server for serving web apps

#44

Post by timothy89 »

babuskov wrote: post #4

I don't get it. You create a server to solve C10K problem, and then host its own website with nginx? Why? Having HN crowd coming and testing your server would be a great test, no?

I host more websites on the same server and as kajecounterhack said I'm using nginx as a reverse proxy. The server is fast and have no problems at all with the HM crowd ;)

Re: A fast and static web server for serving web apps

#45

Post by chc »

rsync wrote: post #37
chc wrote: post #23

Earlier quoted context omitted.

I don't see any rational basis for this. If you weren't vetting the code you downloaded before, you don't lose anything by blindly running the commands on one line instead of three. And if you do want to vet the code, you know what to do. Practically no installation instructions include a "vet the code" step, so you aren't losing anything here. The lack of TLS is worrisome, but that's not so much "becoming a thing" a…

Although this isn't new, it should make you throw up in your mouth a little bit. Malicious compromise is not the only way that an install script can become broken, or corrupted, on a remote site. The ability to checksum what you're running is a very useful sanity check and you should be doing it with all downloaded scripts/packages. I suppose this is tilting at windmills, though.

> Malicious compromise is not the only way that an install script can become broken, or corrupted, on a remote site. The ability to checksum what you're running is a very useful sanity check and you should be doing it with all downloaded scripts/packages.

Yes, and you still can do that. But the standard installation instructions almost never include it. For example, nginx's build instructions boil down to "run configure, possibly with some flags, and then run make and/or make install". That includes the exact same vulnerability you complain of here — it never tells you to checksum anything. This is true for essentially all the software I've ever downloaded. So again, still not "becoming a thing."

The assumption is that if you're the sort of person who customarily checks code before they install it, you know how to inject that step.

Re: A fast and static web server for serving web apps

#46

Post by eksith »

ChuckMcM wrote: post #36

Close. Can add this to the list like thttpd. Something I keep thinking I'll build is a fast, high connection count, limited HTTP server, something that is essentially a wrapper around a program that works like 'regular' and emits HTML. It is a corner case in a custom corner, but the target it something which is essentially a 'transponder.' In the 'Internet of Things' I want to build a wrapper/environment such that my…

I had an idea like this when I thought about creating a small server on an Arduino that I can use to control/get status updates for a pellet stove for my cabin (TBA).

Luckily, there's already code for that, in case you're interested : http://arduino.cc/en/Tutorial/WebServer

Re: A fast and static web server for serving web apps

#47

Post by joeblau »

I just ran two speed tests since there aren't any benchmarks provided

1. First Test is using http://www.webpagetest.org/

Results shortfin.io:88 - http://www.webpagetest.org/result/130806_71_13HK/

  First View: 1.945s
  Repeat View: 1.632s
Results shortfin.io - http://www.webpagetest.org/result/130806_QV_13F7/

  First View	2.099s	
  Repeat View	0.084s
2. Second Test is using Apache Bench

Results (Best results of 3 runs): ab -n 100 -c 100 http://shortfin.io:88/

  Time taken for tests:   12.125 seconds
  Requests per second:    8.25 [#/sec] (mean)
  Time per request:       12124.501 [ms] (mean)
  Time per request:       121.245 [ms] (mean, across all concurrent requests)
  Transfer rate:          38.46 [Kbytes/sec] received

  Connection Times (ms)
              min  mean[+/-sd] median   max
  Connect:      210 1114 1517.2    360    4041
  Processing:  5017 8407 2034.0   8715   11762
  Waiting:      169 1084 3054.8    188   11408
  Total:       9057 9521 1068.7   9058   12123
Results (Best results of 3 runs): ab -n 100 -c 100 http://shortfin.io/

  Time taken for tests:   5.790 seconds
  Requests per second:    17.27 [#/sec] (mean)
  Time per request:       5789.949 [ms] (mean)
  Time per request:       57.899 [ms] (mean, across all concurrent requests)
  Transfer rate:          82.97 [Kbytes/sec] received

  Connection Times (ms)
                min  mean[+/-sd] median   max
  Connect:      171  249  35.7    263     290
  Processing:   172 1798 2345.5    212    5524
  Waiting:      170 1055 1825.1    212    4949
  Total:        344 2047 2368.2    469    5789

Re: A fast and static web server for serving web apps

#48

Post by ebbv »

skrebbel wrote: post #38
ebbv wrote: post #27

Earlier quoted context omitted.

It's a lot worse than the standard configure, make and make install. For one, it's only requiring one simple script to get compromised and replaced to compromise your entire machine. At least when I download the tarball, unpack it, etc. I've got several steps before I even get to the make install that I would run as root. And I might not even do that depending on my install target. If I do, I have ample opportunity t…

I'm a Windows user. Virtually every piece of software I install comes in the form of an executable, that I download-and-run directly from the browser. I often give this executable administrator priviledges. The executable can then do whatever it wants on my computer. Usually it will install said piece of software (except when it was made by Oracle, it'll install said software and the Ask.com toolbar) This has been st…

You're giving those executables full control over your computer. Yeah, you won't get burned very often (depending on where you're getting these executables.) But when you do get burned it's going to be catastrophic. That's the problem.

It's a bad practice.

Re: A fast and static web server for serving web apps

#49

Post by ChuckMcM »

tlrobinson wrote: post #41
ChuckMcM wrote: post #36

Close. Can add this to the list like thttpd. Something I keep thinking I'll build is a fast, high connection count, limited HTTP server, something that is essentially a wrapper around a program that works like 'regular' and emits HTML. It is a corner case in a custom corner, but the target it something which is essentially a 'transponder.' In the 'Internet of Things' I want to build a wrapper/environment such that my…

"easily wrapped around a 'regular' program" Sounds like you want CGI :)

Yes, "static CGI" if such a thing was a thing :-). I've got a thttpd tree that I do this sort of hack in (these are great for monitoring large numbers of servers for example).

Re: A fast and static web server for serving web apps

#50

Post by chc »

eksith wrote: post #39
chc wrote: post #23

Earlier quoted context omitted.

I don't see any rational basis for this. If you weren't vetting the code you downloaded before, you don't lose anything by blindly running the commands on one line instead of three. And if you do want to vet the code, you know what to do. Practically no installation instructions include a "vet the code" step, so you aren't losing anything here. The lack of TLS is worrisome, but that's not so much "becoming a thing" a…

>"If you weren't vetting the code you downloaded before, you don't lose anything by blindly running the commands on one line instead of three." Nginx is included in the OpenBSD base system (as of 5.2) and it does get vetted.

I am not seeing the relevance.
Post reply on HN