Live data from Hacker News

BCHS: OpenBSD, C, httpd and SQLite web stack

learnbchs.org

41–50 of 158 posts

Re: BCHS: OpenBSD, C, httpd and SQLite web stack

#41

People love to talk all sorts of trash on this kind of stack but it's really quite solid for what it does. If anyone was ever curious what a sizeable codebase in this kind of code would even look like, check out the source code for undeadly.org [1]. Yeah these people may be crazy but they're also OpenBSD developers and we really love to see what we can get away with using nothing other than what's available in the ba…

[deleted]

Re: BCHS: OpenBSD, C, httpd and SQLite web stack

#44
post #39

If you're going to promote a stack, try at least to showcase all its components in the first example you give. Where is the SQLite part in your "BSD, C, httpd, SQLite" ? https://learnbchs.org/easy.html Hello world apps don't mean much.

This is really hilarious... I just followed the third given example (https://kristaps.bsd.lv/absdcon2017/database-conclusions.htm...) and that's how it goes: "the simplicity of SQLite is a lie". Ok, thanks, I'll pass on the "BCHS" stack then. I now consider this website satire.

Re: BCHS: OpenBSD, C, httpd and SQLite web stack

#45
post #23

Lots of opinions but little facts in the comment. I'd love to see an experiment with people using that and their preferred web stack. Is this really slower to develop? By how much? Is this really unsecure? Is this really simpler, faster?

I’d wager a good portion of my salary that a skilled BCHS developer is slower than a skilled Django/RoR developer to build a usual web app (with auth, payment gateways, admin panels, etc). Not to say BCHS doesn’t look like a laugh to use.

Re: BCHS: OpenBSD, C, httpd and SQLite web stack

#46
post #2

It seems pretty crazy to write web-facing apps in C, with no memory safety at all. (They do have "pledge" but even in the most restricted case, this still leaves full access to database)

It seems like the database libraries they recommend for security, ksql and sqlbox, mitigate the risk with process separation and RBAC, so the CGI process doesn't have full access to the database.

It's definitely contrary to modern assumptions about web app security, but it's interesting to see web apps that are secure because they use OS security features as they were designed to be used, rather than web apps that do things that are insecure from an OS-perspective, like handling requests from multiple users in the same process, but are secure because they do it with safe programming languages.

Re: BCHS: OpenBSD, C, httpd and SQLite web stack

#47
post #40

Earlier quoted context omitted.

Isn’t “C++ is too complex for me” a decent reason?

Object Pascal/Free Pascal then is the obvious choice, it is The better C.

I do use Lazarus/FreePascal for multiplatform GUI apps. It is also very easy to write servers in. Unfortunately performance is worse vs C/C++ and frankly "batteries" included in C++ are way more powerful and simpler to use so I choose C++ for backends. As for all that FUD around C++ - I am not C++ expert at all but I find modern C++ to be very productive, fast for backend development and pretty safe unless one's goal is to purposely shoot themselves in the foot.

Re: BCHS: OpenBSD, C, httpd and SQLite web stack

#48
Writing C might be challenging for some, but as others have mentioned, one can use some other language which gives a statically linked binary to place in the httpd chroot. It won’t be BCHS then.

For uptime.is I’ve used a stack which I’ve started calling BLAH because of LISP instead of C.

Re: BCHS: OpenBSD, C, httpd and SQLite web stack

#49
post #38

Earlier quoted context omitted.

Isn’t “C++ is too complex for me” a decent reason?

It totally is, as long as you don't use C instead. There are plenty of good, less complex languages than C++ out there: Java is quite close and way, way less complex, for example. But C is non of them. Pointers are more complex in C than in C++ (pointer provenance). Casts are more complicated in C than in C++, as C++ named casts are less powerful and therefore give you less opportunity to shoot yourself in the foot.…

Yeah, I'm just going to keep writing C.

Thanks.

Re: BCHS: OpenBSD, C, httpd and SQLite web stack

#50
post #3

I'd be fine with this, even totally on-board, if C weren't so awful with respect to text. You don't even have to worry too much about free()ing your malloc()s if you design around short-lived processes. But this is just asking for security concerns among the tangled web of string and input processing your bespoke C routines are likely to develop into. Pair it with a better, more modern, and safer native-compiled lang…

> Pair it with a better, more modern, and safer native-compiled language and get the same effect. Zig, Nim, Go, hell even Carp. I love how trollish it is not to talk about Rust in that context.

Your message looks like a perfect example of trolling to me.
Post reply on HN