Hacker News Reader

Comment by ejcx | Hacker News Reader

This looks pretty neat actually. A ton of effort clearly went into it and it looks like the code is really well written with pretty well thought out interfaces

"Its main goals are security.."

Is it actually?

I also don't really see an advantage of using something like this over something like the Go net/http package.

Web-type API stuff is usually high enough level that something like C doesn't make sense. Go has nice enough standard packages for system things that even if I was doing a lot of system-y stuff I would be alright. I don't really see the type of work I would be doing where I want to use this.

View on HN

> I also don't really see an advantage of using something like this over something like the Go net/http package.

C runs "everywhere". Your old C64 from the 80's? Has C compilers.

Go does not, even with gccgo.

I'd bet there are also still likely at least two orders of magnitude more programmers that know C well, and still more programmers with in depth experience of embedded development in C than have even tried Go.

I've still yet to meet anyone outside of the startup devops bubble that have written any Go, and often what language the developers have experience with matters more.

> Your old C64 from the 80's? Has C compilers

Yeah, but the idea to use them back then was like trying to use Ruby for real time applications in modern days, given how shitty they were.

Home computers might have had implementations of C and Pascal dialects, but we all used Assembly when stepping out of the built-in Basic and Forth enviroments.

I can see this being useful for embedded systems where Go is not suitable. I'm not super familiar with that whole world, though.

Ahh that is a use case I hadn't considered. I guess it would be pretty useful if some type of basic webserver was required.

It is.

For example being strict on the network input path and doing proper validation of incoming data is a strong part of the design.

Or was the question more related to, it is C therefor security cannot be part of the process?

It does seem like if your goal was security than perhaps Rust would be a better choice.

If your goal is security literally any high level language is a better choice.

High level language like php ? Security and secure code is a mindset. You code without thinking that bad things will happen, you will get bitten.

Sure high level language can help with memory management... but plenty of CVE are because of sloppy coding, not because of low level language.

While you are correct in that picking a higher level language doesn't shield you from writing insecure code, insecure C/C++ failure modes are usually quite a bit worse than other languages used for that purpose. I don't trust myself to write code that handles memory 100% correctly and is also network-facing. If much better developers than I manage to screw that up, what chance do I have?

Mmm, it can be difficult to take advantage from C exploits (in the context of a webserver). On a well written C system, you might expect most bugs to lead to crashes.

PHP bugs tend to be more exploitable, because you're doing something supported by the language.

But what's stopping someone from writing an app-level vulnerability in C vs any other language? Most of them are because of horrible handling of strings, which is something C is also not that great at. I'm not seeing the security benefit here.

My gut feeling is that if you really want security in C, you have fewer constructs to misuse and so you get less unexpected behaviour. At the same time, you get more protection mechanisms; guard pages etc. I.e. harder to be secure, but if you really want to harden, you can get harder than in higher level languages.

I'm not putting any kind of weight behind that, though; I just feel that it's a bit odd for people (not specifically meaning you, just the whole thread) to criticise this purely on language choice and not put any substance behind their criticisms that actually relate to the software in question.

I think the idea still stands. PHP is a fake high level language in my opinion.

A high level language should reduce boilerplate and 'force' you to write concise and predictable code.

PHP does none of that especially in the context of error/exception handling.

None of your standards for what a high-level language should be have any bearing on what a high-level language is, according to the definition that people actually use, and those standards might exclude Python, Ruby, C++ and Java among others.

Actually yes. For security, even PHP is a better choice than C (for certain versions of the idea of "security"). There's entire classes of security problems that are literally impossible in PHP.

Rust won't help you on the dozens of platforms it isn't available.

Reply on news.ycombinator.com