Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Web development in C: Crazy?

medium.com

Post reply on HN
Print view View original

181–190 of 213 posts

Re: Web development in C: Crazy?

#181

Post by fusiongyro »

X4 wrote: post #178
fusiongyro wrote: post #32

I wrote a small (~300 line) C program to scrape an email and insert the part I wanted into a Postgres database. I used PCRE for the extraction and ECPG for the Postgres part. ECPG stands for embedded SQL in C for Postgres, and it looks like this: // Open the storage subsystem. void open_storage() { EXEC SQL BEGIN DECLARE SECTION; const char* database = DATABASE_NAME; const char* username = USERNAME; const char* schem…

This made me curious! Why did you do this? To create a database of "signatures" to be used in your contact-list?

No, I signed up for the xe.com daily currency exchange rates email and it occurred to me I could build a database around it. So now I have daily exchange rate data going back a couple years. Thankfully they haven't changed their format. They have a service you can pay for if you want to download this data in bulk but I was being cheap and didn't really have any particular use for the data.

Source code: https://bitbucket.org/fusiongyro/exchange_rates/src

Re: Web development in C: Crazy?

#182

Post by AdrianRossouw »

fusiongyro wrote: post #35
jerf wrote: post #5

So, people can't hardly write safe web apps in PHP without spraying XSS and auth bypasses and arbitrary shell executions and arbitrary SQL injections everywhere, and you also want to hand the attackers the ability to segfault your server or possibly even straight-up run arbitrary code? Anyone smart enough to truly safely code a website in C is smart enough to learn a language to create that website which doesn't get…

I'm not sure it's that cut and dry. For one thing, PHP itself has vulnerabilities, as do its flagship apps. These vulnerabilities are easy to scan for, because the default configuration advertises that it is there and what version it is. If you're worried about some kid running scripts or idly scanning, you're probably in better shape with a custom C program than with a widely-used PHP program, even though the custom…

are you actually arguing for security by obscurity?

Re: Web development in C: Crazy?

#183

Post by mheathr »

4ad wrote: post #152
mheathr wrote: post #24

Earlier quoted context omitted.

If you have not already and can do so, I highly recommend adding Dtrace to your C development toolkit. Dtrace, Valgrind, and GDB make rooting out C runtime issues a lot more pleasant and complement one another well.

Indeed. It's a pity DTrace is not available in Linux (there are two ports, none work for real work). It's also a pity DTrace in OS X is starting to bit rot.

A clean room reimplementation of Dtrace is on my list of ideal computing wants that will probably never happen.

Also on the list is everyone targeting the same hypervisor for device drivers (such as Xen) so that hardware support is excellent for all operating systems and all devices.

I would really, really like a clean room reimplementation of Hexray's IDA pro so that I can use it on OS and architecture, an LLVM front end for Plan 9/Inferno OS, a clean room reimplementation of ZFS, GNUstep to have at least a 1:1 implementation of Cocoa so that no matter the OS and architecture one can target that GUI kit and we have inter-application reuse of functionality through scripts like we have for CLI apps, and a clean room reimplementation of AutoCAD and Candence's Orcad.

And as someone who uses a CAS or equivalent environment a lot, I would really appreciate if an ecosytem such as julia, ipython, or octave would reach and exceed Mathematica and Matlab in ease of use, degree of combination and semantics possibilities, and power as well as efficacy.

I really would like to be able to use Plan 9/Inferno OS all the time but developer tools are not comparable to any BSD or Linux ecosystem and there is not a good GUI toolkit available (I would like GNUstep here is why I want the implementation to succeed).

People who can reverse engineer software and hardware is a very small population compared to the res of the dev population though and they are very likely to end up in a lawsuit if they try.

Re: Web development in C: Crazy?

#184

Post by fusiongyro »

AdrianRossouw wrote: post #182
fusiongyro wrote: post #35

Earlier quoted context omitted.

I'm not sure it's that cut and dry. For one thing, PHP itself has vulnerabilities, as do its flagship apps. These vulnerabilities are easy to scan for, because the default configuration advertises that it is there and what version it is. If you're worried about some kid running scripts or idly scanning, you're probably in better shape with a custom C program than with a widely-used PHP program, even though the custom…

are you actually arguing for security by obscurity?

No, I'm saying something more subtle than that, which is why I used four sentences instead of three words.

Re: Web development in C: Crazy?

#186

Post by cbsmith »

pjmlp wrote: post #146
cbsmith wrote: post #138

Earlier quoted context omitted.

> Given the choice C++ is way better than C, given that it allows to use higher level abstractions and replace all unsafe C heritage by library based safe constructs. You may have noticed that C++ is not always deemed universally better than C. What language are all the top web servers implemented in? C has library based safe constructs as well, and C++ still has all of C unsafety. You just get to exercise those bugs…

> You may have noticed that C++ is not always deemed universally better than C. What language are all the top web servers implemented in? Apache and nginx => C Tomcat, Jetty => Java IIS => C++/C# > Most OS's actually have a pretty small API footprint (Windows being the obvious outlier). If it were really just about the language bindings, it would not be a real impediment. A language runtime can abstract out the OS (a…

> Apache and nginx => C > Tomcat, Jetty => Java

Okay, if you are going to throw in Tomcat & Jetty, you should also throw in the likes of lighttpd, mongrel2, etc., all of which are written in C. Pretty much all the load balancers/reverse proxies are written in C too. Hmm.... is it maybe possible that it isn't always better to use C++ instead of C?

> IIS => C++/C#

Yup, the one outlier no doubt owes about 0% of its success to its tech stack. In general, if you don't work at Google and want a C++ web server on anything other than Windows, you are looking at a C++ server framework that has an embedded HTTP stack (tntnet, Wt, etc.).

> If developers aren't forced to use it, then they won't use it, even if made available.

I know. I spend all my time watching them because if I don't they just start doing everything in assembly.

> That is my hope, after all we only need a few generations of developers and then the issue is taken care of by itself.

I think you missed my point. ;-)

Re: Web development in C: Crazy?

#187

Post by cbsmith »

drdaeman wrote: post #148
cbsmith wrote: post #138

Earlier quoted context omitted.

> Given the choice C++ is way better than C, given that it allows to use higher level abstractions and replace all unsafe C heritage by library based safe constructs. You may have noticed that C++ is not always deemed universally better than C. What language are all the top web servers implemented in? C has library based safe constructs as well, and C++ still has all of C unsafety. You just get to exercise those bugs…

> C has library based safe constructs as well, and C++ still has all of C unsafety. The problem C's lacking one of most important primitives - data structures. Bugs in standard library happen pretty rarely, I guess. So, C++ users have most common data structures for free. And when I open some C-based project's code the first thing I usually expect and see is some homegrown linked list and/or map implementations (of S…

> And when I open some C-based project's code the first thing I usually expect and see is some homegrown linked list and/or map implementations (of SIGSEGV fame). I know, there are tons of libraries that offer them, but in my experience of "hey, that server crashed, could you figure out what went wrong"-type tasks, they're very rarely used.

Fortunately, C++ developers just always use the STL because it is considered the bastion of all that is good in collection classes:

http://www.codeofhonor.com/blog/avoiding-game-crashes-relate... http://engineering.adap.tv/2012/03/29/why-we-use-c-without-u...

Don't get me wrong. I love C++ and use the STL by default, but it's all too rare that I look at a decent sized C++ project and see anything different from what you'd expect if the project were written in C.

Re: Web development in C: Crazy?

#188

Post by cbsmith »

jerf wrote: post #5

So, people can't hardly write safe web apps in PHP without spraying XSS and auth bypasses and arbitrary shell executions and arbitrary SQL injections everywhere, and you also want to hand the attackers the ability to segfault your server or possibly even straight-up run arbitrary code? Anyone smart enough to truly safely code a website in C is smart enough to learn a language to create that website which doesn't get…

> So, people can't hardly write safe web apps in PHP without...

I've said it before, but it bares repeating:

PHP is C for people who shouldn't write in C... or PHP.

Re: Web development in C: Crazy?

#189

Post by asdasf »

jerf wrote: post #5

So, people can't hardly write safe web apps in PHP without spraying XSS and auth bypasses and arbitrary shell executions and arbitrary SQL injections everywhere, and you also want to hand the attackers the ability to segfault your server or possibly even straight-up run arbitrary code? Anyone smart enough to truly safely code a website in C is smart enough to learn a language to create that website which doesn't get…

Yeah, nobody would let anything important rely on an application written in C. Like apache or nginx. Or postgresql. Or your whole operating system. That would be crazy.

Re: Web development in C: Crazy?

#190

Post by asdasf »

bluecalm wrote: post #134
lmm wrote: post #103

Earlier quoted context omitted.

> Maybe your problem is CPU-bound. Maybe you have latency limits you need to work within. Unless you have lots and lots of time to spend micro-optimizing everything, you'll get better performance writing in Haskell. > Maybe there are good C libraries that solve your problem Maybe, but most of the original post is about how lacking the library ecosystem is. I can well believe that you might have some useful domain-spe…

>Unless you have lots and lots of time to spend micro-optimizing everything, you'll get better performance writing in Haskell. This is just not true. Haskell is terribly (3x,4x) slow comparing to C for the most trivial of computing tasks. You can probably get it to 2x or 1.5x by giving up all the lists and other default data structures as well as writing everything in procedural (by monads) way. If you do all this yo…

You are just saying the equally wrong thing on the opposing side. You can get to 2x without giving up anything. Lists are just a data structure. So are vectors. You don't give anything up to choose one or the other, you pick the right one and use it. You do not write "everything in procedural (by monads) way" to gain performance. Do notation is literally syntactic sugar, and there is no "perform faster" monad to do it in. Haskell code gets to 2x C speeds the same way C gets to 1x C speeds: profile your code and fix the inefficiencies.
Post reply on HN