Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A fast and static web server for serving web apps

shortfin.io

Post reply on HN
Print view View original

51–60 of 135 posts

Re: A fast and static web server for serving web apps

#51

Post by packetslave »

ds9 wrote: post #33
sehrope wrote: post #22

Earlier quoted context omitted.

A server that only serves static files. It doesn't enable the use of dynamic content like CGI[1]. Compare this to something like Apache or nginx. Both can serve static files but also support a number of ways of either directly running scripts (ex: mod_perl or mod_php in Apache) or proxying to other servers that handle dynamic content. [1]: https://en.wikipedia.org/wiki/Common_Gateway_Interface

OK, then, sorry if I'm being dense, but how can it be "for serving web apps"? App seems an odd term for a site consisting of only static files.

Perhaps you've heard of this new language, JavaScript?

Re: A fast and static web server for serving web apps

#53

Post by nmat »

lstamour wrote: post #42
tlrobinson wrote: post #32

Earlier quoted context omitted.

"Provide an install tarball and provide a checksum of it that we can verify." https://github.com/timothyej/Shortfin My point was the people who are going to blindly run curl/sh commands are also going to blindly download the source tarball and run configure/make/make install, and the people who want to do more verification are certainly free to do so.

I wonder how much work it would be to modify that one-liner to include an MD5 or SHA1 check? Of course it might then be shell and OS-specific... Unless curl or wget can confirm the sha1? Oh... found it! http://superuser.com/questions/453823/is-there-a-tool-that-a...

Without HTTPS in the main site that is mostly useless

Re: A fast and static web server for serving web apps

#54

Post by ds9 »

packetslave wrote: post #51
ds9 wrote: post #33

Earlier quoted context omitted.

OK, then, sorry if I'm being dense, but how can it be "for serving web apps"? App seems an odd term for a site consisting of only static files.

Perhaps you've heard of this new language, JavaScript?

Still not much of an app unless the JS does AJAX, but then it's talking to a server that's running some dynamic process, maybe with DB access etc. - right?

Re: A fast and static web server for serving web apps

#55

Post by timothy89 »

nine_k wrote: post #34

I think the landing page would greatly benefit from two short paragraphs: Why Shortfin when we have Nginx/Lighttpd? Why Shortfin when we have thttpd?

1. Shortfin is not a replacement for nginx. I use it myself to create other projects, e.g. fast API servers with one purpose only and a REST server that uses redis as storage.

2. See #1.

3. I don't try to sell anything, it's just an open-source project that I think maybe someone could benefit from. I've learned a lot while coding it.

Re: A fast and static web server for serving web apps

#56

Post by skrebbel »

ebbv wrote: post #48
skrebbel wrote: post #38

Earlier quoted context omitted.

I'm a Windows user. Virtually every piece of software I install comes in the form of an executable, that I download-and-run directly from the browser. I often give this executable administrator priviledges. The executable can then do whatever it wants on my computer. Usually it will install said piece of software (except when it was made by Oracle, it'll install said software and the Ask.com toolbar) This has been st…

You're giving those executables full control over your computer. Yeah, you won't get burned very often (depending on where you're getting these executables.) But when you do get burned it's going to be catastrophic. That's the problem. It's a bad practice.

Hm, I see your point.

How would you then recommend installing non open source software on a production system? E.g. a freeware (but proprietary) FTP server or a database engine.

Re: A fast and static web server for serving web apps

#57

Post by rglullis »

tlrobinson wrote: post #24
jfb wrote: post #11

Just run the following command as root to install the server. # wget http://shortfin.io/install.sh && sh install.sh What? Are they serious? Is this becoming a thing? Please don't tell me that this is a thing.

Yes, it's a thing, and aside from the lack of HTTPS it's not much worse than your standard "./configure", "make", "make install" install flow of the last 20-whatever years of open source. If you don't trust the developer to serve you a safe install.sh script you shouldn't trust the rest of their code either. If you don't trust them you should audit the code no matter what the install process looks like. That said, if…

It's not "curl | install.sh" vs "configure/make", you know? What about using any package management system?

Re: A fast and static web server for serving web apps

#58

Post by skrebbel »

ChuckMcM wrote: post #49
tlrobinson wrote: post #41

Earlier quoted context omitted.

"easily wrapped around a 'regular' program" Sounds like you want CGI :)

Yes, "static CGI" if such a thing was a thing :-). I've got a thttpd tree that I do this sort of hack in (these are great for monitoring large numbers of servers for example).

I don't understand (and am interested). What's "static" about it? With Apache and mod_rewrite and CGI, I could make the functionality you want (which is, of course, completely not low footprint, but I don't understand how what you want is different from CGI).

Re: A fast and static web server for serving web apps

#59

Post by eksith »

chc wrote: post #50
eksith wrote: post #39

Earlier quoted context omitted.

>"If you weren't vetting the code you downloaded before, you don't lose anything by blindly running the commands on one line instead of three." Nginx is included in the OpenBSD base system (as of 5.2) and it does get vetted.

I am not seeing the relevance.

Your assertion is that if we want to vet the code, there are steps to do that and no conventional installation includes these steps, correct?

Well, getting the "trust us, this is easy" type installation instructions here isn't terribly comforting from a brand new project. That's the sort of thing I'd expect from a source I know. Not from this project that I didn't even know existed before this post.

It's unrealistic to expect those who take security seriously to do so in the first place. Regardless of how often it's done elsewhere.

OTOH, there's a well known and trusted software distributor that does the vetting for you, which this project doesn't have, and I'd much rather do the "vetting-skipped install" if you will for something they distribute instead.

Re: A fast and static web server for serving web apps

#60

Post by lstamour »

nmat wrote: post #53
lstamour wrote: post #42

Earlier quoted context omitted.

I wonder how much work it would be to modify that one-liner to include an MD5 or SHA1 check? Of course it might then be shell and OS-specific... Unless curl or wget can confirm the sha1? Oh... found it! http://superuser.com/questions/453823/is-there-a-tool-that-a...

Without HTTPS in the main site that is mostly useless

True. Though for a bit of benefit, if the download was hosted separately from the site, that'd be two things to hack. The downside, of course, is that script updates would require new SHA1s. It would be best, then, to insert version numbers into the installer scripts, and a version check. That way if a new version comes out, the installer could warn about it (y/n), while still verifying the SHA1.
Post reply on HN