Live data from Hacker News

Nope.c – A web framework with a tiny footprint

nopedotc.com

31–40 of 53 posts

Re: Nope.c – A web framework with a tiny footprint

#32
post #29
post #13

Earlier quoted context omitted.

Yes, it uses lots of strcpy and sprintf instead of strncpy, snprintf or strlcpy. It's bound to be exploited.

It depends. It's not like there's no safe way of using strcpy and sprintf.

The safe way to use strcpy is to use strncpy

Re: Nope.c – A web framework with a tiny footprint

#34
post #5

Looking at the source code : https://github.com/riolet/nope.c/blob/c883b11df78bb8115d5e51... It tries to copy a buffer of 1024 byte (max) into a buffer of 512 bytes (by executing a request with an URL longer than 512 bytes). It also runs 15 children process and use blocking socket, meaning that it's easily "DoS'able". The overall code seems very "unsecure" and poorly designed.

Apparently people are taking advantage of that right now...

Re: Nope.c – A web framework with a tiny footprint

#36
I responded on Reddit with a link to my litheweb (the sources still say picoweb throughout it. I yet have to rename-refactor it).

https://github.com/datenwolf/litheweb

Lithweb is developed network API agnostic and requires no dynamic memory allocation (malloc/free). Its main target are microcontrollers and it has a memory footprint of as little as 0.5kiB. To make it work you'll have to provide an implementation of the ioops functions.

GET variable support has the scaffolding up, but URL parameter parsing not yet implemented.

However POST request support it fully implemented, including MIME Multipart reconstuction.

See the test/bsdsocket.c for an example on how to implement ioops and for a file upload example.

So far the repositry does not contain the tag nesting functions, but I have those, too.

Security issues? Probably some but so far not identified yet. However when I tried fuzzing it, the fuzzer got crashed by litheweb %) (litheweb was not impressed).

Re: Nope.c – A web framework with a tiny footprint

#38
post #26

This site feels ridiculously fast. I've noticed that with other compiled frameworks too, e.g. CppCMS: http://cppcms.com/wikipp/en/page/main I wonder if it is just the lightweight HTML the websites use, or if there is really so much speed to gain from using a compiled language.

Commenters on this site had similar observations about D language's forum, which is written in D. http://forum.dlang.org/ Code: https://github.com/CyberShadow/DFeed If one insists on writing a webapp in a C/C++ like language, D might be the sane way to do it.

Google Go is a popular way to do it.

Re: Nope.c – A web framework with a tiny footprint

#39
post #26

This site feels ridiculously fast. I've noticed that with other compiled frameworks too, e.g. CppCMS: http://cppcms.com/wikipp/en/page/main I wonder if it is just the lightweight HTML the websites use, or if there is really so much speed to gain from using a compiled language.

Commenters on this site had similar observations about D language's forum, which is written in D. http://forum.dlang.org/ Code: https://github.com/CyberShadow/DFeed If one insists on writing a webapp in a C/C++ like language, D might be the sane way to do it.

Nimrod is also becoming a real possibility, check out the Jester framework. I forget the other's name, but it did reasonably well on TehcEmPower benchmarks and runs behind the Mongrel2 web server via ZeroMQ sockets. Very cool stuff.

Re: Nope.c – A web framework with a tiny footprint

#40
post #7

This site feels ridiculously fast. I've noticed that with other compiled frameworks too, e.g. CppCMS: http://cppcms.com/wikipp/en/page/main I wonder if it is just the lightweight HTML the websites use, or if there is really so much speed to gain from using a compiled language.

Yes, there are definitely huge speed gains possible and if you choose an implementation which is still interactive you get the benefits of both (I know one particular example in CL: teepeedee2, there are some blogs posts, e.g. http://john.freml.in/teepeedee2-c10k or so).

I have seen it come up many times, but is anyone still using it or tried it long term? I checked a year ago or so and it appears both Git commit-wise and blogwise Fremlin had moved on to better things, but when people dismiss Lisp, I don't say it out loud but I immediately think of this project.
Post reply on HN