Hacker News Reader

Comment by charcircuit | Hacker News Reader

What's stopping you from making a basic version? Just about everything supports HTTP 1.0 still so you can make a quick program that sends:

    GET / HTTP/1.0
    Host: example.com

over a socket and that's already mostly working. Figure out TLS. Then you just have to do command line parsing and add the stuff you parsed into your request.

View on HN

"Figure out TLS."

Is this sarcasm? A joke?

OpenSSL or your TLS library of choice will likely have documentation and examples showing you how to use it. I'm not sure I understand your point.

Have you looked at the documentation or are you just guessing? When you realize how impenetrable OpenSSL or any TLS lib documentation looks to people untrained in cryptography, you would gain a new appreciation for Git man pages!

Kind of makes you think that the subject at hand is quite complex in its nature, thus untrained people might do best to steer away until properly trained.

I used mbedTLS a while ago when implementing my own HTTPS server from scratch. I had no particular crypto or TLS knowledge, though I did know about ciphers, hashes and certificates from a high level.

Between the docs[1][2] and the examples[3] I was up and running using my own IO stack in a couple of evenings. If I had used the IO stack from the library it would have been very easy.

Another couple of evenings and I had it integrated with Windows' certificate store. In the end it wasn't very difficult to implement, but it was a bit more of a challenge figuring out the documentation and how it related to mbedTLS.

Definitely a rewarding experience, gave me some nice insights into the plumbing.

edit: Note, not trying to argue replacing libcurl is a weekend project!

[1]: https://mbed-tls.readthedocs.io/projects/api/en/latest/

[2]: https://mbed-tls.readthedocs.io/projects/api/en/latest/api/g...

[3]: https://github.com/Mbed-TLS/mbedtls/blob/development/program...

Try eTLS, the e stands for security /s

Just don't forget to implement CLI params so we can have drop-in replacement: https://curl.se/docs/manpage.html

Othwerise for basic HTTP version, I'll use Fetch API that has TLS already figured out. https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API

Not much, but the word "basic" does some heavy lifting there.

Even with just http(s), what you describe is just a tiny fraction of typical use cases, even if you ignore all the rarely used bits.

Reply on news.ycombinator.com