Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ferron – A fast, memory-safe web server written in Rust

github.com

Post reply on HN
Print view View original

41–50 of 102 posts

Re: Ferron – A fast, memory-safe web server written in Rust

#41

Post by fatchan »

dorianniemiec wrote: post #22
eptcyka wrote: post #20

How does it handle slow loris?

Hyper (HTTP library used by Ferron) has request header timeout of 30s by default if a timer is set. Ferron sets the timer for Hyper for request header timeout to work, thus mitigating Slowloris.

Offering more detailed timeouts for other stages of the request would be great, too.

For example with HAProxy you can configure separate timeouts for just about everything. The time a request is queued (if you exceed the max connections), the time for the connection to establish, the time for the request to be recived, inactivity timeout for the client or server, inactivity timeout for websocket connections... The list goes on: https://docs.haproxy.org/3.1/configuration.html#4-timeout%20...

Slowloris is more than just the header timeout. What if the headers are received and the request body is sent, or response consumed very slowly? And even if this is handled with a "safe" default, it must be configurable to cater to a wide range of applications.

Re: Ferron – A fast, memory-safe web server written in Rust

#42

Post by jsheard »

dorianniemiec wrote: post #7

The author of Ferron web server here. Thank you so much for submitting this, and thank you all for the support you have shown when I submitted the server on Hacker News.

Nitpick: the logo at the top of your readme is unreadable in GitHubs dark mode.

Re: Ferron – A fast, memory-safe web server written in Rust

#43

Post by dorianniemiec »

fatchan wrote: post #41
dorianniemiec wrote: post #22

Earlier quoted context omitted.

Hyper (HTTP library used by Ferron) has request header timeout of 30s by default if a timer is set. Ferron sets the timer for Hyper for request header timeout to work, thus mitigating Slowloris.

Offering more detailed timeouts for other stages of the request would be great, too. For example with HAProxy you can configure separate timeouts for just about everything. The time a request is queued (if you exceed the max connections), the time for the connection to establish, the time for the request to be recived, inactivity timeout for the client or server, inactivity timeout for websocket connections... The li…

I also implemented timeouts for response processing (including reading the request body from the client), to protect against Slow HTTP POST attacks.

Re: Ferron – A fast, memory-safe web server written in Rust

#44

Post by dorianniemiec »

jsheard wrote: post #42
dorianniemiec wrote: post #7

The author of Ferron web server here. Thank you so much for submitting this, and thank you all for the support you have shown when I submitted the server on Hacker News.

Nitpick: the logo at the top of your readme is unreadable in GitHubs dark mode.

So how can I put a logo with bright text in dark mode and dark text in light mode on the read-me for a GitHub repository?

Re: Ferron – A fast, memory-safe web server written in Rust

#46

Post by dorianniemiec »

koakuma-chan wrote: post #40
austin-cheney wrote: post #36

Every web server claims to be fast, so I wonder how they define that. As someone who has written their own supposedly fast web server I only want configuration simplicity. Most web servers are unnecessarily far too complicated. In a web server here is what I am looking for: * Fast. That is just a matter of streams and pipes. More on this later. That said the language the web server is written in largely irrelevant to…

In Rust all web frameworks are fast because they all use the same stack tokio + hyper.

By the way, Ferron web server also uses Tokio and Hyper.

Re: Ferron – A fast, memory-safe web server written in Rust

#48

Post by jsheard »

dorianniemiec wrote: post #44
jsheard wrote: post #42

Earlier quoted context omitted.

Nitpick: the logo at the top of your readme is unreadable in GitHubs dark mode.

So how can I put a logo with bright text in dark mode and dark text in light mode on the read-me for a GitHub repository?

Either give it a solid background, or do this: https://github.blog/changelog/2022-05-19-specify-theme-conte...

Re: Ferron – A fast, memory-safe web server written in Rust

#49

Post by dorianniemiec »

timeflex wrote: post #47

The first thing on their main homepage is instructions to curl a shell script into Bash using Sudo. I find the argument that they prioritize security unconvincing.

Oh... For safety, it's recommended to check the installation script for suspicious commands. Or you can just pull the image for the Ferron web server from Docker Hub.

Re: Ferron – A fast, memory-safe web server written in Rust

#50

Post by dorianniemiec »

jsheard wrote: post #48
dorianniemiec wrote: post #44

Earlier quoted context omitted.

So how can I put a logo with bright text in dark mode and dark text in light mode on the read-me for a GitHub repository?

Either give it a solid background, or do this: https://github.blog/changelog/2022-05-19-specify-theme-conte...

Thank you! I have visited the post from the link, and added the dark mode logo.
Post reply on HN