Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web development in C: Crazy?

medium.com

Post reply on HN
Print view View original

121–130 of 213 posts

Re: Web development in C: Crazy?

#121

Post by rwmj »

jerf wrote: post #5

So, people can't hardly write safe web apps in PHP without spraying XSS and auth bypasses and arbitrary shell executions and arbitrary SQL injections everywhere, and you also want to hand the attackers the ability to segfault your server or possibly even straight-up run arbitrary code? Anyone smart enough to truly safely code a website in C is smart enough to learn a language to create that website which doesn't get…

I use C every day, and I wrote a whole framework for writing websites in C (no longer maintained because I'm no longer that interested in writing websites):

http://web.archive.org/web/*/http://www.annexia.org/freeware...

What was amazing was that you could write pretty complex dynamic websites that fit into a few K of RAM and could trivially handle huge load.

I originally wrote that framework for a chat service. It ran for years on a single 32-bit CPU box with 128 MB of RAM, handling the chat requirements of dozens of English schools.

Re: Web development in C: Crazy?

#122

Post by mikkom »

srl wrote: post #20
jerf wrote: post #5

So, people can't hardly write safe web apps in PHP without spraying XSS and auth bypasses and arbitrary shell executions and arbitrary SQL injections everywhere, and you also want to hand the attackers the ability to segfault your server or possibly even straight-up run arbitrary code? Anyone smart enough to truly safely code a website in C is smart enough to learn a language to create that website which doesn't get…

I once wrote a website (a search engine for a specific set of websites) in C. It actually worked, once I spend 20 hours in valgrind. I've grown since then, in two important ways. First, I'd probably do a better job now, and not have to spend any time in valgrind at all (I still use C quite frequently). Second, I'd never, ever, try to pull that stunt again.

We actually used c in ~2000 in our web company (one of the biggest in our country at that time). Even the finnish EU commission site ran on C platform that I wrote. Oh the days..

Re: Web development in C: Crazy?

#123

Post by thisishugo »

harrytuttle wrote: post #102
davedx wrote: post #97

Earlier quoted context omitted.

You mean like this? https://github.com/tyler/Bogart/blob/master/bogart.c#L53 I'm sure nothing could possibly go wrong there...

To be fair, it looks like a "get it working" proof of concept, but I certainly wouldn't take that into production :)

The author explicitly says it's not intended for production in the README:

> This code has every security flaw you imagine, tons of memory leaks, and when I wrote it I may have been awake for much longer than one should be when writing C.

Re: Web development in C: Crazy?

#124

Post by harrytuttle »

pjmlp wrote: post #120
harrytuttle wrote: post #107

Earlier quoted context omitted.

We use C# which allows you to write safe code. However, people still manage to fuck it up at an implementation level often enough for it to cause high risk problems.

I do mostly JVM and .NET based development nowadays, in consulting projects. Sometimes I wish to be part of a C or C++ based project, then I try to imagine how the quality of our offshore guys would map to those languages and realize how lucky I am not to be part of such projects.

Yeah very good point. Our offshore guys can't even get c# right :)

Re: Web development in C: Crazy?

#125

Post by golergka »

jerf wrote: post #5

So, people can't hardly write safe web apps in PHP without spraying XSS and auth bypasses and arbitrary shell executions and arbitrary SQL injections everywhere, and you also want to hand the attackers the ability to segfault your server or possibly even straight-up run arbitrary code? Anyone smart enough to truly safely code a website in C is smart enough to learn a language to create that website which doesn't get…

> If you're smart enough to safely write that C code, you won't.

That's one of the best things I've read in a last few days.

Re: Web development in C: Crazy?

#126

Post by ruben_varnish »

Although we try not to talk too much about it, many users of Varnish Cache actually use it "because it is the easiest way to get a C layer in our web stack".

Others are proud creators developing web sites in it using both VCL (which is compiled into C) and C directly through VMODs or Inline-C in VCL. More:

* https://www.varnish-cache.org/docs/trunk/users-guide/vcl-inl...

* https://www.varnish-cache.org/docs/trunk/reference/vmod.html

* https://www.varnish-cache.org/vmods

* https://www.varnish-cache.org/trac/wiki/VCL

Re: Web development in C: Crazy?

#127

Post by ramchip »

pjmlp wrote: post #82
DigitalJack wrote: post #21

Earlier quoted context omitted.

There exists a form of survivalist mindset in some programmers. It goes roughly like this: if you can't boot it, it's fluff programming. The attraction of C to this mindset is that it can be transliterated (vs translated) into machine code. This transliteration is so straight forward that if you know C and are familiar with the basics of the instruction set you can do it by hand. The survivalist mindset fears depende…

> The attraction of C to this mindset is that it can be transliterated (vs translated) into machine code. This transliteration is so straight forward that if you know C and are familiar with the basics of the instruction set you can do it by hand. Except modern processor architectures are no longer a one-to-one correspondence between Assembly code and C.

There has never been a one-to-one mapping (rather one-to-many), but it's still perfectly possible to transform C into assembly by hand. It's not even that difficult.

Re: Web development in C: Crazy?

#128

Post by alexkus »

It all depends on whether you've got a compelling reason to or not.

For us it was a simple decision, we have a mature stable product[1] that's written in C. So the path of least resistance is to write out own web framework (from scratch to avoid IP infringement problems). Sure it took time, a lot more time than grabbing something written by someone else, but that's not how it works everywhere (especially in corporate environments). Now we've got this library it makes adding HTTP client/server stuff to any of our C binaries relatively easy.

Likewise string processing in C isn't a problem once you've got a suitable library built up; ADT libraries (no I don't need to implement my own buggy hashtable again and again), regexp wrapper libraries, etc. They also help maintain consistency across platforms (our product ships on 6 different platforms including Windows).

If you're looking for instant gratification then C isn't the right language for you but a huge amount of the Internet is built on the back of things written in C. Are webservers (Apache, nginx) written in C similarly crazy? No.

Of course, it needs someone to write a solid C HTTP framework and then open source it so that it can be maintained/improved, now that would be useful. Sadly our employer has no plans to release ours, which is a shame but I have no control over that.

1. Coming up 20 years old now and >$1.5bn in revenues over those years, not too shabby.

Re: Web development in C: Crazy?

#129

Post by reinhardt »

readme wrote: post #44
DigitalJack wrote: post #21

Earlier quoted context omitted.

There exists a form of survivalist mindset in some programmers. It goes roughly like this: if you can't boot it, it's fluff programming. The attraction of C to this mindset is that it can be transliterated (vs translated) into machine code. This transliteration is so straight forward that if you know C and are familiar with the basics of the instruction set you can do it by hand. The survivalist mindset fears depende…

On the next episode of "Doomsday Coders" Programmer writes an entire operating system from scratch in case all the copies of Linux in the world are deleted. A web developer writes his entire application in x86 assembly to prepare for an event in which all the world's compilers and interpreters disappear. And more...

Replace "disappear" with "cannot be trusted to not be owned by NSA" and someone might actually take a stab..
Post reply on HN