Docs links lead to a 403 forbidden for me https://www.ferronweb.org/docs/
You went to the documentation page while I was uploading the website files after I updated the website. You can now refresh the documentation page.
Ferron – A fast, memory-safe web server written in Rust
61–70 of 102 posts
Re: Ferron – A fast, memory-safe web server written in Rust
#62The first thing on their main homepage is instructions to curl a shell script into Bash using Sudo. I find the argument that they prioritize security unconvincing.
Oh... For safety, it's recommended to check the installation script for suspicious commands. Or you can just pull the image for the Ferron web server from Docker Hub.
You mean the script that you'd have to check every time you want to install? At least with Docker, unless you're running the container privileged then you have some isolation. However, a package manager is usually the recommended approach since those apps are usually checked by maintainers & often routinely scanned for vulnerabilities. A package manager is my preferred approach.
Re: Ferron – A fast, memory-safe web server written in Rust
#63Earlier quoted context omitted.
Why do you think that FAQ makes me come off as patronizing?
I wouldn't be as harsh as that, but "what is a web server" feels very out of place in how basic it is, and the final one that basically just says "read the docs" maybe also doesn't quite land.
On the one hand, the „what is a web server“ seems pretty weird because it’s something most people visiting the page would know. But on the other hand, stuff like this is something I really miss in other places. It’s really annoying to get a link to some GitHub repo and you have to spend 5 minutes to just figure out what you’re even looking at.
Re: Ferron – A fast, memory-safe web server written in Rust
#64Every web server claims to be fast, so I wonder how they define that. As someone who has written their own supposedly fast web server I only want configuration simplicity. Most web servers are unnecessarily far too complicated. In a web server here is what I am looking for: * Fast. That is just a matter of streams and pipes. More on this later. That said the language the web server is written in largely irrelevant to…
Security is not that simple. Duplicate HTTP headers, utf-8 in HTTP headers, case insensitivity etc has resulted in countless security vulnerabilities over the years. Do you reject suspicious requests? Do you process the request but filter out invalid headers? What about suspicious headers being returned from the app being served? You have to make choices here and if you choose unwisely bad things happen. The spec is of little help here, because web browsers and other web servers (and downstream app servers) don't adhere to the specs being sometimes too lenient and in other times too restrictive in what they do.
Just take a look at https://www.rfc-editor.org/rfc/rfc9110#section-5.5 to get an idea of how any choice made by a web server can blow up in your face.
Re: Ferron – A fast, memory-safe web server written in Rust
#65Earlier quoted context omitted.
Oh... For safety, it's recommended to check the installation script for suspicious commands. Or you can just pull the image for the Ferron web server from Docker Hub.
You mean the script that you'd have to check every time you want to install? At least with Docker, unless you're running the container privileged then you have some isolation. However, a package manager is usually the recommended approach since those apps are usually checked by maintainers & often routinely scanned for vulnerabilities. A package manager is my preferred approach.
Just for arguments sake, how did you install docker engine? Did you add their apt source where they can push anything they like into their packages?
And also, you shouldn’t rely on docker for safety, it might or might not work but docker isn’t a reason to just run an untrusted program.
Re: Ferron – A fast, memory-safe web server written in Rust
#66Kudos. It would have been nice to see benchmarks compared to Nginx, since it's extremely popular.
I'm not using any of the other servers in the benchmark so it's meaningless to me.
Re: Ferron – A fast, memory-safe web server written in Rust
#67Every web server claims to be fast, so I wonder how they define that. As someone who has written their own supposedly fast web server I only want configuration simplicity. Most web servers are unnecessarily far too complicated. In a web server here is what I am looking for: * Fast. That is just a matter of streams and pipes. More on this later. That said the language the web server is written in largely irrelevant to…
Can you share a link to your web server please? I'm finding it hard to make sense of your comment: I can't reconcile some of the stuff you're saying. My gut feeling is you're either ridiculously smart, so smart that defining and implementing a security rules engine for a web server is something genuinely trivial for you, and the world has a lot to learn from you. Or, you're really, really not aware of how much you do…
Not OP, and also not a web server genius, but I read OP's comment as allowing server administers to write policy in OPA then just using https://github.com/microsoft/regorus/ to determine whether to allow or forbid the connection. The web server author can clearly document what is available in input/data to be checked against in the policy. Is it really more complicated than that?
Re: Ferron – A fast, memory-safe web server written in Rust
#68Kudos. It would have been nice to see benchmarks compared to Nginx, since it's extremely popular. I'm not using any of the other servers in the benchmark so it's meaningless to me.
Thank you!
Re: Ferron – A fast, memory-safe web server written in Rust
#69Why no benchmarks against Nginx?
Re: Ferron – A fast, memory-safe web server written in Rust
#70Earlier quoted context omitted.
Go has larger ecosystem of libraries for building web servers. You have FrankenPHP for running PHP, Lego for automatic TLS, etc. For Rust there is `tokio-rustls-acme` crate (used by Ferron) for automatic TLS. While for PHP there is a `php` crate that depends on unsupported PHP version. Ferron uses FastCGI for communicating with PHP-FPM daemon instead. However, Go uses a garbage collector, unlike Rust, which has a bor…
Rust has garbage collection.
no it doesn't