Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web development in C: Crazy?

medium.com

Post reply on HN
Print view View original

51–60 of 213 posts

Re: Web development in C: Crazy?

#51

Post by cbsmith »

nemothekid wrote: post #22

There are hardly any benefits in writing your web app in C ove r Java or Go. That 1% speed increase is nothing compared to the huge amount network wait these apps will be doing. If you really consider it, what 95% of people write these days is glue between various services, and the parts that do matter, where you need the most performance, are already written in C. The reason why Redis, MongoDB and Postgres have good…

> If you really consider it, what 95% of people write these days is glue between various services, and the parts that do matter, where you need the most performance, are already written in C.

I think that is absolutely on the money?... but what if you are building one of those components?... or what if you are writing a very thin wrapper on one of those components, and it is brand new and only has C bindings?... or what if you need to be portable to dozens of different platforms, many of which don't share much toolchain overlap except for gcc?

> but I guarantee I'll probably leave a buffer overflow exploit open when trying to parse GET variables.

It's pretty easy to avoid that if you are worried about it. There are buffer/blob abstractions that give you "safe" interfaces with 0 risk of buffer overflow. Really, there is no good reason to have those unless you really are trading safety for performance.

> Or I can just do it in Java, and get all the performance and almost all the advantages of doing it in C.

Sometimes you can, sometimes you can't. It depends on the problem... and your levels of skill with both Java & C.

Re: Web development in C: Crazy?

#52

Post by rurounijones »

cbsmith wrote: post #50
ced wrote: post #42

Earlier quoted context omitted.

During the years we worked on Viaweb I read a lot of job descriptions. A new competitor seemed to emerge out of the woodwork every month or so. The first thing I would do, after checking to see if they had a live online demo, was look at their job listings. After a couple years of this I could tell which companies to worry about and which not to. The more of an IT flavor the job descriptions had, the less dangerous t…

That's using language choice as a proxy for developer talent. It's a proxy, not a real metric of the language itself. I'd note that pg ultimately sold to Yahoo, who a) wrote a fair bit of C in house themselves and b) were severely trounced by a competitor that initially was primarily using C++ (Google).

I don't see it as a talent filter proxy. More of a "Does this company understand what it is getting into and therefore what it needs" proxy.

e.g. You run a skyscraper building company. If you see job ads for competitors with things like "must have excellent woodworking knowledge" you are probably less worried than those with "must have excellent metallurgy knowledge".

Re: Web development in C: Crazy?

#53

Post by nitrogen »

asdfaoeu wrote: post #49
fiatmoney wrote: post #33

Earlier quoted context omitted.

Seems like the rules for C web development are the same as for any other language: don't trust user input, and delegate the sanitization to vetted library functions. It's not like it's 1991 and you have to use plain arrays and strcmp; there are really good, safe libraries for these things. That said, doing web development in a language with neither a REPL nor built-in unicode support sounds like a Bad Time.

Still an order of magnitude easier not to shoot yourself in the foot in most higher level language. Pretty sure you still have to use plain arrays and strcmp, what are these "safe" libraries you were going to use? Unless we are talking about C++ here? Also C supports unicode fine (to the extent it supports strings) and REPL can't hardly be considered a requirement for web development considering Java, .NET and PHP* d…

Pretty sure you still have to use plain arrays and strcmp, what are these "safe" libraries you were going to use? Unless we are talking about C++ here?

glib: https://en.wikipedia.org/wiki/GLib

There are others. Basically, if you wrap your dangerous C app in a thin, impenetrable layer of solid string processing and input validation, it's very manageable.

Valgrind and input fuzzing help considerably to work out any bugs.

Re: Web development in C: Crazy?

#54

Post by moconnor »

nemothekid wrote: post #22

There are hardly any benefits in writing your web app in C ove r Java or Go. That 1% speed increase is nothing compared to the huge amount network wait these apps will be doing. If you really consider it, what 95% of people write these days is glue between various services, and the parts that do matter, where you need the most performance, are already written in C. The reason why Redis, MongoDB and Postgres have good…

C and C++ compilers can produce faster execution than Go or JVMs as they support SIMD vectorization e.g. SSE/AVX. For CPU-bound workloads you can get more than 2x speed up.

It doesn't mean you should write your entire server stack in C vs calling a C function for heavy computation, but the idea that Java and Go approach 99% the speed of C/C++/Fortran is generally only true for programs that are not optimized for performance.

Re: Web development in C: Crazy?

#55

Post by fusiongyro »

davidw wrote: post #39
fusiongyro wrote: post #37

Earlier quoted context omitted.

Maybe your problem is CPU-bound. Maybe there are good C libraries that solve your problem. Maybe you just want to learn C better. Maybe you have latency limits you need to work within. Maybe you just want to be contrary. Sometimes "why not" is worth more than "why."

Pretty much any decent language has a way to call out to C. I wrote a portion of a book on Tcl's C API, for instance, and it's very easy to farm out computationally intensive work to C code, as it is in Python, Ruby and most other things, one way or the other.

I suppose a response to the spirit of the remark as a whole rather than one exemplary detail would be asking a lot.

Re: Web development in C: Crazy?

#56

Post by cbsmith »

asdfaoeu wrote: post #49
fiatmoney wrote: post #33

Earlier quoted context omitted.

Seems like the rules for C web development are the same as for any other language: don't trust user input, and delegate the sanitization to vetted library functions. It's not like it's 1991 and you have to use plain arrays and strcmp; there are really good, safe libraries for these things. That said, doing web development in a language with neither a REPL nor built-in unicode support sounds like a Bad Time.

Still an order of magnitude easier not to shoot yourself in the foot in most higher level language. Pretty sure you still have to use plain arrays and strcmp, what are these "safe" libraries you were going to use? Unless we are talking about C++ here? Also C supports unicode fine (to the extent it supports strings) and REPL can't hardly be considered a requirement for web development considering Java, .NET and PHP* d…

> Still an order of magnitude easier not to shoot yourself in the foot in most higher level language.

There are some best practices that tend to help you to limit the risk a lot. Still... a lot of people do web development in JavaScript, and I'd cite it as a very strong exception to your assertion.

> Pretty sure you still have to use plain arrays and strcmp, what are these "safe" libraries you were going to use?

Pretty much all of the "NULL terminated" functions have a length terminated equivalent that you can (and should) use instead. There are also blob & string abstractions available that wrap arrays and strings in structs that have fields to track the size of the allocated space, with the side benefit of making C's evil type coercion a bit harder to bump into.

> Also C supports unicode fine

Particularly if you use ICU4C, C actually has the best unicode support out there (obviously there is ICU4J which gets merged into Java regularly, but often you get stuck with an old VM with an ancient version). It's actually kind of shocking how painful it is to have full unicode support with higher level languages that really ought to know better.

> and REPL can't hardly be considered a requirement for web development considering Java, .NET and PHP* don't have REPL's.

> *Looks like PHP has some now

Not only does PHP have one, but Java has since forever (http://www.beanshell.org/), and .NET really kind of does have a few semi-reasonable options (http://www.linqpad.net/, http://www.sliver.com/dotnet/SnippetCompiler/, http://www.mono-project.com/CsharpRepl, not to mention: http://technet.microsoft.com/en-us/library/bb978526.aspx).

Of course, so does C (http://root.cern.ch/drupal/content/cint, http://root.cern.ch/drupal/content/cling, http://www.softintegration.com/products/chstandard/, and arguably even things like https://code.google.com/p/picoc/ or http://ups.sourceforge.net/main.html can serve if you are desperate).

Re: Web development in C: Crazy?

#58

Post by davidw »

fusiongyro wrote: post #55
davidw wrote: post #39

Earlier quoted context omitted.

Pretty much any decent language has a way to call out to C. I wrote a portion of a book on Tcl's C API, for instance, and it's very easy to farm out computationally intensive work to C code, as it is in Python, Ruby and most other things, one way or the other.

I suppose a response to the spirit of the remark as a whole rather than one exemplary detail would be asking a lot.

The spirit of using C for web applications is: it'd be faster and simpler just to publish your root password and IP address to the web.

Re: Web development in C: Crazy?

#59

Post by cbsmith »

rurounijones wrote: post #52
cbsmith wrote: post #50

Earlier quoted context omitted.

That's using language choice as a proxy for developer talent. It's a proxy, not a real metric of the language itself. I'd note that pg ultimately sold to Yahoo, who a) wrote a fair bit of C in house themselves and b) were severely trounced by a competitor that initially was primarily using C++ (Google).

I don't see it as a talent filter proxy. More of a "Does this company understand what it is getting into and therefore what it needs" proxy. e.g. You run a skyscraper building company. If you see job ads for competitors with things like "must have excellent woodworking knowledge" you are probably less worried than those with "must have excellent metallurgy knowledge".

> I don't see it as a talent filter proxy.

That's fine. I was characterizing how pg was using it.

> Does this company understand what it is getting into and therefore what it needs?

I think it is actually a much poorer proxy for that. Maybe if they are a small company or don't have any engineers, that would make sense. As a company gets larger, job descriptions start to represent very small, specific parts of what a company does, and the internal context of the company often outweighs the importance of the external context that is visible to you.

As an example, when Facebook was still up and coming and had real competition, Facebook were the ones hiring C programmers, not their competitors... ;-)

Re: Web development in C: Crazy?

#60

Post by gizzlon »

The reasons for this [that no one uses C] aren’t terribly difficult to discern. Let’s face it: compared with higher-level languages, C is hard. Like, objectively hard

So.. instead of leading with one of the many, many great reasons not to use C, he pretty much calls everyone too stupid to make it work.

Post reply on HN