Earlier quoted context omitted.
It's the Linux equivalent of downloading and running random binaries in Windows.
*running as administrator
Gonna steal all your files, passwords and crypto as a regular user anyway?
Show HN: I'm rewriting a web server written in Rust for speed and ease of use
51–60 of 100 posts
Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use
#52Earlier quoted context omitted.
Can we stop with this nonsense already? If you trust them enough to run their server code, why wouldn't you trust them with the installation script?
Read how Tls works. Many people Can mitm. That’s why we sign applications
If they can MITM the installation script delivered over HTTPS, they can also MITM the website delivered over HTTPS.
You can have 10 step instructions for users to add your PGP signing key and install your APT repository, but what difference does it make? None at all. A malicious website will copy your instructions and replace the signing key and the repository URL with their own.
Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use
#53That’s awesome — congrats on reaching the release candidate stage!
I’m curious about the performance improvements you mentioned. Did you benchmark against other Go web servers like Caddy or fasthttp?
Also really like that you’ve made automatic TLS the default — that’s one of those “quality of life” features that make a huge difference for users.
I’m working on an open-source project myself (AI-focused), and I’ve been exploring efficient ways to serve streaming responses — so I’d love to hear more about how your server handles concurrency or large responses.
Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use
#54> Any feedback is welcome! Read https://www.joelonsoftware.com/2006/12/09/simplicity/ and ask yourself if you are truly solving anyone's problem or if you are just looking for a way to rationalize the amount of time you are spending on a hobby.
Wow, what a harsh comment. You make it sound like we should squeeze any form of efficiency out of people or you're wasting time
> like we should squeeze any form of efficiency
The complete opposite. It's OP that's trying to "optimize the web server for reverse proxying and static file serving", when what we have out there is more than enough.
> or you're wasting time
"Wasting time" is not a problem. If OP is doing working on things because it brings them pleasure and they are hoping to learn from it, more power for them. What bugs me about these types of posts is when people are set on the "build a better mouse trap" mentality and want others to validate them.
It may sound "harsh" to you, but if I came up asking for "any type of feedback" when I'm trying to figure out if the idea is worth persuing, I'd be pretty upset if I kept chasing an invisible dragon because the community was more concerned about "hurting my feelings" instead of being upfront and give some warning like this might be interesting to you but it's not solving any real pain point. Keep that in mind when deciding if work on this will be worthwhile.
Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use
#55Earlier quoted context omitted.
I don’t trust them enough to run as root.
But you have to. Nginx, caddy, traefik, etc cannot run without root or even if you can, it would be way more limiting
1) That isn’t true.
2) Even if it were, I’m not going to do so while evaluating an unknown program.
Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use
#56Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use
#57Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use
#58Earlier quoted context omitted.
Can we stop with this nonsense already? If you trust them enough to run their server code, why wouldn't you trust them with the installation script?
Because untrustworthy websites can piggyback on the brand name. "Download ffmpeg here: sudo bash -c ..." And then the installation script from our malicious site installs ffmpeg just fine, plus some stuff you have no idea about. And you never know that you've just been hacked.
Can you repeat this mental exercise for every other installation method you can think of? e.g. distributing deb/rpm files, distributing AppImages, asking users to add your custom repository and signing key?
(Yes I know that the last one has built-in benefits for automatic updates but that's not going to protect you on initial installation and its benefits can be replicated in a more portable way in any other auto-update mechanism with a similar amount of effort)
((And if you have the patience to set up a custom repository, you can simplify initial installation process using a "curl|bash" script))
Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use
#59> Any feedback is welcome! Read https://www.joelonsoftware.com/2006/12/09/simplicity/ and ask yourself if you are truly solving anyone's problem or if you are just looking for a way to rationalize the amount of time you are spending on a hobby.
It's good to have as many web servers as possible out there. Stop being so harsh and touch some grass
> It's good to have as many web servers as possible out there.
The problem space of "web servers to serve static files and reverse proxy" is fairly small, how many differing solutions and designs would be required to satisfy your idea of "as many as possible"?
At what cost? For what benefit?
Again: if OP wants to work on this because they take joy in it, fine. But be honest about it (to themselves and to others) instead of coming up with all sorts of ratioinalizations and biased comparisons when talking about the alternatives.
Re: Show HN: I'm rewriting a web server written in Rust for speed and ease of use
#60Earlier quoted context omitted.
They do offer other installation methods already. Installation via package managers (Debian/Ubuntu), using repo provided by ferron https://ferron.sh/docs/installation/debian Installation as a Docker container https://ferron.sh/docs/installation/docker And more.
That's true, but that's not what's front and center. Curl-sudo-bash is the first thing you see on the site, all the other options are close to the bottom of the page. Defaults matter and people tend to use whatever is the first option presented to them unless they have a good reason to do otherwise.
> using repo provided by ferron
This poses a similar security risk to executing the "curl-sudo-bash".