Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web development in C: Crazy?

medium.com

Post reply on HN
Print view View original

131–140 of 213 posts

Re: Web development in C: Crazy?

#131

Post by ianstallings »

jerf wrote: post #5

So, people can't hardly write safe web apps in PHP without spraying XSS and auth bypasses and arbitrary shell executions and arbitrary SQL injections everywhere, and you also want to hand the attackers the ability to segfault your server or possibly even straight-up run arbitrary code? Anyone smart enough to truly safely code a website in C is smart enough to learn a language to create that website which doesn't get…

Using that same logic we shouldn't use C for anything, because we might make a mistake.

I wouldn't use this not because of possible mistakes leaking in, but because the higher-level languages have already solved some of the problems you would have to solve yourself, such as handling unicode. There are C frameworks you could use but my point is that you would come across problems that have already been solved, and you would have to solve them again, but this time for libCello.

Now that's for production and work. To mess around on my own time? Sounds like fun to me. C is my favorite language but I use it everyday programming mobile devices so I'm probably a little unusual. Maybe a little website experiment or something. If it goes down or gets owned, rebuild time.

Re: Web development in C: Crazy?

#132

Post by pjmlp »

ramchip wrote: post #127
pjmlp wrote: post #82

Earlier quoted context omitted.

> The attraction of C to this mindset is that it can be transliterated (vs translated) into machine code. This transliteration is so straight forward that if you know C and are familiar with the basics of the instruction set you can do it by hand. Except modern processor architectures are no longer a one-to-one correspondence between Assembly code and C.

There has never been a one-to-one mapping (rather one-to-many), but it's still perfectly possible to transform C into assembly by hand. It's not even that difficult.

Yes, back in the old 8 and 16 bit days, it was pretty much one-to-one for most use cases.

Nowadays not any longer if you want to write code that takes advantage of branch prediction, speculative execution, cache lines, vector units, GPGPU ...

Just watch this Going Native talk on how sometimes generating code that is 4x bigger than the direct translation can yield up to 30% performance increase.

http://channel9.msdn.com/Events/GoingNative/2013/Compiler-Co...

Re: Web development in C: Crazy?

#133

Post by cbsmith »

justincormack wrote: post #119
cbsmith wrote: post #46

Earlier quoted context omitted.

I should think the reasons are obvious: 1) Whatever language you are most proficient in, that is often the most efficient tool for _you_ to get the job done right. 2) PHP is largely C for people who should never program in C (or PHP ;-). Depending on the nature of what you are doing, and if you use some basic support libraries (and the author mentions a few), your code needn't be that much more work to get done than…

If you need a lot of C interfacing go with something that interfaces well with C. Like Lua.

Or, C#? ;-)

Sometimes it is hard to beat just doing it in C.

Re: Web development in C: Crazy?

#134

Post by bluecalm »

lmm wrote: post #103
fusiongyro wrote: post #37

Earlier quoted context omitted.

Maybe your problem is CPU-bound. Maybe there are good C libraries that solve your problem. Maybe you just want to learn C better. Maybe you have latency limits you need to work within. Maybe you just want to be contrary. Sometimes "why not" is worth more than "why."

> Maybe your problem is CPU-bound. Maybe you have latency limits you need to work within. Unless you have lots and lots of time to spend micro-optimizing everything, you'll get better performance writing in Haskell. > Maybe there are good C libraries that solve your problem Maybe, but most of the original post is about how lacking the library ecosystem is. I can well believe that you might have some useful domain-spe…

>Unless you have lots and lots of time to spend micro-optimizing everything, you'll get better performance writing in Haskell.

This is just not true. Haskell is terribly (3x,4x) slow comparing to C for the most trivial of computing tasks. You can probably get it to 2x or 1.5x by giving up all the lists and other default data structures as well as writing everything in procedural (by monads) way. If you do all this you can get close to C performance but you just gave up all the advantages of writing in Haskell in the first place. And you are still slow as hell.

Re: Web development in C: Crazy?

#135

Post by ianstallings »

ced wrote: post #42
wwweston wrote: post #15

At my first web job circa 1996, our shopping cart product was mostly C, so I did web development in C for about two years. I'm not sure that using C was the craziest thing about how we did things. Nobody really had an idea how to structure a web app, so it was more or less a dozen or so CGIs which read/wrote to flat files through custom-written dbm clone (woo, NoSQL in '96!). Lots of unsophisticated string munging. M…

During the years we worked on Viaweb I read a lot of job descriptions. A new competitor seemed to emerge out of the woodwork every month or so. The first thing I would do, after checking to see if they had a live online demo, was look at their job listings. After a couple years of this I could tell which companies to worry about and which not to. The more of an IT flavor the job descriptions had, the less dangerous t…

Of course he would be worried, because at the time there was a total of 17 Lisp hackers in the world to go around ;)

Re: Web development in C: Crazy?

#136

Post by 16s »

"And when was the last time you wrote a function that returned 1 or 0? If you’re a Rubyist or a Pythonista or a server-side JavaScript devotee, you may never have done so."

That's just returning True or False (bool). Lot's of people return that from functions in all languages.

Re: Web development in C: Crazy?

#137

Post by desas »

Figs wrote: post #4

A lot of embedded systems have web configuration interfaces written in C. For example, your wireless router's configuration page is probably written in C.

Router configuration pages are usually awful. With string handling being an awful pain in C, it might explain why my router only does validation in javascript (thankfully, it means I can disable it when it is wrong).

Re: Web development in C: Crazy?

#138

Post by cbsmith »

pjmlp wrote: post #84
marssaxman wrote: post #65

Earlier quoted context omitted.

Google still does primarily use C++.

Given the choice C++ is way better than C, given that it allows to use higher level abstractions and replace all unsafe C heritage by library based safe constructs. Of course, the best option would be to replace them by other languages with native compilers. However at the level these languages are used, it will only happen when OS vendors push new languages for their OS. So it will never happen in UNIX land or Mac O…

> Given the choice C++ is way better than C, given that it allows to use higher level abstractions and replace all unsafe C heritage by library based safe constructs.

You may have noticed that C++ is not always deemed universally better than C. What language are all the top web servers implemented in?

C has library based safe constructs as well, and C++ still has all of C unsafety. You just get to exercise those bugs at a higher level of abstraction.

> Of course, the best option would be to replace them by other languages with native compilers.

I think that is anything but clear. Certainly the option of doing so has been around. You just don't see a ton of big moves that worked out well.

> However at the level these languages are used, it will only happen when OS vendors push new languages for their OS.

Most OS's actually have a pretty small API footprint (Windows being the obvious outlier). If it were really just about the language bindings, it would not be a real impediment. A language runtime can abstract out the OS (as the C runtime does).

> So there isn't any OS vendor left that would push new system programming languages for their OS.

I'm going to claim this could well be a function of Darwinian forces.

Re: Web development in C: Crazy?

#139

Post by cowsandmilk »

asdfaoeu wrote: post #49
fiatmoney wrote: post #33

Earlier quoted context omitted.

Seems like the rules for C web development are the same as for any other language: don't trust user input, and delegate the sanitization to vetted library functions. It's not like it's 1991 and you have to use plain arrays and strcmp; there are really good, safe libraries for these things. That said, doing web development in a language with neither a REPL nor built-in unicode support sounds like a Bad Time.

Still an order of magnitude easier not to shoot yourself in the foot in most higher level language. Pretty sure you still have to use plain arrays and strcmp, what are these "safe" libraries you were going to use? Unless we are talking about C++ here? Also C supports unicode fine (to the extent it supports strings) and REPL can't hardly be considered a requirement for web development considering Java, .NET and PHP* d…

> Still an order of magnitude easier not to shoot yourself in the foot in most higher level language.

I would argue that C's lack of robust string concatenation encourages most people to avoid concatenating strings at all costs. Most DB libraries support bound parameters, which would be much easier to use than constructing an arbitrary sql string in C. So, I would argue the tendency for a competent C programmer is to do the safe thing rather than the lazy thing other languages make easy that exposes you to SQL injections.

Along with that, most scripting languages are written in C. I know a lot of people who have written PHP extensions in C. This article seems to suggest that no one does any web development in C, when almost every large company I know of does so, even if it is just to speed up slow parts of their app by adding new functions to PHP.

Re: Web development in C: Crazy?

#140

Post by annnnd »

jerf wrote: post #5

So, people can't hardly write safe web apps in PHP without spraying XSS and auth bypasses and arbitrary shell executions and arbitrary SQL injections everywhere, and you also want to hand the attackers the ability to segfault your server or possibly even straight-up run arbitrary code? Anyone smart enough to truly safely code a website in C is smart enough to learn a language to create that website which doesn't get…

Good summary. The answer to the question in title would be: yes.
Post reply on HN