A fast and static web server for serving web apps • Hacker News Board

Re: A fast and static web server for serving web apps

#131

Post by Ecio78 » Wed, Aug 07, 2013, 8:30 AM UTC

at-fates-hands wrote: post #81

ebbv wrote: post #27

Earlier quoted context omitted.

It's a lot worse than the standard configure, make and make install. For one, it's only requiring one simple script to get compromised and replaced to compromise your entire machine. At least when I download the tarball, unpack it, etc. I've got several steps before I even get to the make install that I would run as root. And I might not even do that depending on my install target. If I do, I have ample opportunity t…

>>>>Provide an install tarball and provide a checksum of it that we can verify. This 100%. When I first started experimenting with Linux after being a lifelong Windows user, this was the same advice I got from a seasoned Linux developer: ALWAYS COMPILE FROM SOURCE - NO EXCEPTIONS. He just told me even though Linux is secure and not as big a target as MS, he said you want to establish good habits from day one and not…

ALWAYS COMPILE FROM SOURCE - NO EXCEPTIONS. And still you can have problems if the source package has been compromised: https://news.ycombinator.com/item?id=6167000 [ok it's javascript] http://www.exploit-db.com/exploits/15662/ [source code -ProFTPD] http://www.cert.org/advisories/CA-2002-28.html [source code - Sendmail]

etc..

or do you want to tell us that you inspect every line of the source code before compiling something?

Re: A fast and static web server for serving web apps

#132

Post by mryan » Wed, Aug 07, 2013, 9:37 AM UTC

steinnes wrote: post #113

jamespo wrote: post #106

Earlier quoted context omitted.

Cool, I'll just email MS and ask them to port Sharepoint to BSD.

Good job making an honest and good recommendation sound naive.

That was a terrible recommendation. Proposing a solution when you know nothing about the situation nearly always results in a pointless solution.

Suggesting that the best way to securely install Windows packages is to use a different operating system smacks of immaturity, and is obviously not a practical solution in Windows environments.

A better suggestion might be: If you do not trust it, run it in a VM/sandbox.

Re: A fast and static web server for serving web apps

#133

Post by at-fates-hands » Wed, Aug 07, 2013, 2:07 PM UTC

Ecio78 wrote: post #131

at-fates-hands wrote: post #81

Earlier quoted context omitted.

>>>>Provide an install tarball and provide a checksum of it that we can verify. This 100%. When I first started experimenting with Linux after being a lifelong Windows user, this was the same advice I got from a seasoned Linux developer: ALWAYS COMPILE FROM SOURCE - NO EXCEPTIONS. He just told me even though Linux is secure and not as big a target as MS, he said you want to establish good habits from day one and not…

ALWAYS COMPILE FROM SOURCE - NO EXCEPTIONS. And still you can have problems if the source package has been compromised: https://news.ycombinator.com/item?id=6167000 [ok it's javascript] http://www.exploit-db.com/exploits/15662/ [source code -ProFTPD] http://www.cert.org/advisories/CA-2002-28.html [source code - Sendmail] etc.. or do you want to tell us that you inspect every line of the source code before compiling s…

I think he told me this so I would get into the habit of doing it. I was so used to just clicking on an executable file and just installing the program without ever thinking it may contain malicious code.

I can tell you I don't do this every time. Now if I'm installing a 3rd party extension or plugin, I usually do it in a sandboxed environment, run some pen tests on it to check how secure it is and see if there's any malicious code before I install it on my machine or server.

And yes, even then, it is still possible to install malware on your machine.

Re: A fast and static web server for serving web apps

#134

Post by tracker1 » Wed, Aug 07, 2013, 5:18 PM UTC

MertsA wrote: post #121

tracker1 wrote: post #117

Earlier quoted context omitted.

I'm more familiar with Windows, but Linux should be similar. If your application is executed often, then it's pages should be in memory already, and not necessarily need to be read from disk. In terms of execution, if it's a compiled binary, it should be fast enough, if you need more, what you want is a lightweight application server anyway.

The problem with regular old CGI is that for every request the web server gets it has to run some binary file and setup a new thread for that every single time. Also, that's ignoring the filesystem overhead which isn't negligible even if it's already cached. You're basically turning your web server into a glorified shell script and even though all of your CGI scripts are compiled it's still horribly inefficient. Fast…

I'm specifically saying that the File System overhead is negligible for files/executables that are frequently accessed. Windows uses RAM to cache these files... Setting up a Process to execute said file vs a service that stays running is a different story.

Re: A fast and static web server for serving web apps

#135

Post by BlackDeath3 » Thu, Aug 08, 2013, 8:34 AM UTC

timothy89 wrote: post #80

BlackDeath3 wrote: post #40

Very cool. I've been doing the same thing lately, writing my own little web server that serves static files. It's been a fun learning experience!

Nice, in what language? I've really learned a lot from creating shortin! Shortfin is written in C so it's a nice project to spend some time on when I get tired of writing javascript and html ;)

I'm writing mine in C as well. I've never been too into web programming, but the lower-level stuff is quite interesting to me.

Keep it up!