Hacker News Reader

Comment by benlivengood | Hacker News Reader

Golang also makes it possible to serve a web site or service from a single binary. You can even avoid linking libc if you stick to core Go (CGO_ENABLED=0), and it comes with all the http and tls libraries you need to replace the traditional web server (nginx, apache, httpd) as well.

I love C and wrote some CGIs in C in the past but I don't love concurrent programming in C. While forking and execing can use shared read-only mmap on .text segments, the .bss and .data will need initialization and copying; there's unavoidable startup overhead that a threaded process avoids, and raw pthreads is kind of painful. If all you need to do is serve a low traffic site, CGI is fine.

My biggest worry would be how often the SQLite DB gets backed up because there's no way a C web server will be free of RCEs in today's world.

View on HN

Shameless plug: if you value Go, and CGO_ENABLED=0, and SQLite, and are worried about C in a web server and RCEs, may I interest you in my SQLite driver?

https://github.com/ncruces/go-sqlite3

I just wrote up the security goals of the tool I use to translate C to Go: https://github.com/ncruces/wasm2go/blob/main/SECURITY.md

I obviously can't make any promises, as it's just a personal pet project, but those are the goals, and they do catch memory corruption bugs in practice: https://sqlite.org/bugs/forumpost/543f94984b

FWIW, there's modernc.org/sqlite which already provides pure Go sqlite implementation.

Might be useful to test your own implementation against.

I do. I had it listed in my own README as an alternative for a long, long time, and both show up in these often posted benchmarks: https://github.com/cvilsmeier/go-sqlite-bench

But for the point I was making, it is in fact not an alternative. In my version each SQLite connection is confined to a sandbox, and a C memory bug cannot corrupt the Go runtime, call stack or heap. In their version, a C pointer becomes an unsafe.Pointer that can address all Go memory.

Thanks for writing this library! It's great. I've used it a couple of times and never had an issue

> there's no way a C web server will be free of RCEs in today's world.

That's a bold claim not supported by facts. The following one had not had any RCE for 27 years, since its inception, and counting. I am certain there are more C web servers written securely.

https://cr.yp.to/publicfile.html

Touche, DJB is one of the few people capable of writing secure C network code.

I also don't exclude the possibility of formally verified C code like seL4 having no RCEs, etc.

Reply on news.ycombinator.com