"This webpage is not available"
It's probably already been compromised since C has no bounds check whatsoever.
Nope.c – A web framework with a tiny footprint
11–20 of 53 posts
Re: Nope.c – A web framework with a tiny footprint
#12I think HN just broke your server.
Edit: Just read the linked Reddit thread, looks like there were some security issues. But hey, that's the power of open source, right? People can tell you instantly when shit is broken or unsafe.
Re: Nope.c – A web framework with a tiny footprint
#13Looking at the source code : https://github.com/riolet/nope.c/blob/c883b11df78bb8115d5e51... It tries to copy a buffer of 1024 byte (max) into a buffer of 512 bytes (by executing a request with an URL longer than 512 bytes). It also runs 15 children process and use blocking socket, meaning that it's easily "DoS'able". The overall code seems very "unsecure" and poorly designed.
Yes, it uses lots of strcpy and sprintf instead of strncpy, snprintf or strlcpy. It's bound to be exploited.
Re: Nope.c – A web framework with a tiny footprint
#14I think HN just broke your server. Edit: Just read the linked Reddit thread, looks like there were some security issues. But hey, that's the power of open source, right? People can tell you instantly when shit is broken or unsafe.
I think this post is a joke of some sort ("nope.c"), example of how not to do things and why we don't code web apps in C. The "web server" is just ridiculously badly designed.
Re: Nope.c – A web framework with a tiny footprint
#15The code is filled with bloopers.
Re: Nope.c – A web framework with a tiny footprint
#16I think HN just broke your server. Edit: Just read the linked Reddit thread, looks like there were some security issues. But hey, that's the power of open source, right? People can tell you instantly when shit is broken or unsafe.
I think this post is a joke of some sort ("nope.c"), example of how not to do things and why we don't code web apps in C. The "web server" is just ridiculously badly designed.
Feels like an educational project. So I wouldn't be too harsh on the author. Should've probably made it more clear though.
Re: Nope.c – A web framework with a tiny footprint
#17Looking at the source code : https://github.com/riolet/nope.c/blob/c883b11df78bb8115d5e51... It tries to copy a buffer of 1024 byte (max) into a buffer of 512 bytes (by executing a request with an URL longer than 512 bytes). It also runs 15 children process and use blocking socket, meaning that it's easily "DoS'able". The overall code seems very "unsecure" and poorly designed.
Why do you think it's called "nope.c?" ;)
Re: Nope.c – A web framework with a tiny footprint
#18Looking at the source code : https://github.com/riolet/nope.c/blob/c883b11df78bb8115d5e51... It tries to copy a buffer of 1024 byte (max) into a buffer of 512 bytes (by executing a request with an URL longer than 512 bytes). It also runs 15 children process and use blocking socket, meaning that it's easily "DoS'able". The overall code seems very "unsecure" and poorly designed.
Yes, it uses lots of strcpy and sprintf instead of strncpy, snprintf or strlcpy. It's bound to be exploited.
Not only just that, but it seems in many cases there is absolutely no bounds checking whatsoever. There are legacy libraries out there that use the str* group of functions safely, because there is careful bounds checking before each call. That's still far less reassuring than just using safe functions, but it's better than absolutely nothing.
Based on the inconsistent use of tabs and spaces, lack of whitespace around any sort of operators or special syntax, and total disregard for security, this looks much more like a 1995 project than a 2014 one.
Re: Nope.c – A web framework with a tiny footprint
#19Nice try, a bit buggy but nothing that can't be solved.
Even tho people here on HN seams a but harsh there is some good lessons to be learned from them.
Re: Nope.c – A web framework with a tiny footprint
#20Better use nxweb, this one isn't that secure: http://www.reddit.com/r/programming/comments/2bo44u/i_am_the...