G-WAN, Another Free Web Server

mssmss writes "Has anyone used G-WAN — a free (as in beer), supposedly fast and scalable Web server? The downside is it supports only C scripts, which the author claims is a plus since most programmers know C anyway. There is currently only a Windows release and no clear answer in their FAQs whether there would be Linux/Solaris releases. As an interesting aside, releasing a Web server while at the same time fighting a losing battle (PDF) with a large bank over a piracy claim of $200 million (the bank is alleged to have done the piracy) is quite a feat."

Comments

Comment removed

[account_deleted]

Comment removed based on user account deletion

Value?

[mcrbids]

Where's the value/point in releasing another limited-utility webserver?

I see the point in having a few options for a particular category, so that you can choose between different optimizations for things like cost, performance, and compatibility. But why something of limited utility (only runs C scripts) compatibility (only runs on 'doze) AND cost? (not OSS, but it's free!)

I don't know. Even with a fairly "heavy" web server such as Apache, the performance increases by going with another "lighter" platform seldom represent more than a year or so of hardware advance.

So.... Why?

Re:Value?

[Anonymous Coward]

So.... Why?

afaik, the main reason for giving it away for free is: its author needs much traffic on his site, in order to hide some very secret traffic happening there.

hard to believe, but this is what he pretends!

so, please, download it, even if you don't plan to use it :-)

Re:Value?

[Anonymous Coward]

Only if it does something of value.

I recall a very lightweight web server that some large outfit uses to serve up images. That's it. only images. Apparently it made things speed up significantly.

I don't see G-WAN being anything special, though.

Re:Value?

[kjs3]

> Where's the value/point in releasing another limited-utility webserver?

Well...that depends I suppose. I don't think G-WAN is worth paying attention to, but Marcus Ranum semi-famously wrote a "limited utility" web server for an porn site that was both very fast and very secure in 1996, and still was a decade later. I agree with his point that not everything requires Apache level functionality, and all those bells and whistles come at a cost. Right tool for the job and all that.

http://www.ranum.com/security/computer_security/editorials/master-tzu/

I truly believe that the patching fad in which we are currently living is not going to last much longer. It can't. In another couple years, we'll have one full-time patcher to each system administrator. What's odd is that if companies simply exercised a bit of discipline, it wouldn't be necessary at all. Back in 1996 a buddy of mine and I set up a web server for a high-traffic significant target. It was not the Whitehouse; it was a porn site. We invested 8 hours (of our customer's money) writing a small web server daemon that knew how to serve up files, cache them, and virtualize filenames behind hashes. It ran chrooted on a version of UNIX that was very minimized and had code hacked right into the IP stack to toss traffic that was not TCP aimed at port 80. 10 years later, it's still working, has never been hacked, and has never been patched. If you compute the Return On Investment (Or ROI in the language of Prince Ciao) it's gigantic.

Re:Value?

[JWSmythe]

    I did some testing for a company not all that long ago. They needed to serve up images fast. No html. No parsed code. Just images. Lighttpd, thttpd, and a bare bones stripped down Apache 1.3.x. My money was on thttpd. I was sure it would outperform the others, but we went to serious comparative testing anyways. I had done similar testing many years before, and switched a farm of servers doing images and static HTML files over to it.

    As it turned out, lighttpd and the bare bones Apache were just about even, with a few speed advantages in Apache's favor. So despite what I would have preferred (thttpd), that project went to the bare bones Apache.

Spite?

[innocent_white_lamb]

It looks like this chap has a grudge against Microsoft (he says his company was "eradicated from the market the usual way", apparently by Microsoft) so he wrote this webserver to hit them "where it hurts".
 
I don't know if spite is the best motivation to write excellent software.

Re:Spite?

[zblack_eagle]

I don't know how writing a web server that requires a Microsoft OS exactly hits them "where it hurts"

Re:Spite?

[zblack_eagle]

No, I just figured he'd develop a web server using tools that weren't MS tools for an OS that wasn't a MS OS. If he wanted to spite them, at least. If I was in the business/hobby of making turbo mods for cars, and I hated Ford, I wouldn't make turbo mods solely for Ford cars

Re:Spite?

[tobiasly]

Not just against Microsoft, this guy just seems to be full of piss and vinegar in general. Every entry in his blog is a rant against something, whether it's Microsoft, the world economy, the Western Hemisphere, or those stealthy, mysterious corporate hacker ninjas who spend every waking hour trying to take down his ironclad website due to the obvious danger he poses to The Man.

Even the software's FAQ takes cheap shots at the objects of his vast paranoia. Stay far, far away from anyone with that big a chip on their shoulder.

Re:Spite?

[grouchyDude]

MS has a lot of good developers (whatever you may think or their products or policies). Maybe he figures it will hurt them (aesthetically) to look at something lame?

Re:Spite?

[rrohbeck]

Buffer overflows resulting in server pwnage?

Re:Spite?

[ColdWetDog]

Every entry in his blog is a rant against something, whether it's Microsoft, the world economy, the Western Hemisphere, or those stealthy, mysterious corporate hacker ninjas who spend every waking hour trying to take down his ironclad website due to the obvious danger he poses to The Man.

So he sounds just like a typical Slashdotter. What's not to like?

Re:Spite?

[__aasqbs9791]

It only runs on an MS OS right now, and I didn't see any mention (though I may have missed it) of what he used to code it (MS tool-wise) so I think you need to reread the article. Or even the summary.

Re:Spite?

[arethuza]

Ouch - the design on that site makes my eyes hurt. The content just makes my brain hurt.

Re:Spite?

[al3]

He seems to be taking out his anger for Microsoft on PHP

Re:Why?

[Anonymous Coward]

It ups the difficulty level, allowing you to more easily grind on your way towards Web Master III.

Help me out here

[TimHunter]

Why does the world need a non-free web server that only runs on Windows when there's already plenty of free (as in speech) ones out there (http://www.apache.org/, http://www.lighttpd.net/) that run everywhere?

Re:Help me out here

[AlexBirch]

Plus IIS is free as in beer (if you've paid for winders)

Re:Help me out here

[Antique Geekmeister]

Speed and security. The endless permutations and add-ons to Apache do, in fact, cause a significant security and compatibility and performance burden, much as the endless and often poorly written add-ons to Perl create similar issues. The idea can be taken to extremes, but how many of todays Perl and PHP website scripting security issues would evaporate if the authors were forced to write in a less flexible language that took a few moments to actually compile before being enabled?

Re:Help me out here

[loconet]

The idea can be taken to extremes, but how many of todays Perl and PHP website scripting security issues would evaporate if the authors were forced to write in a less flexible language that took a few moments to actually compile before being enabled?

.. and you actually think C is the answer to that?

Re:Help me out here

[kikito]

Your logic is flawed.

Language flexibility and application security are not correlated.

Re:Help me out here

[sirlatrom]

When you take the idea to extremes there, it sounds to me like advocating "security through deterring for seconds or minutes" -- which I would consider even worse than "security through obscurity".

Re:Help me out here

[Antique Geekmeister]

Please take a look at CPAN. Select half a dozen web related modules, and check them form case statements that fail to have a fallthrough for unexpected conditions, and check them for input text processing that does not sanitize the inputs, especially for database information. Then come back and explain how the excessive flexibility of Perl does not contribute to writing far too many approaches to solving similar approaches, and how its flexibility encourages the use of robust and well-understood approaches to processing data.

So yes, indeed, limiting the number of ways to write precisely the same functionality does enocurage consistent structures whose vulnerabilities become understood. There are trade-offs. Such loss of flexibility may make code less efficient. But who writes perl for efficiency of execution?

Re:Help me out here

[Ralish]

I'm pretty sure IIS is factored into the cost of the licences of the versions of Windows that contain it (whether you use it or not) ;)

Re:Help me out here

[Draek]

how many of todays Perl and PHP website scripting security issues would evaporate if the authors were forced to write in a less flexible language that took a few moments to actually compile before being enabled?

None. Contrary to popular belief, lower-level languages don't make shitty programmers competent.

Re:Help me out here

[plasticsquirrel]

There's still an entire world of people who think in terms of Windows-only and shareware. They're living in a 90's time warp, really. Never mind that C is inherently dangerous to use for scripting (not to mention primitive), or that there are smaller, freer web servers out there.... Some people feel compelled to reinvent the wheel, and then feel like heroes when they only pack in a few advertisements or dial home every once in awhile. People who don't know any better will still use it.

Re:Help me out here

[friedo]

Perl doesn't have a case statement, you syntactically insensitive clod.

Perl 5.10 does have given/when, though. Smartmatch FTW.

Re:Help me out here

[Improv]

C has lousy string support. It's really easy to screw them up, just like most memory allocation-related stuff in C is a big burden. Perl, Python, PHP, and even Fortran handle strings more sensibly, eliminating one of the most common sources of security problems in one go.

It may be true in theory that compiled languages that enforce discipline (ML, for example) would be better yet for security, particularly when used by people who have a good security model in mind, but Perl, PHP, and Python do well with such a model. In C, even if you have a good security model, every strcpy() or strncpy() is a potential vulnerability.

It's possible to wrap all the dangerous bits of C up into a programming framework, using functions that handle your mallocs for you, using objects to replace strings, etc. Very few people do that.

Re:Help me out here

[Improv]

Your points would be warranted if:
1) CPAN were Perl itself.
2) CPAN were atypical for a collection of useful modules for any programming language.
3) C were better.

Re:Help me out here

[Penguinisto]

Contrary to popular belief, lower-level languages don't make shitty programmers competent.

True, but at least the clued-in know that up-front. Too many of the upper-level ones tend to mislead the masses into thinking they're competent.

Re:Help me out here

[msimm]

No kidding. And if you really want to play around with cool web server technologies slightly off the beaten path there are plenty of more interesting options like Resin (open source java/php servlet).

Honestly I've got to question anyone who wants to run Windows server for any kind of performance-oriented or scalable solution, which would make this an ad?

Re:Help me out here

[Antique Geekmeister]

I would far, far rather have the truly awful Perl and PHP I've been seeing the last few years fail outright to compile, rather than being published over at CPAN and corrupting every downstream project that is automatically built with the latest release of the author's fantasies. Compilation failures, and compilation warnings are helpful to cleaning up code. And taking the directly legible source code away from the programming equivalent of script kiddies and forcing them to read genuine source code helps raise the threshold of them simply cutting and pasting tools instead of using the already existing, well-written ones.

It's a long-term problem: flushing times that Perl programmers attempt to rewrite the "transcribe text as numbers" printf statement would probably shrink the deployed Perl software of the world by 5%.

Re:Help me out here

[Rary]

But I think the point is that, since you need Windows to run G-WAN, then you've already paid for IIS, so why the need for a different closed-source (but free as in beer) web server?

Re:Help me out here

[slifox]

So? A higher level language makes the job easier for experienced programmers who understand how the interpreter works at the machine-level.

If you really do have a good understand of how it works, you can avoid most security and performance issues; you can dictate efficiency boosts like specific typing, precompiled regular expressions, etc; and you can still embed C and/or assembly when appropriate. You also gain all the advantages and lack of other common low-level security flaws, like buffer overflows. Basically, you're trusting the language designers to write a robust interpreter to avoid the common C security issues so you don't have to -- sounds a lot like using C/C++ instead of assembly, just replace 'interpreter' with 'compiler'.

Why should we resist new tools that help good programmers create good code more efficiently, just because bad programmers can also use them to create bad code more efficiently?

Re:Help me out here

[Antique Geekmeister]

But those lower level programmers are not getting the experience that turns them into good programmers. They're cutting and pasting bad code and propagating errors which are nightmarish to track down after the fact. And yes, I'm trusting the language designer to write a good _compiler_ to write small utilities, well written, rather than presenting every programmer with that stunning mass of debris I find coming out of places like CPAN.

We should not resist new tools for good programmers. We should resist toolboxes that include that many slightly different hammers, many of which are liable to break and many of which have handles likely to slip in the grip of a normal user, sending a large and spinning object flying towards anyone working near them. I'm afraid I've been that person near them and struck with those handles too many times in the last five years, and from observation, far too many of the scripting language authors need to go back and be _mentored_ in how to do efficient or even safe code, because they certainly didn't learn it dealing with Perl.

For examples of the insanity, I'll point you directly to mod_perl itself and resolving which versions of mod_perl itself are compatible with your project. Though that utility was written in C, it has to deal with a lot of Perl's vagaries, and it can be very awkward to coordinate multiple old and new Perl utilities with a single mod_perl release.

Re:Help me out here

[slifox]

But those lower level programmers are not getting the experience that turns them into good programmers.

I assume you mean 'those new programmers'... lower-level programmers would be working with ASM, or even C in this context, not perl.
I disagree anyways -- there have always been bad programmers, and there always will be. The lower level languages have even more potential areas for insecure programming, and that fact will not stop people from writing bad code, nor will it make them understand the underworkings of the computer. Just because a good programmer must know more about the computer architecture, doesn't stop bad programmers from not caring and writing code anyways. In fact, the steeper learning curve of lower-level languages may even provide more of an incentive to copy-and-paste, rather than spending more effort to learn the underworkings than it would to learn the essentials for proper coding in higher-level languages.

I'm trusting the language designer to write a good _compiler_ to write small utilities, well written, rather than presenting every programmer with that stunning mass of debris I find coming out of places like CPAN.

CPAN is not the perl interpreter. You object to perl as a language or higher-level languages as a concept, because there are people who write poor code, there are people who decide to use prewritten poor code, and there are websites that provide easy access to all this prewritten poor code? I hope you realize that this has nothing to do with perl, and that a parallel exists with every language at every level of abstraction from the machine level. There are certainly many, many pieces of assembly and C/C++ which are poorly written and yet are copied-and-pasted by others... if anything, it's harder to become a good lower-level programmer since there are more issues and technicalities to consider. Those that don't become good lower-level programmers will not necessarily stop programming, they'll just continue writing bad code.

We should resist toolboxes that include that many slightly different hammers, many of which are liable to break and many of which have handles likely to slip in the grip of a normal user, sending a large and spinning object flying towards anyone working near them.

So then we shouldn't use nail guns, because they don't require the carpenter to repetitively practice the skill of hammering in a nail like a hammer would? Yes, it's a lot easier to hurt yourself with a nail gun... but it also makes building many houses a much more feasible task, and allows the carpenter to concentrate on the fact that they're building a house, rather than the fact that each nail must be driven properly. Under the pressures of common job timetables and the monotony of hammering each nail, they may even accidentally screw up the overall design without realizing it -- accidentally not seeing the whole picture as they are too concentrated on the tedious and repetitive details. There are invariably construction workers who will use the nail gun improperly and hurt themselves or others -- so you get out of the way and refuse to work with them or hire them, rather than not permitting anyone to use the nail guns.

I'm afraid I've been that person near them and struck with those handles too many times in the last five years, and from observation, far too many of the scripting language authors need to go back and be _mentored_ in how to do efficient or even safe code, because they certainly didn't learn it dealing with Perl.

If they can't, won't, or haven't learned efficient/safe coding practices in perl, what makes you think they'll learn them in C, which requires far more details and studying?

It sounds to me like you shouldn't have been using amateurs' code, regardless of language, for essential or business purposes... you can hardly blame the language for that. If anything, you or whoever made the decision to use the poor cod

Re:Help me out here

[Jesus_666]

You have already heard of JSP, right? And CGI has been around for ages.

I can tell you from experience that writing in a compiled language does not force one to write cleaner code. It just forces one to click "Build" and deploy the new version before the changes go live. In fact, most sloppy coders would generate significantly less secure websites if they were forced to write in C. With PHP, being sloppy means that an attacker could download files they're not supposed to or inject SQL statements. With C, being sloppy means that an attacker could execute arbitrary code on the server.

No, thanks. I like my server not getting rooted.

Re:Help me out here

[Jesus_666]

You're arguing that nobody who doesn't already know how to program should be allowed to learn it. Inexperienced programmers always create shitty code, in any language. And they will resort to cut-and-paste code from random websites whenever convenient.

Forcing them to use C for web development won't change that; you'll see websites that leak memory like a sieve, open supposedly read-only files in read-write mode and then reuse that pointer (which the coder doesn't notice because he only ever tested with the same value being written to that file) or have all methods declared as void* for "flexibility", with results being casted as inappropriate.

C does not magically make shitty programmers good. Experience does. And C is not the only language on the market in which one can possibly gain that.

Re:Help me out here

[SharpFang]

Maybe some but C as a text generation and processing language (which is the basic function of CGI) is definitely a very bad choice. C strings are inherently fault-prone.

In Perl or PHP you do $y .= " $x \n"; and it is totally fault-proof. It is easy and straightforward, and totally foolproof. Now write something like that in C. Allocate buffers for x and y, check for overflows, reallocate if buffers are too short, make sure the number of arguments matches the format string, and within maybe 15 lines have the result ready, not nearly as readable, not a shade close to as fault-proof, and 1500% longer.

I'm not saying a compiled, secure language would be bad for CGI scripting. I'm just saying C is a horrible choice.

Re:Help me out here

[MrMr]

How does C protect you from missing case switches or unsanitized inputs?

Re:Help me out here

[Antique Geekmeister]

By the consistent example of previously written C. There are, in my observation, so many different ways to do the same things in Perl that developing consistent good practices is very difficult indeed.

Re:Help me out here

[Antique Geekmeister]

I object to Perl for many reasons. Historical pain and suffering is one of them. And "amateur's code" is what a lot of the Perl available modules are, and it is _dificult_ to wean programmers away from the tremendous variety of truly awful debris that festoons CPAN. I'm afraid that I do often refer to CPAN as being part of Perl itself, because it's so much of the Perl that people actually use. I would expect, over time, that the older and more poorly written modules would be discarded and refined, but I just don't see it.

And the tools I've had to deal with were not "amateur code", they were professionally provided tools written by commercially funded devlopers. It made me shudder a lot: I've simply not seen such extensively poor code littering other projects.

Re:Help me out here

[Al Dimond]

The first thing that came to mind when I thought of C, network-facing services, and security was buffer overruns. They aren't hard to avoid, but they aren't hard to write either. Encouraging programmers to write ad-hoc scripts to process input in C sounds like a remarkably bad idea to me.

Re:Help me out here

[Antique Geekmeister]

That's why you _don't_ encourage that. You use a few well defined examples, preferably from a library function with some history of reliability. I've had to clean up, repeatedly, after Perl programmers who keep re-inventing their own special shaped wheels.

Re:Help me out here

[SanityInAnarchy]

The idea can be taken to extremes, but how many of todays Perl and PHP website scripting security issues would evaporate if the authors were forced to write in a less flexible language that took a few moments to actually compile before being enabled?

Not nearly as many security issues as we'd gain from, I don't know, buffer overflows and other whole classes of vulnerabilities which simply don't exist in Perl, PHP, Python, Ruby, even Java code.

Re:Help me out here

[kikito]

You are mixing apples and pears.

I don't personally know CPAN, but I'll take your word that it is very well written.

Assuming that this was the case, then the only thing that you can conclude is that Perl has a very good library.

Implicit in your enunciation is also that CPAN is good because it "encourages consistent structures whose vulnerabilities become understood". Again, I'll take your word for it.

So if you meant "good libraries make good languages", I'd agree with you. But note that this would apply to any computer language.

I think the simplicity of the CPAN lib might have clouded your judgement. Have you considered that the reason why CPAN is so good might as well be that it was built on a *very* flexible language?

And by very bright people, which is actually more important: The problem isn't the language - it's people.

A bad programmer will find a way to write spaguetti code no matter how restricted his environment is. (The xml parsing library is restricting? I'll do the xml parsing with regular expressions instead!) A good programmer will also create spaguetti code, just a bit less often.

And don't forget that manager that wants that 2-months job finished at the end of the week.

Re:Help me out here

[Antique Geekmeister]

Dear me. You've gotten my intent exactly _backwards_: I suspect I was not clear.

CPAN has examples of excellent, well-written modules. They are overwhelmed by amazingly badly constructed, conflicting, mislabeled, misnumbered, misused, and mostly unnecessary dross that new Perl programmers incorporate eagerly and without QA into their new modules. The result is typical Perl reliability: it works fine until it breaks, then you add a few lines to fix the particular spot it broke and ship it back out with the same underlying flaws and no consistent architecture. CPAN, as a large software repository, is awful because many of the programmers never learned better, and they've descended to a common level of great ideas, but extremely poor integration and small, deadly failures that cause competent developers to waste incredible amounts of time.

I certainly agree that a bad programmer will find ways to create bad code. But programmers need good examples to learn good practices from, and the amount of dross over at CPAN is so great that it teaches truly unfortunate behaviors for even competent programmers exposed to it.

Re:Why?

[Tablizer]

I was hoping they were talking about the "box" itself, not software.

Re:Big Plus!

[Tablizer]

i C your point

-1 Bad Pun

Linux/Solaris release

[Fwipp]

Summary:

There is currently only a Windows release and no clear answer in their FAQs whether there would be Linux/Solaris releases.

The main page at gwan.com :

It also means that G-WAN will be (much) faster on Linux and Solaris.

Sounds like the person writing the summary didn't bother to read the pages that they linked.

Re:Linux/Solaris release

[markb]

When the answer to the question:

"Will Linux, BSD, Solaris, etc. be supported?"

is:

"G-WAN's small footprint and modularity make it easy to port on any platform. Starting with Windows (today's most widely used operating system) makes it possible for end-users to compare. There's no choice if you can't compare."

it's not clear.

Everything on this site screams CRAZY. Pretty funny.

Re:Linux/Solaris release

[beaviz]

Crazy?!

He's the village lunatic of the internet! Seriously, he's paranoid as hell and doesn't make much (if any) sense.

10. subnet?

[lalena]

From the PDF (about the bank piracy claim)

in its report made on May 26th, 2006 M. MARC MORTIER from BEFTI reckons that "the 10.249.17.10 network address belongs to the address range of FINAMA bank", and that his "laptop is using the 10.249.24.60 IP address".

If their claims are based on the assumption that 10.249.*.* is a Finama bank owned IP subnet, then they are in trouble.

Re:10. subnet?

[Spad]

From the open letter to the French president (Google Docs PDF), although the English takes some effort to comprehend:

GROUPAMA is not offended at seing the bailiff JEAN-CLAUDE DAIGREMONT and the judicial expert JEAN-MARIE HUOT in charge of the seizure of September 7th, 2005 at 22-28 Joubert street PARIS 9th, refusing to seize evidences pretexting that they did not exist (they reported that the 10.249.x.x network did not exist) -a fact that their own official report denies (a FINAMA bank router returned the 10.249.80.49 network address -FOUR TIMES).

They do appear to be referring to the internal network of FINAMA bank.

Re:10. subnet?

[Dumnezeu]

Also, the bank clearly said that it did not use 10.249.*.* while he said that at least one ping test replied with one such address. I stopped reading the rest of the PDF after I read that, because I began wondering what does that have to do with advertising the company that writes G-WAN on Slashdot? ... oh, nevermind, I got it now: our web server is free as in "beer" (yet not open-source) and btw, we've got a big trial going on and we're doing pretty good and the company is writing lots of software for lots of countries and we might soon make $200 if the judge buys our story. What do you think of G-WAN now?

Re:10. subnet?

[eln]

Even so, claiming they use 10.249.x.x is not proof of anything. The entire 10.x.x.x subnet is reserved for private network use, so any number of companies could be and probably are using that exact same subnet. All they need is a halfway-competent network administrator to tell the court about the concept of private IP space, and that bit of evidence is worthless.

Re:10. subnet?

[Antique Geekmeister]

That would be like saying "the fifth floor is in our building, not a public street address, so this warrant is useless". I bet that would be a useful bit of precedent to establish for lots of people who are served with search warrants. Given the router information mentioned in the article, and the settings of the laptop with an address in the address space, it's unsurprising that our plaintiff was upset that those machines did not get reported or searched properly.

Re:10. subnet?

[ArsenneLupin]

Worse than that. What they actually did was saying "our building has no fifth floor, we go directly from 4 to 6", but then referring, in a different document of the same affidavit, to some equipment being located at the 5th floor.

Re:Big Plus!

[bcrowell]

Absolutely. What makes me especially excited about trying G-WAN is that whenever it crashes I'll have the extra fun of figuring out whether the reason it crashed was because my own C code crashed, or because the code in his web server crashed. But wait, there's more! Adding to this really enjoyable programming problem will be the extra challenge that comes with the fact that his code is closed source, so if the crash occurs inside his code, I'll be able to get in there with a debugger and spend an afternoon figuring out what happened and whether there's any way to change the data my code gives to his code so that his code won't crash crash. I can see many really enjoyable weekends ahead of me in my parents' basement, with a bowl of nachos and a liter jug of root beer. Good times!

I dont exactly see the points

[siDDis]

People claim Apache is slow, but why not using a reverse proxy like Varnish to "speed it up" and still keep the features. I really see no reason why I should use G-WAN or lighttpd.

Re:I dont exactly see the points

[thetagger]

People claim Apache is slow, but why not using a reverse proxy like Varnish to "speed it up" and still keep the features. I really see no reason why I should use G-WAN or lighttpd.

Not everybody is serving easily-cacheable stuff. Reverse proxies are great for semi-static websites like news sites, but they are useless for social-networking, webmail and other interactive sites that need to render customized content for each particular user.

Anyway, nginx is my current favorite web server.

Re:I dont exactly see the points

[beaviz]

People claim Apache is slow, but why not using a reverse proxy like Varnish to "speed it up" and still keep the features. I really see no reason why I should use G-WAN or lighttpd.

Not everybody is serving easily-cacheable stuff. Reverse proxies are great for semi-static websites like news sites, but they are useless for social-networking, webmail and other interactive sites that need to render customized content for each particular user.

I'm a system administrator at a (smaller) social network site with highly dynamic content. Well, at least that's what it looks like. We have lots of things to cache. Images, css, javascript, Flash/Java applets...
Varnish has helped us tremendously. Now our webservers runs the actual platform, not serving the same CSS file as they did 0.0002s ago.

My point being, no matter how little impact you think Varnish will make, try it anyway. You might very well be surprised if you have any kind of serious traffic.

(And then have a look at memcached!)

Re:Big Plus!

[Anonymous Coward]

Some of the most reliable and, surprisingly, cleanest web apps that I've worked with were written in pure C, as Apache modules. But this insurance company did have the money to hire real programmers, not just scripters and web designers.

Using C helped force the developers to avoid the extreme overarchitecturing that basically every Java- or ASP.NET-based web app suffers from. The code was simple, right to the point, and left very little room for bugs to creep in.

The system was also very fast, requiring just a single web/application server to support several thousand simultaneous users. The only reason multiple web servers were used was for failover purposes.

When I first joined them, after a number of years of using Java and Perl, I thought they were fucking nuts. But after working with them for a few years, I saw first-hand that they took the correct approach. Their web apps contained significantly fewer bugs than I would've expected from a similar-sized and similar-complexity web app written in Perl or Java. They also produced code far faster than would be expected, because they didn't get bogged down in design patterns and excessive architecture and all the crap like that we see from too many Java developers. Their web apps were damn fast, even without them bothering to tune them.

There's a place for using PHP, Perl, Python, Java, Ruby and C# for web development. It's when you want to throw some shitty web sites together really quickly, without much concern about maintainability or user experience, using the shittiest and cheapest Indian outsourcing firm you can find. Otherwise, it's a better idea to use a few talented programmers and C.

Re:Why?

[mrsteveman1]

Yea but most of those linux distros are just identical code, and many of them persist only because of user behavior and usage patterns that people don't want to change. It's preference more than anything at this point. I like the way Debian does things, so i use that frequently. Others like the way Redhat does things, etc.

This web server is substantially different from all the others, apparently closed source and quite limited from the sound of the summary (which, like TFA, i barely read). This is more like shifting from Linux to another operating system than switching between distros.

Re:Big Plus!

[noidentity]

Hey, look on the bright side: at least you don't have to write your scripts in asm.

WTF?

[Jugalator]

Sorry, but I won't run a HTTP server where the author think running native code extensions with no security checks is good.

Okay, is it just me

[Josh04]

Or is the guy who wrote this completely and utterly nuts, in every way? I don't even need to cite this, just visit the labyrinth site and wait till your mind melts.

Re:Okay, is it just me

[timmarhy]

let me see.

Using C as a "scripting" language. CHECK

Using C as a "scripting" language on a WEB SERVER. CHECK

Writing a non free webserver for windows only with very limited features. CHECK

yep, he's passed the "i'm crazy as a loon" test.

Re:Okay, is it just me

[uglyduckling]

Writing a website full of incomprehensible ranting about Microsoft and the computer industry, whilst claiming that releasing a[nother] free web server for their platform will "hit them where it hurts". CHECK

Re:Okay, is it just me

[aaron alderman]

kdawson. CHECK

Re:Big Plus!

[mwvdlee]

Well, atleast for C you can get thousands of open source scripts and internet libraries to set up your website or help hack your own...... yup......

Re:Big Plus!

[Anonymous Coward]

Wooooooooooosh!

IIS

[KalvinB]

If you're going to be "scripting" in C on Windows you might as well go fully compiled with IIS (free with any Windows OS you'd be running on a server) and C# (Express version also free). Get MySQL with ODBC and you're all set.

I use PHP on Apache for flexibility. If I wanted to use C I'd compile it.

Re:IIS

[argent]

GWAN in user space is faster than IIS in the kernel on Windows. When they port to Linux it should toast IIS nicely.

The real question...

[amirulbahr]

So the guy wants to write a web server to scratch an itch or something. No big deal there. The question is WHY THE FUCK DID IT MAKE SLASHDOT?

Re:The real question...

[edivad]

So the guy wants to write a web server to scratch an itch or something. No big deal there. The question is WHY THE FUCK DID IT MAKE SLASHDOT?

Same question I had in mind ...

Re:The real question...

[MobileTatsu-NJG]

The question is WHY THE FUCK DID IT MAKE SLASHDOT?

Numerous people on this site have loudly proclaimed "Alternatives are great!!!" and have had their comments modded up for it.

Re:The real question...

[Anonymous Coward]

Alternatives are great!!!

Re:The real question...

[93 Escort Wagon]

So the guy wants to write a web server to scratch an itch or something. No big deal there. The question is WHY THE FUCK DID IT MAKE SLASHDOT?

C'mon. Whenever some new Linux distribution (or variant on an existing distro) is announced, it automatically becomes a Slashdot submission. Why should it be any different with new web servers?

Of course, whenever we have those HIGYALD (Hey, I've Got Yet Another Linux Distro) stories, there is always at least one post similar to yours, asking why it's news. And there's always at least one response to that post, explaining that alternatives are great - which is true here as well, so the circle is now complete.

Re:The real question...

[oldhack]

Of course, whenever we have those HIGYALD (Hey, I've Got Yet Another Linux Distro) stories, there is always at least one post similar to yours, asking why it's news. And there's always at least one response to that post, explaining that alternatives are great - which is true here as well, so the circle is now complete.

Everyone knows that. Why are you posting such a redundant comment?

Re:The real question...

[thoughtsatthemoment]

I guess not everyone noticed this guy's site contains a link to an internal MS document that seems to show how MS was practicing mind control. Perfect for slashdot.

Re:The real question...

[dkf]

The question is WHY THE FUCK DID IT MAKE SLASHDOT?

Let's see...

Posted by kdawson on ...

Looks like we've got an answer.

Re:The real question...

[ljwest]

I heartily concur... and I'd like to ask further: Why the.. did I have to scroll down this far to see the real question asked?

Re:The real question...

[Anonymous Coward]

mod parent up!

Re:The real question...

[jsled]

Yes, but the value in sites like /. is *EDITING*. They should filter shit like this so their s/n ratio is high, and thus their feed is valuable. This will bring subscribers and thus attention and thus ad impressions. At present, slashdot posts 90% crap found on other sites 4-9 days ago, and 7% crap like this and 3% interesting stuff, mostly hard-science stuff I'd find if I was still in school or in a non-CS/Real-Science job.

Re:Big Plus!

[caramelcarrot]

He even fucking linked to those two languages. This has to be a troll.

It can't even talk http properly

[RJabelman]

His server returns 404 for errors:

http://www.gwan.com/csp_crash.html

That's going to make wirting for this thing really confusing.

Re:It can't even talk http properly

[Phroggy]

Oh geez. He's returning Error 404 when a script crashes? That means he can't be bothered to find the list of HTTP status codes, because if he did he'd see that 404 is clearly the wrong choice. It also means he can't be bothered to look at other implementations, because then he'd have noticed that popular servers such as Apache and IIS return Error 500 when scripts are broken.

From this we can conclude that he probably hasn't read the HTTP protocol specification (because it'd be hard to read the spec but miss the list of status codes), and he has no idea how current servers work (so instead of copying their good ideas, he'll be reinventing his own broken wheels).

And from THAT we can conclude that his browser is a steaming pile of crap. The reason it's not open source is probably because he's afraid that somebody would read his code and make fun of him for it.

Heh, check out the actual 404 error message - it's malformed HTML 2.0! If you're going to go to the trouble of including a DOCTYPE declaration, you ought to at least validate the code.

Re:It can't even talk http properly

[slblink]

He's returning Error 404 when a script crashes?

But he manages to send 400 Errors to valid HTTP/1.0 requests:

GET / HTTP/1.0 HTTP/1.1 400 Bad Request Date: Mon, 30 Nov 2009 10:51:49 GMT Server: G-WAN/1.0.4 Content-type: text/html Content-Length: 274 Connection: close

Re:It can't even talk http properly

[makomk]

That's... not necessarily a valid request, if you're talking to a HTTP server with multiple virtual hosts on the same IP address. You really need to send a Host header these days, even for HTTP 1.0 requests.

Re:It can't even talk http properly

[St.Creed]

Only when the webadmin is clueless. Otherwise he'd have configured a default website with a default page, informing you about the reason you arrived at that webpage, and what you need to do to change that.

Re:It can't even talk http properly

[Phroggy]

I'm not saying he's not intelligent, and I'm not saying his product is terrible. I'm merely saying he appears to have plunged into writing a web server without fully understanding the specifications that dictate how a web server is supposed to operate. I don't care how good his code is, if he didn't look at the specs first, or at least take the time to understand how other implementations work, the end result is pretty much guaranteed to suck.

Ah g-wan...

[martinmarv]

... g-wan, g-wan, g-wan

G-wan, g-wan, g-wan, g-wan, g-wan

Mrs Doyle approves

Re:Ah g-wan...

[ColdWetDog]

"O G-wan Konobe you're my only ..... "

Nope. Not gonna go there.

Yes, but...

[EzInKy]

...the thing about C is that libraries written in it are among the easiest for higher level languages to interface with. It's almost ironic in a way that C gives more freedom to those who refuse to it.

Re:Yes, but...

[maxume]

That isn't terribly true, Jython can use reflection to access any Java class, no messing about with shims or an FFI, and I think the situation on the .net CLR is about the same.

Re:Yes, but...

[EzInKy]

That isn't terribly true, Jython can use reflection to access any Java class, no messing about with shims or an FFI, and I think the situation on the .net CLR is about the same.

That's not very helpful to those wishing to write code in lisp. C libraries can be linked to by just about any other language.

Re:Yes, but...

[maxume]

But that is because there are enough C libraries out there to justify doing the work to make a C interface for Lisp, so I guess I would have been better off saying something about that being a feature of popularity, not anything intrinsic to C (except maybe that it is mature and reasonably compact, which helps keep things simple).

Why post this?

[oldhack]

Really, what's the point of posting a story of another unremarkable and very limited webserver? It's cool by me if kdawson simply found it on the top of the stack so he clicked bugger. I mean, it's not like I'm paying to browsing here. That what's going on here? Like I said, you know, it's all good by me. But I'm curious, you know, and ... well, you know what I am saying, right?

Re:Why post this?

[PetoskeyGuy]

These troll articles usually get more comments than the average ones. Everyone gets to feel smart and superior to both the poster and the editor. You should say thank you. :-)

Re:Why post this?

[oldhack]

Hey, it worked. Thanks slashdot!

Re:Big Plus!

[Anonymous Coward]

i C what you did there.

Re:Big Plus!

[BlitzTech]

Yes, your anecdotal evidence clearly suggests that scripting languages have a place as sub-standard languages to design a web-enabled application. Never mind all the professional Drupal developers. Or people that use Joomla. Yeah, platforms like those two are total wastes and it would have been infinitely wiser to write it as an Apache module.

I'm baffled that you point to using C as the root reason that your developers' code had less bugs. Speed I'll concede, but not bugs. Give your guys some credit. I'll bet them using C isn't why they write good code.

Sheesh, Give up on C and use Java 5 EE already.

[MikeElectric]

First: Java Front to BACK: Jsp/JavaServerFaces, Enterprise JavaBeans, Java Objects in the Database instead of Stored Procedures.
- The Java to Database: Persistence API supported on Oracle, MySql and Postgres.
- OpenSolaris( fastest OS out there ) or Mac OS X Server.
- Glassfish( most advanced Web Server )
- Free, take your pick Email servers
- Take your pick Oracle Database or free MySql or Postgres.
- Fast, EASY to Code, Java Front to Back.
- Most Secure web server.
- Most advanced web server, No Memory Leaks for example.
- Java: Code Like C, but let GlassFish Save your butt.

Re:Sheesh, Give up on C and use Java 5 EE already.

[argent]

- 2-5 times CPU time compared to C, even with JIT compilation.

Re:Big Plus!

[Penguinisto]

...could be worse - it could've used only the .NET framework

Oh, wait...

Re:Big Plus!

[Penguinisto]

True, but damn - an ASM-only web server would be hella fast! (and hella boring).

Re:Why?

[vivian]

This web server apparently has much better performance and scalability - so it can do the same job while using much less power. The article does explain all that pretty well if you care to read it.

Are you fucking kidding me?

[Weaselmancer]

I asked him to explain why stable versions (some of these stable releases were several years old, too) of the software he was recommending contained over 100 bug fixes. He couldn't provide a suitable answer, and thus management gave him the boot. And so we're not using Drupal.

You are out of your mind. Bug fixes to a stable release is your metric of quality?

May I ask what OS you guys are using in your bug-free paradise? You know, the OS that doesn't need any bug fixes after release. That one. I'd like to go buy myself a copy because that sure sounds great.

Re:Are you fucking kidding me?

[thetagger]

I asked him to explain why stable versions (some of these stable releases were several years old, too) of the software he was recommending contained over 100 bug fixes. He couldn't provide a suitable answer, and thus management gave him the boot. And so we're not using Drupal.

If the elevated number of bug fixes is a concern to you, I can provide you with my own customized version of Drupal without any bugfixes in it for a reasonable fee. That is the beauty of open source.

Re:Big Plus!

[Anonymous Coward]

A lot of web apps are primarily string processing and db interfacing; a scripting language is a more natural fit in that scenario.

Scripting languages tend to be written in C. I've written my share of HTTP app servers as native code and some in scripting languages (one in C/lua a few years back -- fast). Frankly, the typical web stack is a rickety, cobbled together piece of shit! Web server, rewrite engine, scripting host, language framework, database abstraction library over an underlying database lib... It's often cleaner and leaner to write the entire app as a daemon which handles a subset of HTTP and then to reverse proxy.

I've been playing with Google's go language recently; even given it's current state, I'll not hesitate to state my preference for go over any scripting language for a web app.

Actually, no

[symbolset]

I did write a MASM interpreter once. Perhaps I was doing it wrong, but it was _not_ fast. What it was: an abomination with all the convenience of assembler combined with the speed of interpreted BASIC. It was an interesting intellectual exercise, and that's all.

If you want a superfast scripting web language, try APL. You could probably fit all the APL code ever written in your CPU cache.

Re:Actually, no

[KibibyteBrain]

I think an ASM interpreter would actually be possible, but you would have to write a decent interpreter, namely with features like JIT(assembling!) for it to have performance on par with actually ASM programs. For example, NET is "interpreted" at a bytecode level with MSIL which is basically an intermediate assembly-like language. Also, at the end of the day, hand generated assembler only CAN be faster than C, there are no guarantees especially if your brain has a worse compiler than the one in your toolchain. I find this likely in the case of scripts that mostly do things like parse text and do many comparisons(ie, use up lots of simultaneous, related memory), as this is where your C compiler/interpreter will usually start to have a strong advantage over the human brain. Lastly, assembler doesn't really do you any good in these sorts of scenarios since you mostly are calling your framework code, and so doing a call foo vs. foo(); isn't really going to emit more efficient code.

Re:Big Plus!

[Kagetsuki]

C scripts are not C, it's just a scripting language that looks like C. You can't actually import normal C libraries and if I recall (I've only used C scripts once) you can't do much in terms of memory operations. On top of that they are scripts, so if they screw up the parser will tell you where thing crashed. Please don't be so critical of something you don't understand, scripts with C like context are nothing new and there are a variety of advantages to using the same syntax between your actual code and your scripting language.

Also, the scripting languages you mentioned are either not easily embeddable or somewhat focused for certain purposes. You should realize simple scripting and embedded scripting can be very different things. Particularly scripting languages like Lua can prove to be quite incredible, offering extremely advanced features (like tables) while still remaining surprisingly quick. Depending on what you are doing Lua can actually allow less capable programmers to write surprisingly complex code to enhance your program - we used it about a half year ago and with our scripts you could get moving objects on the screen in 3 lines, interactivity in 7, and easily an entire interface in less than 100. There are also a variety of scripting languages for actual embedded (as in hardware) applications which focus on being fast and light, but are often equally light on advanced features. I'd like to see you get python running capably on an 8-bit MicroController, or php doing something useful on one....

Hmm...

[cigawoot]

Why not just use Apache? C isn't designed to be used for server-side scripting...

Re:Big Plus!

[Hooya]

> software he was recommending contained over 100 bug fixes

So, did you guys replace windows, exchange, office with other products? Wait a minute...

Oops, my bad. You were talking about Joomla and Drupal. Somehow I did a mental s/Joomla/windows/g;s/Drupal/Office/g' in my head - subconsciously, I might add. And the whole time I was like - "Those bastards! The SP[123] and the freggin updates.windows.com" and not letting me shut down my computer without applying patches every other day (or so it seems)... But you're right. I googled a bit for a list of all the bugs for Windows and Office and couldn't find it. Occams Razor: there are none! That's professional! The Drupal/Joomla punks have the bugs listed on their OWN website!! How amateur!!

Re:Big Plus!

[onefriedrice]

Absolutely. What makes me especially excited about trying G-WAN is that whenever it crashes I'll have the extra fun of figuring out whether the reason it crashed was because my own C code crashed, or because the code in his web server crashed.

Finding where a program crashed is way easier than finding a logic error, and those can occur in any language. Actually, debugging crashes can lead to discovery of certain kinds of logic and/or runtime errors that would be difficult to find if your runtime environment is protecting you from ever seeing a crash (heaven forbid).

I'm as much a fan of high-level languages, nice runtime environments, and useful abstractions as anyone, but I also happen to think that C gets more flak than it deserves. I really think universities are doing their graduates a disservice by educating them in the safe, comfortable confines of Java if they don't also teach them C. In my own subjective experience, the most capable and successful programmers I know (in any environment) are also the ones who are very comfortable in environments without garbage collection and restricted memory access.

On the plus side ...

[devloop]

Finally a platform with built-in buffer overflow support!

Let the exploits games begin!

Re:On the plus side ...

[CarpetShark]

Finally a platform with built-in buffer overflow support!

You should check out this new thing called Windows ;)

Re:Big Plus!

[rrohbeck]

You can't read hex core dumps? Sissy.

P.S. At first I thought "G-Wan? Must be Obi-Wan's brother."
Too bad that "Use the source, Luke" doesn't apply.

Re:Big Plus!

[lena_10326]

I've deployed hand written C web servers, not as an Apache plugin, but as a standalone server so I've seen what kind of performance you can get by cutting out all the bloat you don't need. For example, you can get a huge CPU boost by not fully parsing the headers and picking out only what you need. The server was difficult to debug at times (valgrind helped) but in the end it worked out pretty well because the needs at the time required a centralized solution. We were able to run a fairly high volume website on a single multi-core box. That's unheard of in enterprise level dev shops.

It worked because the architecture was centralized and the software deployments were super simple. When the requirements need an decentralized architecture that scales with IO or scales to astronomical numbers, it becomes impossible to make that work. It's been my experience that IO is generally the problem, not CPU. There are physical limitations with scaling IO on a single node so you're forced to go with a fleet of nodes. Maintaining C/C++ business code on a fleet is a LOT more difficult than doing the same with platform independent languages.

Part of the problem is that a C/C++ server is interacting directly with the OS and its libraries so dealing with the slight differences that always come up gets to be a huge time drain. It's a lot easier to develop, test, and deploy with a scripting language. Regardless of the underlying kernel and libraries, you can be reasonably assured your script will "just work" when the kernel and libraries vary. Also, C really is harder to get right the first time. Having built in memory management is a huge time saver because "sloppy but correct" code won't cause downtime. Be sloppy in C, and the website goes down hard.

Re:Big Plus!

[rrohbeck]

That is assuming that you have symbols so you get at least a meaningful stack dump.
Without it you're SOL.

Re:Big Plus!

[physburn]

In case anyone missing the above authors obvious sarcasm. I'd like to add, that C is the natural language for creating buffer overrun errors. Lets Sigfault the webserver just by putting too long a string into your web form. Overruns or not, strings.h is not want I want to be using when trying parse text from a web form.

---

Web Servers Feed @ Feed Distiller

Re:Big Plus!

[mysidia]

I like environments without garbage collection, it gives more control, and doesn't degrade system performance while everything has to slow down continuously for GC.

But as for working in an environment without protected memory... that's just crazy talk.

Homework Project

[Fnord666]

It looks to me like someone took their homework project from Freshman year and decided to toss it out on the internet to see if anyone bites.

Re:Homework Project

[BugHappy]

If you demonstrate that you can beat IIS 7.0 on Windows and Rock on Linux (like G-WAN does) then the World would surely like hearing about your homework projects.

Reasoning for not being open source is astounding

[mysidia]

FAQ Entry:

Why isn't it Open-Source?
TrustLeap's technology could be mis-used, diluting or even compromizing it: open-source is now an on-ramp to very profitable closed data services. And if you are not rich enough to prevent others from stealing from you in the first place, then the 'rule of law' just helps the guilty to ruin you.

And after reading items on this timeline. I begin to question the author's sanity...

Re:Big Plus!

[mysidia]

It never crashes or has a bug.

If it seems to have a bug, then it must be that big companies Poisoned DNS servers!

Re:Big Plus!

[AHuxley]

Sell to a government, your premature optimisation becomes effortlessly scalable.
10000 req/s is the big number feel good bait.
Takes 10x longer to develop malware for :)
Script kiddies cannot do C, only black hats, white hats and grey beards can that. C adds a touch of class and college lab sophistication.
"has no users" spin that as security thru obscurity with a hint of patriotic nationalism.
As for source code trust, people loved Enigma, Crypto AG, Apple and MS.

Re:Big Plus!

[Lord Byron II]

I'll one-up you and say we need a good Fortran education for our youth. Same reasons, but its even easier to produce dangerous code.

Re:Big Plus!

[jfim]

Finding where a program crashed is way easier than finding a logic error, and those can occur in any language. Actually, debugging crashes can lead to discovery of certain kinds of logic and/or runtime errors that would be difficult to find if your runtime environment is protecting you from ever seeing a crash (heaven forbid).

Except when your non-protected runtime doesn't crash and instead overwrites the stack, corrupts the malloc arena or writes to a dangling pointer causing corruption in a completely unrelated part of the program. Hours and hours of fun!

One of the most important thing that managed programming languages brought is the fact that other parts of the program can't corrupt the system enough to make things undebuggable and that an error in a module is self-contained enough that it can't trample other parts of the program due to a memory error.

I do agree though that C and other unmanaged languages should still be taught.

Re: social networking

[bobv-pillars-net]

I'm also a sysadmin at a social networking site with highly dynamic content. Unfortunately, Varnish won't help much because over 90% of the cumulative CPU time is ate up by the MySQL server.

The 1990s called

[simoncpu was here]

...and want their CGI back.

This seems like an ideal tool...

[jafiwam]

This seems like an ideal tool if you want to have a drop-in solution for a zombie network to host illegal or pirated shit all over the internet.

Runs on cruddy already infected hardware! Perfect for Grandma Gertrude and Grandpa Horace to have hidden in their computers.

Feature set of this thing seems like a newer version of that pile of crap ORielly WebSite Pro.

Stay away... this dude doesn't want to kill IIS, he wants to kill every windows install anywhere on the planet.

Re:This seems like an ideal tool...

[BugHappy]

Prove it. Show that you are not only a tongue.

Crack G-WAN. Make it fail.

Then you will have ground for your (stupid) claim.

Is it April 1st?

[Korbeau]

I mean ... it must absolutely be a prank! The project's website looks like a bad infomercial - the guy's application is like a student project (write a simple web-compliant server that runs CGI scripts) gone totally wild.

If you need time-critical efficiency in your web app, I suggest you make your front-end in a high-level framework to do the pretty printing and then delegate the CPU-intensive requests to some back-end server written in highly-optimized C.

The truth is web-servers are usually mostly CPU-idling, the real clog is in the I/O. There's no "vertical scaling" goal to reach here by making the code more efficient. You need to buy monster hardware.

Re:Is it April 1st?

[BugHappy]

Korbeau must be selling hardware.

So, G-WAN feels like a "student project"... but how should Rock (the official champion), or Apache (the veteran) feel since they are immensely slower than the "bad infolercial"?

I like the "experts" that claim they can do it whenever they want.

Go, do it. Show the world that Rock is a wimp and that you can do better.

Then you will have the right to talk about it.

Few people can do string processing in C

[Casandro]

Only very few people can do string processing in C. Actually I believe more people can do string processing in assembler than in C, as with assembler you see where the problems are whereas C makes you believe it has some kind of string support.

I sent a message via his error log

[mattr]

I can't tell if sane or not but it certainly sounds like he is putting much effort into some software.
So it would help to defuse the impression of insanity that most of the posters here are suggesting. He doesn't sound insane at least not for a French programmer who has left the country due to corruption apparently.

Personally I would suggest an online explanation in more detail of two points:
1) Would he offer source to a company/institution that will sign an NDA? I bet he would sell it to say Facebook if they wanted to compile their own.
It isn't a crime to do closed source software although to my mind not offering the source in any way is going to slow adoption.
2) I took the time to read the blog and pdfs. His legal problems seems to have started when he caught a bank using his software. See: groupama.pdf

This refers to software he makes (in Switzerland now), Remote Anything

Okay. First, the pdf shows they have installed packs of 65535 units of his software. This makes no sense at all and looks like a dumb programming bug. He doesn't show the evidence he has, or how he got the reports. I imagine he has a phone home routine in his program. This is maybe why it gets called a virus too I could imagine, if that is the app he is talking about. The $200M fine he is seeking is therefore either crazy, a lie, or else based on such strong evidence I can't imagine not mentioning it. I think he needs to explain what the evidence is, how he got it, and why the numbers suggest some binary math errors. He has four lines that look like "64 DS + 256 Masters + 65536 Slaves = 34 million euros" and this is totally crazy. He seems to be suggesting they are using 250,000 clients if I am correct. His own site says Fortune 500 companies often buy tens of thousands of licenses. He should explain the discrepancy.

I think if he does these two things then he could expand his market more. If he doesn't want to go open source fine but comparing it to open source projects then should include this caveat. Maybe he could get a university or famous security company to audit the code.

Re:I sent a message via his error log

[mattr]

Well, Anonymous Coward "Pierre", that was quite insulting and exactly what I'm talking about.

While it is entirely possible that you have a large conspiracy against you, it is also possible that you have a medium-sized conspiracy and that is inflated by sick individuals who just like to kick someone who sounds paranoid, and then of course being paranoid and imagining enemies who don't exist like me.

This is bad for business since all the other posters here were just calling you insane for pushing C based scripts in a closed source web server when there are open source alternatives, but now it also is clear that you see enemies everywhere even people who might be friendly. You need to chill out, you sound utterly rabid.

You may have made some good software (I have no idea though it sounds popular to be sure) but your total thermonuclear war jihad on people is self-defeating and boring.

In case you must know, my name is Matt Rosin and you can email me if you like. mattr atnospam telebody dotdotdot net. My consulting company Lawrence is too small for you to have heard about it frankly. I will answer your email, if it is not insulting.

Yes actually I spent my unpaid time (though since I am owner of my own company I guess that is debatable) to read it. I also speak some French so I skimmed the French ones. I might have missed some important detail, sorry if so. I certainly did my best. I am spending more unpaid time now (don't worry it's well after midnight).

I understand what you say. I have not seen info about the license agreement, sorry. Also I did not see anything about the key generator, maybe I missed something about that buried in one of these docs. My time is not exactly free.

That said, maybe you really should hire a PR company to help you! Really this is likely a good idea.

I am really honestly saying this because if you freak out you could indeed get in trouble with the heavy handed authorities, especially now that you have contacted Sarkozy himself. You don't understand the characteristics of people in power and have a complex that makes you believe you are invincible. Well, maybe you are safer now living in Switzerland but still I would get a lawyer and a PR firm. Don't slug it out on your own, hire someone who sounds calm and uninterested to do it for you.

And yes, I know what an unsigned int is thank you very much. My point is simply that even if the company illegally installed the software, the calculation for a fine would be based I imagine (IANAL though) on the actual number of licenses used, multiplied by some punitive factor, and then perhaps add something extra for their circumvention of protection and hiding of evidence.

In other words, there is no understandable reason to create 250,000 licenses even if they are free, and I don't even know if it is physically possible to do so.

If you are as paranoid as I think, you will imagine I am arguing for a reduced sentence! ;) That is not the case though.

I'm not arguing for the criminal, but even though it sounds neat to bill for that many licenses, and may even be allowed to by your license agreement which I haven't read, it does not make sense to bill for more licenses than there are employees. Also you made it sound like heavy customers are only buying in the tens of thousands of licenses. It would make more sense to bill for the number of employees and multiply it by a number like 3 for punishment, and then add on some damages for their circumvention / theft. That is what a judge would be thinking, if he wasn't fed up and thinking it's bullshit with no evidence.

You might need to hire a detective too you know, to find out why they said there are no such machines.

So in the pdf I saw with a table that included the number 65535 a lot and no explanation I saw (I might have missed it though I read it 3 times), that number looked fishy. Yes I would believe it came from a keygen, which was installed by someone illegally, but how much disk space would it take

Re:I sent a message via his error log

[mattr]

P.S. I forgot to mention that maybe you can sue the bank in Switzerland too if they have an office there. But you probably know that.

Good Luck

--Matt

Re:Big Plus!

[Panaflex]

People that never learn C or delve into actual hardware & kernel architecture have real troubles with issues such as concurrency, atomicity and threading. High performance code is difficult to master in Java, as you much understand what's happening in the implementation.

  You seem to forget that the Java core is written in C/C++? I've worked at top tier industry web sites - java is not immune to stupid code practices. It crashes a bit nicer, but downtime is still measured in lost dollars.

Re:Big Plus!

[Anonymous Coward]

In front of management, I asked him to explain why stable versions (some of these stable releases were several years old, too) of the software he was recommending contained over 100 bug fixes. He couldn't provide a suitable answer, and thus management gave him the boot. And so we're not using Drupal.

http://php.net/ChangeLog-5.php

Most recent version has approx 110 bug fixes, which was on 19-November-2009, the previous version (minor version) had a pretty big pile and that was just a couple months prior, and the same story going back.

The Drupal changelog shows... 3 bugs fixed...

So.... either your story is pure bullshit, or you are a first class moron. Or both more than likely.

Re:Big Plus!

[Toonol]

In response, I opened up a web browser, and found the changelogs for the most recent releases of the stable versions of PHP and Drupal. In front of management, I asked him to explain why stable versions (some of these stable releases were several years old, too) of the software he was recommending contained over 100 bug fixes.

That's crazy. I think that consultant dodged a bullet by avoiding having to work with you guys.

Re:Big Plus!

[CaptnMArk]

It's not too bad if it's a per-request fork()ing server. But under Windows... :(

Re:Big Plus!

[OrangeTide]

I'd rather bug hunt crashes and core dumps than dig through bugs related to misuse of massive dynamic type systems.

On the otherhand I would not want one silly double free() bug to take out my entire site.

I demand something that is:

1. Fast
2. Robust
3. Easy to diagnose/debug
4. Secure
5. Free

When I find it, I'll be sure to share it with all of you. Well, there is Yaws, but it's written in Erlang (not sure how to exclude Yaws given my list).

Re:Big Plus!

[Jesus_666]

A big upside, though, is C's first-class string handling, especially where Unicode is concerned. Scripting languages just aren't in the same league.

Re:Big Plus!

[tyrione]

In front of management, I asked him to explain why stable versions (some of these stable releases were several years old, too) of the software he was recommending contained over 100 bug fixes. He couldn't provide a suitable answer, and thus management gave him the boot. And so we're not using Drupal.

http://php.net/ChangeLog-5.php

Most recent version has approx 110 bug fixes, which was on 19-November-2009, the previous version (minor version) had a pretty big pile and that was just a couple months prior, and the same story going back.

The Drupal changelog shows... 3 bugs fixed...

So.... either your story is pure bullshit, or you are a first class moron. Or both more than likely.

http://drupal.org/node/579476 [Drupal 6.14 changelog lists 51 bug fixes plus multiple security fixes to 6.x core]

http://drupal.org/node/579484 [Drupal 5.20 changelog lists 6 bug fixes plus multiple security fixes to the 5.x core]

Who in the hell wouldn't use 6.14 over 5.20?

Re:Big Plus!

[Richard W.M. Jones]

Yes, writing scripts in C is a great idea.

It's certainly not a new idea ...

Minimal webserver, written in C, supporting C scripts ...

Re:Other good C web frameworks?

[bobintetley]

I wrote one. It's a simple inetd-based process forking webserver in C (see inetdxtra). It uses about 80kb per process, is scalable (and obviously memory protected using separate processes for both responses and CGI) and was designed for embedded hardware. It supports CGI, so you can write pages in C, Perl, PHP, Java, or anything that can use stdio and read environment variables.

Lots of people must have written webservers like this, I have no idea why slashdot consider this newsworthy.

Re:Big Plus!

[Rhaban]

I think you should be nominated for an award in stupidity.

Re: social networking

[beaviz]

I'm also a sysadmin at a social networking site with highly dynamic content. Unfortunately, Varnish won't help much because over 90% of the cumulative CPU time is ate up by the MySQL server.

What's your read/write ratio? memcached has helped us a lot with MySQL load for read extensive databases. IODrives has done the same for write extensive workloads. Don't be scared by the price tag, one server with an ioDrive can easily replace 5 servers without ioDrives.

Looking for source code?

[redblue]

A while back I had written a minimal HTTP server to figure out I/O completion ports in Windows over a weekend. You can download it from (BSD license): http://arunsagar.com/Code/rani.cpp
Similar throughput specs as the OP's server, and the C++ code can be part of the server itself (great for debugging). Buggy and incomplete, but you can play, fix and extend as you wish.

Re:Looking for source code?

[BugHappy]

Your rani.cpp sample does no HTTP header parsing, no keep-alives, no scripts, no denial of service defense against timeout attacks, etc. And on the top of this rani.cpp is actually slower than G-WAN. That's quite a challenge apparently to match G-WAN even with I-do-nothing squeleton code.

Re:Looking for source code?

[redblue]

I would be loath to put a potentially malware infested software like G-WAN on my machines, so am unable to make a direct comparison. I also don't have a machine that matches the spec published for it. Nevertheless, the G-WAN curves are similar to rani's curves for TPS. Perhaps you could share the performance numbers that you have observed?
As for the rest, it was a weekend effort. What more do you expect?

Re:Free beer?

[redalien]

Free Beer as in Alcohol Free Beer, i.e. pointless.

Re:Big Plus!

[arief.utama]

I can't complain with that. Uhh... the thrill. Excites me just to think about it. Programming has been so boring with scripting language nowadays. Everything is sooooooo waaaayyyyyyyyyyyyyyyyy tooo easy. They got functions for everything, memory is well managed (actually garbage-managed), no core dumps, no crashes. No pointer bugs. What's the fun with _that_ !

Re:Big Plus!

[mustafap]

The entire Internet backbone is powered by C. Do you think router software is written in perl? Operating systems? BIOSes? Harddisk firmware? Data encrypters? GPS firmware? Mobile phone firmware?

Real engineers program mostly in C.

The higher level stuff is just there to enable non programmers to write banal blogging applications that enable people to publish details of their uninteresting lives.

When the world fully wakes up to the amount of energy we waste executing inefficient algorithms in inefficient programming languages, we'll see who's smug then.

Re:Big Plus!

[jabberw0k]

number-sign octothorpe ...

Re:Big Plus!

[sammy baby]

P.S. At first I thought "G-Wan? Must be Obi-Wan's brother."
Too bad that "Use the source, Luke" doesn't apply.

G-Wan has more of an East Coast flow than his brother.

Re:Big Plus!

[Fred_A]

I really think universities are doing their graduates a disservice by educating them in the safe, comfortable confines of Java if they don't also teach them C.

Bah, Java is passé. We do everything in Logo nowadays.

PUT :page ON TURTLE
SEND TURTLE ON NETWORK

Go turtle ! You can do it !

Re:Big Plus!

[tomhudson]

Bah, Java is passé. We do everything in Logo nowadays.

PUT :page ON TURTLE
SEND TURTLE ON NETWORK

Go turtle ! You can do it !

Different tools for different jobs. For example, the USPS mandates the use of the System Networked Architecture Instructional Language for USPS mail servers.

"Neither snow nor rain nor heat nor gloom of night shall stay these servers from the swift completion of their appointed tasklists".

Re:Big Plus!

[Nadaka]

On the other hand, at least the "real engineers" don't have to waste their time writing the "banal blogging applications" that everyone and their grandma wants. Just imagine how much that would cost.

Re:Other good C web frameworks?

[BugHappy]

Maybe they liked G-WAN because it is faster than all other servers both on Windows and Linux. Or, maybe they liked ANSI-C scripts (offering C programmers the opportunity to avoid PHP).

Re:Big Plus!

[lena_10326]

So you won that argument by appealing to the ignorance of your managers. Great job.

You said the PHP, Drupal, and Joomla codebases are poor. How do you know? What are you basing that on? I have to presume you've never looked at or used those packages because you failed to provide any detailed insight as to why they are poor from a technical standpoint. All that you mentioned was change logs, so that must be what you're basing your opinion on.

An active change log means the project is being maintained, which is a good thing because the last thing you want to support is a production website based on a framework with little or no updates. The length of the change log has no indication on the severity of the bugs. Sometimes you will see very large bug counts after housekeeping sprints, but low bug counts after fixing the critical security bugs. Sometimes an entry will roll-up several bugs, sometimes there are no bugs but consist of general software improvements. You can't use change log size as a heuristic relating to code quality. You generate that metric by scoring and tallying the individual bugs (discounting the general enhancements) and factoring in the size of the codebase. That requires stringent analysis and I guarantee you've not done that.

It seems your responders have been ripping you a new one and I have to say that I agree with them. You're arrogant and critical, yet you apparently misunderstood how normal software development works. There is nothing wrong with being critical, but when you criticize something or someone you're expected to support your argument and provide an alternative (particularly if the targets are high profile), but you didn't--during your meeting or in your post here.

I suspect your motivation was more about posturing and scoring points with your managers by shutting someone down at a meeting. I've worked with those exhibiting that personality type before, and I'll say they are quite unpleasant to work with. They tend to slow things down by throwing out road blocks without providing support. It's just too bad the contractor didn't have the debating skills to counter your unsupported points because it was very easy to do so.

Re:Big Plus!

[St.Creed]

... or you can just have loads of fun with the macro preprocessor in C. A friend of mine once used this with abandon. And then abandoned his no longer debug-able project :)

Re:Big Plus!

[lawpoop]

C scripts are not C, it's just a scripting language that looks like C.

You mean PHP?