Hacker News Reader

Hacker News

Comment by coolgoose | Hacker News Reader

Parent Full thread

coolgoose

In before somebody is going to say they can rewrite curl in a weekend hackaton.

View on HN

There is a blogpost about this exactly where Daniel collects similar responses:

https://daniel.haxx.se/blog/2021/05/20/i-could-rewrite-curl/

"We sold a curl exploit" is a nice short story of everything wrong with our rotten industry.

Lobsters and HN have really become a hotspot for arrogant contrarians. You can observe this best in the comment section of any thread that dares to mention modern web development.

The most charitable view I can take of such comments is to mentally paraphrase them to: "I can rewrite the small subset of the curl CLI that I personally use, in a modern language, on top of an existing HTTP library, in a weekend hackathon". That doesn't seem so crazy.

Yeah, especially using libcurl.

writing stuff I use is not that much of an effort. However providing various configuration options, handling edge cases and scenarios millions of programmers would like to use... different league.

of course I can ! just pull in libcurl and then it is just parsing cli arguments

A whole weekend?! With GPT4 and C++23 on the horizon that's more of an afternoon delight.

Hah. Goddamn. This comment was depressing enough to shock me into leaving HN for the night. We have so little time left. I should spend it reading good books.

Half of which is just waiting for the code to compile.

You could ask for gpt to pretend to be a Linux machine and predict how the c++ code would run without compiling with 99% accuracy and just a little chance of hallucinating the target endpoint responding with 418

25 years of CVE:s, why not.

to be fair, if you have ever used the curl C api, you can see why there are 25 years of CVEs, and not 25 years of reliable secure bug free networking (not that its possible).

I love C as much as the next guy, hell, I even write it for fun when I'm feeling down -- but the one thing I won't do, beyond a little "i wrote an http 1.0 server in C" joke project, is networking.

Keep your C offline. If I do networking, it has to be modern C++ with static analyzers, good practices, boost asio, unit testing, and sanitizers, or just Rust, Erlang/Elixir, or whatever other non-C language.

Ive never seen a library get as abused and misused as Curl in source code - well maybe zlib. I think it's great that curl exists, and Im glad its so old that the bugs are mostly worked out, but writing a subset of curl that doesnt have a million issues in a weekend is not so unrealistic.

Why try not, then?

Edit: Just found this[0], hehe. :)

[0]: https://daniel.haxx.se/blog/2021/05/20/i-could-rewrite-curl/

what have you created in the last 25 years?

Done https://news.ycombinator.com/item?id=35229588

What's stopping you from making a basic version? Just about everything supports HTTP 1.0 still so you can make a quick program that sends:

    GET / HTTP/1.0
    Host: example.com

over a socket and that's already mostly working. Figure out TLS. Then you just have to do command line parsing and add the stuff you parsed into your request.

"Figure out TLS."

Is this sarcasm? A joke?

Try eTLS, the e stands for security /s

OpenSSL or your TLS library of choice will likely have documentation and examples showing you how to use it. I'm not sure I understand your point.

Have you looked at the documentation or are you just guessing? When you realize how impenetrable OpenSSL or any TLS lib documentation looks to people untrained in cryptography, you would gain a new appreciation for Git man pages!

I used mbedTLS a while ago when implementing my own HTTPS server from scratch. I had no particular crypto or TLS knowledge, though I did know about ciphers, hashes and certificates from a high level.

Between the docs[1][2] and the examples[3] I was up and running using my own IO stack in a couple of evenings. If I had used the IO stack from the library it would have been very easy.

Another couple of evenings and I had it integrated with Windows' certificate store. In the end it wasn't very difficult to implement, but it was a bit more of a challenge figuring out the documentation and how it related to mbedTLS.

Definitely a rewarding experience, gave me some nice insights into the plumbing.

edit: Note, not trying to argue replacing libcurl is a weekend project!

[1]: https://mbed-tls.readthedocs.io/projects/api/en/latest/

[2]: https://mbed-tls.readthedocs.io/projects/api/en/latest/api/g...

[3]: https://github.com/Mbed-TLS/mbedtls/blob/development/program...

Kind of makes you think that the subject at hand is quite complex in its nature, thus untrained people might do best to steer away until properly trained.

Just don't forget to implement CLI params so we can have drop-in replacement: https://curl.se/docs/manpage.html

Othwerise for basic HTTP version, I'll use Fetch API that has TLS already figured out. https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API

Not much, but the word "basic" does some heavy lifting there.

Even with just http(s), what you describe is just a tiny fraction of typical use cases, even if you ignore all the rarely used bits.

Reply on news.ycombinator.com