Show HN: Demo of Wiki and Forum coded in C under 80k | Hacker News Reader

Show HN: Demo of Wiki and Forum coded in C under 80k

home.ronsor.gq

47 pointsronsor56 comments

I really think we should stop being so mean to the submitter. Sure the code might have problems and the whole approach might not be advisable, but I am sure they have learned a lot from doing this. Ronsor congratulations for actually shipping.

I think the negativity comes from the fact this site now linked on the front page of HN can be hacked to send malicious JavaScript to people...

Also, in my opinon, adding "Demo" means that it shows how to do it, but that's not clearly not how to do it properly.

Yes it should not be getting the attention it is getting right now, but we can approach this in a more generous fashion. Let's help rather than ridicule.

Well even Google still has tons of bugs (including XSS and XSRF).

Nowadays it's not possible to write applications without knowledge of XSS, XSRF, SQLi, redirects etc.etc. The security amount you have to understand is just getting ridiculous.

And let's not even mention DOS. No-one is securing against that and most servers can be made inaccessible by a simple script that just opens connections.

I wouldn't characterize a collegial inspection of key security/durability features a website should employ as mean-spirited.

Considering that there's some low-hanging fruit still to be plucked, it's better for someone to point them out, and demonstrate the necessity to close these easily-leveraged gaps quickly, rather than to leave them open for someone much less scrupulous to misuse.

I'll upload the source code tomorrow...

Edit: Its also running on my 4mb flash openwrt router, and has NO dependencies

Excited to see the code. C isn't known for being great for writing high level applications like this, so I'm really curious what the source looks like. Especially since it has no dependencies!

I wonder if it has no buffer overflows either. ;-)

C is definitely not known for easy and safe string processing, so I'm quite curious to see how it accomplishes that.

It's not too hard if you are willing to use fixed length buffers and safe calls like: strlcpy, strlcat, and snprintf.

Also not terribly hard to write a small arbitrary length string library as part of the project.

its still not as easy as in languages with modern libraries.

a = "foo" + "bar"; is very useful so is b = a.split( "," ); or a = b.trim(); etc. C strings are rarely so convenient.

its more obvious with the more high level things you want. to do something like b = a.split( "," ); on a string that is not know until runtime you need dynamic allocations and you could use strtok to fill that memory with the results, but its an error-prone ballache by comparison.

Someone should totally build a dynamically typed language around C which is specifically meant for dealing with HTTP and serving HTML.

It's called PHP

I was going to say that.

Go works pretty well for that :)

I still maintain that + is a terrible operator for concatenating strings, and results in quite a few types of bugs that are pervasive in many languages (usually from trying to automatically coerce non-matching operands).

I think I agree. PHP uses ., and I can't recall ever having a problem with that. However, I've been bitten by +.

i can accept that argument. basic used & and php uses . as mentioned by another comment. :)

Not all implementations of snprintf behave the same way. Many are subtly broken.

Some don't nul terminate the string if it's longer than the destination buffer.

Also the return value can be -1 (correct behavior on failure, but it's often left unchecked) or more than destination buffer size! Fun times if you accumulate total written without range checking snprintf return value...

To add, notably this:

_snprintf, _snprintf_l, _snwprintf, _snwprintf_l -> https://msdn.microsoft.com/en-us/library/2ts7cx93.aspx

  "If len > count, count characters are stored in buffer, no null-terminator is appended, and a negative value is returned."

Uh, what?

I guess that's why it is _snprintf and not snprintf, huh?

They do provide secure [1] versions too, but you need to be careful which one you pick. Those secure versions terminate execution in some cases if buffer length is exceeded.

[1]: https://msdn.microsoft.com/en-us/library/f30dzcf6.aspx - better remember that _TRUNCATE flag.

All data is checked to see whether it is larger than 3768 (the buffers are 4096)

you may be surprised how easy it is to write a http server that replies with html in C... its all just text going over sockets after all.

i did it myself a lot a long time ago by teaching myself, but you are right that using some full featured server and some high level language targetting web development has much more convenience, especially if you care about rich features and security.

They claim it's got no dependencies though - so somehow they've got their own sockets implementation crammed in there.

i doubt it tbh, i bet he means no /3rd party/ dependencies other than the ones that came with the development environment.

the C standard library and the usual set of headers and os functions that you get in most C environments is not what people tend to mean by dependencies....

POSIX?

Its quite possible to have a C-based sockets-/signals- handler in a single source file, say .. 48k lines of code or so. I've seen many robust system daemons with just such an implementation.

3rd party dependencies are definitely an issue that very few languages have managed to promote, since languages either want to promote (or demote) such circumstances as mass-package (i.e. mass usage of the language) in a broad commercial/industrial/social context.

But its not naive to write such things as a Wiki and a Blog in C. Just .. dangerous. I imagine there are, however, some good 3rd-party C libraries available to do less-dangerous implementations, however...

it never seems to actually be posix, but yeah that kind of stuff.

it is interesting stuff.

It's served from another httpd server, no sockets library was used. Just simple file I/O, string.h, and its own implementation of hashing

It is relatively easy. I've done it myself many moons ago.

I've followed Steve off and on over the years. He seems to prefer C++ as a web-app language so much so that he blogs about it and other things. I like his stuff. I discovered Steve through Joel On Software some years ago. If memory serves me, I think at one time he was publishing a Web CMS type engine written in C++ but I could have him confused with someone else (been awhile)

Here is his site: http://stevehanov.ca/blog/index.php?id=95

> NO dependencies

not even sockets? because /that/ would be impressive.

I think what the OP meant was no 3rd party library dependencies such as a CGI library and that he's still dependent on OS system calls such as file I/O and sockets.

You don't need sockets. I used xinetd instead. Got the idea from someone else on the net. Not uncommon. And performance isn't bad either just 10% less than what it could have been, even if every request spawns a process.

Unix processes creation is lightweight and fast, unlike Windows.

Curiously enough, after 10 hours your work is still running, having survived a slashdot'ing. Well done! I applaud your bravado! Bravo!

It looks interesting. Unfortunately, judging from the comments here, it's also more or less useless. I really look forward to seeing the source code, though, but the hard part is the part that seems not yet done - which is the security.

I mean, what even is the point of sending me a file with a txt extension if you're not sending text headers?

What are your thoughts re: adding memory protection to C? (in other words: add a distinction between "pointer bytes" and "raw data bytes" and some rules regarding pointer assignment, arithmetic, and dereferencing that serve to treat the pointer bytes as protected memory of a "3rd space" that sits between kernel space and user space; thereby ensuring that a program can only obtain a pointer to either a stack location (with restrictions) or heap location that points to a byte in an allocated segment of memory?)

I've actually been building a teaching VM with these properties. You can't take the address of arbitrary values (so there's no distinction between lvalues and rvalues), there's no pointer arithmetic (instead you have type-safe primitives for record access and array indexing), all arrays (including strings) know their length and bounds-check accesses, and unions behave more like sum types, always knowing precisely what type they have stored. All these constraints ensure you can never convert a number to an address, or generate an address to an illegal value. More info about the goal and rationale: http://akkartik.name/post/mu; http://github.com/akkartik/mu.

I also recently found out about http://eigenstate.org/myrddin which seems more mature with very similar goals/aesthetics. I've been digging into it a fair bit.

Finally, on the extreme other end of the spectrum, there's Rust.

You should call this system "Java". <g>

Some compilers have options for separating call stack and function stack. So an under or overflow of a char buf[] can't corrupt return stack frame.

Now that more than enough people complained about security etc. I also want to add that a modern wiki doesn't really work with their own grammar anymore. Consider changing to markdown, restructuredText, MediaWiki, or Atlassian style (last not really suggested but better than nothing).

I wanted to keep it small, so i didn't use markdown, MediaWiki, etc, since those are harder to parse

http://home.ronsor.gq:12321/pub/ohshitwhoputthishere.txt

seems that cgi-bin is also writable, can't make the file executable though

http://home.ronsor.gq:12321/cgi-bin/ohshit.txt

It is interesting from performance and low resource consumption point of view. Great work! I wonder if someone would like to do the same in assembly language for even more crazy experiment -)

Ask and ye shall receive: https://new-hn.algolia.com/?query=Web%20server%20assembly&da...

During this testing period, I would like to thank everyone who found the bugs and other issues with it. I am now working on fixing them all.

this is still an awesome project, unfortunately there will be lots of python and ruby hipsters here who will dismiss this project... it doesn't matter, since most software you use is built in C or C++, and that won't change anytime soon :-)

Server stopped working after doing this:

/cgi-bin/wiki?../../../srv/www/cgi-bin/wiki\0txt.e

That was mean.

I already figured that would be tried, so, I filter all '/' from strings.

http://home.ronsor.gq:12321/cgi-bin/irc.html

  <script type="text/javascript">alert('you guys better watch out for dat XSS and XSRF bidness');</script>

Oh god, this shit is sooooo not secure.

well you're missing a </xmp> to get it working

Whoops, somehow IRC is kill.

They should have prevented special characters from being entered at the server level.

Not a lot you can do with just the latin alphabet, numerals and a space.

This comment breaks the Show HN guidelines:

Be respectful. Anyone sharing work is making a contribution, however modest.

Instead of "you're doing it wrong", suggest alternatives. When someone is learning, help them learn more.

https://news.ycombinator.com/showhn.html

back in the day people coded demos 4k in size with 3d graphics and music

In for the source code

Not trying to be snarky, but if the goal was to show why you shouldn't do something like this, you've succeeded.

Would you consider rewriting something like this in rust or go, and doing a comparison? I think you would have found things to combat XSS in either of those languages (safe templating), would be interested to see the differences... And if any of those languages deliver on their promise to be safer than C

rust & go do not produce small enough executables for my use case. atleast i didn't do it using shell scripts.

Have you taken a look at dynamically linked rust/go? Also, go 1.6 is going to have dynamic linking also.

http://stackoverflow.com/questions/29008127/why-are-rust-exe...

https://golang.org/doc/go1.5#compiler

Reply on news.ycombinator.com