Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ferron – A fast, memory-safe web server written in Rust

github.com

Post reply on HN
Print view View original

71–80 of 102 posts

Re: Ferron – A fast, memory-safe web server written in Rust

#71

Post by 1dom »

solatic wrote: post #67
1dom wrote: post #55

Earlier quoted context omitted.

Can you share a link to your web server please? I'm finding it hard to make sense of your comment: I can't reconcile some of the stuff you're saying. My gut feeling is you're either ridiculously smart, so smart that defining and implementing a security rules engine for a web server is something genuinely trivial for you, and the world has a lot to learn from you. Or, you're really, really not aware of how much you do…

Not OP, and also not a web server genius, but I read OP's comment as allowing server administers to write policy in OPA then just using https://github.com/microsoft/regorus/ to determine whether to allow or forbid the connection. The web server author can clearly document what is available in input/data to be checked against in the policy. Is it really more complicated than that?

I honestly don't know. I'm in the same place as you: not a web server expert. But I did spend a bunch of time in security a while ago, so maybe it's my own bias to be sceptical of anyone who casually suggests building and implementing their own boundary security solutions.

As well as that, the idea that the language any software is written in is largely irrelevant, especially in the context of performance, is not at all obvious or intuitive to me. I get that it would look that way if you reduce a web server down its core functionality. But that also is a common mistake in educated but inexperienced early career software engineers.

I don't know this stuff, but I know enough to know how well I don't know this stuff. I'm trying to work out if the stuff I'm reading is from someone who I should learn from, or if it's from someone with a lot of confidence but limited experience. It could be either, I'm sincerely on the fence, but a git repo of their web server would help clear it up for me personally.

> Is it really more complicated than that?

I can't say without really doing a thorough review. Even if regorus is 100% reliable rules engine, my understanding is it's a rules engine. I assume there's still a bunch of custom integration needed to manage and source the rules, feed them to the engine, and then implement the result effectively and safely across the web server. It can be done quickly and easily, but to consider everything and be confident it's done correctly and securely? I don't think that can be done trivially by the average human without some compromise.

Re: Ferron – A fast, memory-safe web server written in Rust

#72

Post by timeflex »

echoangle wrote: post #65
timeflex wrote: post #62

Earlier quoted context omitted.

You mean the script that you'd have to check every time you want to install? At least with Docker, unless you're running the container privileged then you have some isolation. However, a package manager is usually the recommended approach since those apps are usually checked by maintainers & often routinely scanned for vulnerabilities. A package manager is my preferred approach.

Just for arguments sake, how did you install docker engine? Did you add their apt source where they can push anything they like into their packages? And also, you shouldn’t rely on docker for safety, it might or might not work but docker isn’t a reason to just run an untrusted program.

I'm not even using Docker. I use Podman in rootless mode installed using the system package manager. Even if an app found a way to break out of the container, it wouldn't have elevated privileges.

I'm not saying security is about perfection, but encouraging people to curl something to the shell with sudo is poor practice. I get that it is a newer piece of software, so I am forgiving. But getting it packaged into Homebrew, WinGet, Nix, etc. is more ideal. Some of them may verify a signed package, ensure reproducible builds, track changes for proper uninstalls, etc.

Re: Ferron – A fast, memory-safe web server written in Rust

#74

Post by dorianniemiec »

arnath wrote: post #73

Random thing I’ve been wondering: is there a point in including TLS support in web servers any more? Isn’t it always better to run a reverse proxy and terminate HTTPs at the edge?

The problem is that you will have more moving parts - a web server, and an additional reverse proxy (which can add overhead). Also, Ferron can also be configured as a reverse proxy.

Re: Ferron – A fast, memory-safe web server written in Rust

#75

Post by evantbyrne »

dorianniemiec wrote: post #25
Tepix wrote: post #24

How much memory does it use? Is it suitable for memory-limited scenarios like a Raspberry Pi 1 with 256MB?

I am not exactly sure, but comparing Ferron 1.0.0-beta5 and Caddy 2.9.1 in a benchmark where HTTPS, HTTP/2 are enabled, and default Apache httpd page was served, Caddy used so much memory, that at 12,600 requests per second the system with 16 GB RAM ran out of memory, while Ferron didn't use that much memory, and benchmark succeeded up to 20,000 requests per second. Maybe it's a bug in Caddy?

Either that or misconfiguration with the benchmark setup. A quick google search indicates this can happen with some setups. Maybe try looking at other Caddy benchmark code.

Re: Ferron – A fast, memory-safe web server written in Rust

#76

Post by yjftsjthsd-h »

no_wizard wrote: post #3

I wonder why they left nginx off their comparisons. Is it simply because nginx is still faster I wonder

Especially because the details under that say,

> The web servers serve a default page that comes with NGINX web server.

so yeah, if you even refer to nginx when talking about benchmarks but leave it out, I'm going to favor adverse inference and assume that it's because nginx is faster.

Re: Ferron – A fast, memory-safe web server written in Rust

#78

Post by yencabulator »

dorianniemiec wrote: post #74
arnath wrote: post #73

Random thing I’ve been wondering: is there a point in including TLS support in web servers any more? Isn’t it always better to run a reverse proxy and terminate HTTPs at the edge?

The problem is that you will have more moving parts - a web server, and an additional reverse proxy (which can add overhead). Also, Ferron can also be configured as a reverse proxy.

For many uses, the reverse proxy is the cloud load balancer. That's probably what the grandparent is thinking too.

Re: Ferron – A fast, memory-safe web server written in Rust

#79

Post by pas »

MaxBarraclough wrote: post #51
austin-cheney wrote: post #36

Every web server claims to be fast, so I wonder how they define that. As someone who has written their own supposedly fast web server I only want configuration simplicity. Most web servers are unnecessarily far too complicated. In a web server here is what I am looking for: * Fast. That is just a matter of streams and pipes. More on this later. That said the language the web server is written in largely irrelevant to…

> Fast. That is just a matter of streams and pipes. More on this later. That said the language the web server is written in largely irrelevant to its real world performance so long as it can execute low level streams and pipes. I'm no expert, but that doesn't sound right to me. Efficiently serving vast quantities of static data isn't trivial, Netflix famously use kernel-level optimisations. [0] If you're serious abou…

everyone is using kernel optimisations at that size. (because it's worth it, because there's a well known pattern of load, file/chunk sizes (so I/O in general) and metrics to shoot for)

nginx is a big state machine built around epoll, and there's not much to do with the raw kernel ABI anyway (of course using safer and more powerful tools helps with the general quality of the end result, but not really with speed). it took many years for the uring ABI to emerge (and even using it efficiently is not trivial).

Re: Ferron – A fast, memory-safe web server written in Rust

#80

Post by marcusb »

dorianniemiec wrote: post #34
KennyBlanken wrote: post #32

Earlier quoted context omitted.

Some feedback: you really need to put a features list somewhere prominent and tell people what distinguishes your webserver from others in terms of its capabilities. Also, your FAQ really makes you come off as incredibly patronizing.

Why do you think that FAQ makes me come off as patronizing?

I'd file this under "you can please some of the people, some of the time." If you get those kinds of questions, or if you get questions that indicate some of your potential user community doesn't understand that Ferron is a web server or what a web server is, I personally wouldn't worry too much about it.
Post reply on HN