I own a web dev company. We do everything in C. For 10 years we've been doing so. The advantage is, we can do anything and everything. We do it faster, too. And we never have to wait for the language or some library to catch up to the new stuff. There is nothing we can't do and speed or platform is never a limitation. In fact, there's always this underlying feeling that coding in anything but C is crazy.
Web development in C: Crazy?
161–170 of 213 posts
Re: Web development in C: Crazy?
#162So, people can't hardly write safe web apps in PHP without spraying XSS and auth bypasses and arbitrary shell executions and arbitrary SQL injections everywhere, and you also want to hand the attackers the ability to segfault your server or possibly even straight-up run arbitrary code? Anyone smart enough to truly safely code a website in C is smart enough to learn a language to create that website which doesn't get…
> If you aren't smart enough [to safely code a website in C...] the first clue that you aren't is that you think that you are Gee, isn't that epistemology at its finest. Personally I've never met anyone who programmed in C because they were too dumb to learn anything else, but who knows. You may however be aware that, before an HTTP packet even makes it to your shiny, scripty web page, it's often processed by a succe…
I've never met anyone who programmed in C because they were too dumb to learn anything else
I have.
They were too dumb to understand that they were writing unsafe C code because they weren't skilled enough to write safe C code. So it never occurred to them that they had a problem that would be solved by writing part of their system in Python or Ruby or Java.
it's often processed by a succession of "segfault-y" and "arbitrary-code-running" software such w Apache and Linux
The vast majority of C programmers are much less skilled than Apache and Linux developers.
Re: Web development in C: Crazy?
#163So, people can't hardly write safe web apps in PHP without spraying XSS and auth bypasses and arbitrary shell executions and arbitrary SQL injections everywhere, and you also want to hand the attackers the ability to segfault your server or possibly even straight-up run arbitrary code? Anyone smart enough to truly safely code a website in C is smart enough to learn a language to create that website which doesn't get…
[deleted]
Re: Web development in C: Crazy?
#164Doug Crockford at the TC-39 panel last night talked about how one of the most exciting things about JavaScript is that its a wildly successful general-purpose programming language that "doesn't have to look like C to be successful." His point was that we used to live in a software ecosystem where the conventional wisdom was that if a programming language didn't look like C, it wasn't going to take off. JavaScript (an…
JavaScript is a C-like language though. It looks like C. It borrowed its syntax and even many of its keywords.
Also, in some of his earlier talks he said that it looks familiar to C or Java developers (because it's a C-like language) and that this perceived familiarity is the reason why most people don't bother learning the language.
Re: Web development in C: Crazy?
#165WHYYYYYYYYY No, seriously, why ? As far as I can tell, his entire argument is "web development in C is terrible and limiting, but not as quite as terrible and limiting as you might think." I guess that's good news if terrorists are forcing you to write websites in C, but I don't see even an attempt at explaining why you would choose to do this.
For a CRUD app, of course it doesn't make much sense and you'd probably have to be a masochist. :) But there are valid use cases I can think of: Anything that's very CPU intensive that would need to run very quickly: dynamic image generation, or something that does a complex series of operations on user input that needs to delivers the results ASAP.
Of course it's usually easier and safer to just throw more CPU at it, but at a certain scale that might get too expensive...
Re: Web development in C: Crazy?
#166The main problem, I think, is that web development usually requires lots of string processing, and the C standard library makes this complicated and opaque. Maybe Cello helps with that?
Re: Web development in C: Crazy?
#167So, people can't hardly write safe web apps in PHP without spraying XSS and auth bypasses and arbitrary shell executions and arbitrary SQL injections everywhere, and you also want to hand the attackers the ability to segfault your server or possibly even straight-up run arbitrary code? Anyone smart enough to truly safely code a website in C is smart enough to learn a language to create that website which doesn't get…
> If you aren't smart enough [to safely code a website in C...] the first clue that you aren't is that you think that you are Gee, isn't that epistemology at its finest. Personally I've never met anyone who programmed in C because they were too dumb to learn anything else, but who knows. You may however be aware that, before an HTTP packet even makes it to your shiny, scripty web page, it's often processed by a succe…
> it's often processed by a succession of "segfault-y" and "arbitrary-code-running" software such as Apache and Linux.
If your web code has ~20 years of security audits and fixes it's probably perfectly safe to use it. If you're adding large new features under tight deadlines I don't recommend it.
Re: Web development in C: Crazy?
#168Earlier quoted context omitted.
We use C# which allows you to write safe code. However, people still manage to fuck it up at an implementation level often enough for it to cause high risk problems.
I do mostly JVM and .NET based development nowadays, in consulting projects. Sometimes I wish to be part of a C or C++ based project, then I try to imagine how the quality of our offshore guys would map to those languages and realize how lucky I am not to be part of such projects.
Don't you do something wrong, when you consult the company to use (more) offshore guys? I thought that a company is best led, when developers share their knowledge cooperatively and ask their managers to outsource unimportant time-consuming things like api-/file-/conversions, legacy code support, CSVs …
(Disclaimer: Don't get my tone wrong please, I'm asking not suggesting, thus I respect your experience.)
Re: Web development in C: Crazy?
#169Earlier quoted context omitted.
If you have not already and can do so, I highly recommend adding Dtrace to your C development toolkit. Dtrace, Valgrind, and GDB make rooting out C runtime issues a lot more pleasant and complement one another well.
Indeed. It's a pity DTrace is not available in Linux (there are two ports, none work for real work). It's also a pity DTrace in OS X is starting to bit rot.
I don't know where the problem is, I use http://gpo.zugaina.org/dev-util/dtrace on Gentoo without a problem.
Re: Web development in C: Crazy?
#170Earlier quoted context omitted.
Using that same logic we shouldn't use C for anything, because we might make a mistake . I wouldn't use this not because of possible mistakes leaking in, but because the higher-level languages have already solved some of the problems you would have to solve yourself, such as handling unicode. There are C frameworks you could use but my point is that you would come across problems that have already been solved, and yo…
And we shouldn't use C for anything, if it can at all be avoided, because the likelihood and aftermath of mistakes are enormous.
Then by that logic, you shouldn't use a Computer, because the likelihood and aftermath of mistakes are enormous. :) c'mon, don't be that close-minded.