Hacker News Reader

Comment by bcjpjk | Hacker News Reader

Yeah... this example code is bad. Not to mention that CGI is slow, problematic, and chock full of potential security issues. At the very least, spawning a process per request is a DOS attack waiting to happen, even if the code were immaculate.

View on HN

Classic CGI is not the best performing interface, yes. But there's a big difference in launching a complete interpreter for every request, and running a small purpose-built native program. And remember that people did manage the former 20 years ago, sites like Slashdot were running CGI Perl scripts back then.

I'm not sure about the "chock full of potential security issues". You have to be careful with trusting environment variables as the Bash guys learned, but I don't know what else there is that is specific to CGI.

Forking a process per request is expensive, interpreter or not.

Slashdot used apache mod_perl back then. It never forked a process per request.

CGI was commonly used by everybody and anybody in those years. I recall Slashdot having some CGI pages, not everything but forms processing.

Slashdot started in 1997, the first release of mod_perl was on 12.03.1998. They certainly used cgi at first, just check the url here: https://web.archive.org/web/19980113191337/http://slashdot.o... - it says cgi right there.

Edit: Seems I was wrong about the date, it was actually 28-Jul-1997[1], nevertheless slashdot was only launched two months later, and as the link above witnesses didn't seem to have used it at first.

[1]: https://web.archive.org/web/19971210053529/http://perl.apach...

Then I have good news for you !

https://en.wikipedia.org/wiki/FastCGI

Also: DOS attacks against capacity sound positively benign compared to what they translate to on cloud : DOS on your credit card.

What is lambda?

Reply on news.ycombinator.com