Kristaps Dzonsons

This is really hilarious... I just followed the third given example (https://kristaps.bsd.lv/absdcon2017/database-conclusions.html) and that's how it goes: "the simplicity of SQLite is a lie". Ok, thanks, I'll pass on the "BCHS" stack then. I now consider this website satire.

This looks great! I too have been working on a critter tracker[0], but writing it in C using kcgi[1] (no JS at all). I have never done a web project before, so this has been a great learning experience. I still have some functionality to complete, but so far it has been pretty useful, even just the "available now" feature. [0] https://xvetrd.tilde.institute/index.cgi [1] https://kristaps.bsd.lv/kcgi/

Acme clients are a space where there are a lot of bad choices. My favorite acme client is this: https://kristaps.bsd.lv/acme-client/ It is: - Small - Written in C - Can be statically linked against LibreSSL and curl No nonsense, does what it says on the tin, works on many operating systems.

There seem to be slightly fewer Lets Encrypt and ACME implementations than stars in the sky. Which is fantastic. Last week I read about a privsep/chroot/pledge'd (OpenBSD thing) C implementation https://kristaps.bsd.lv/acme-client/ .

I do this too, but I use cmake to switch the backend between pandoc and lowdown [0]. Lowdown is not a drop-in replacement for pandoc flavored markdown, but it's between 10-100X faster. It's very handy to switch when tinkering with template changes because I can convert ~ 1000 markdown files instantaneously on my mid 2010s desktop. [0]: https://kristaps.bsd.lv/lowdown/

Pushing the burden of network permissions management outside the browser, to the OS? Heresy! To be serious, this has introduced me to sandboxing on BSD via pledge [0] and comparisons against Linux seccomp [1] - thank you! [0] https://news.ycombinator.com/item?id=17289654 [1] https://kristaps.bsd.lv/devsecflops/ (submission by same poster at https://news.ycombinator.com/item?id=44264021)

Very impressive design of the application -- haven't looked into the crypto yet. It reminds me a bit of the design the OpenBSD folks made with letskencrypt/acme-client: https://kristaps.bsd.lv/acme-client/

My main authoring tool is then Emacs Markdown Mode (https://jblevins.org/projects/markdown-mode/). For data entry, it comes with some bells and whistles similar to org-mode, like C-c C-l for inserting links etc. I seldom export my notes for external usage, but if it is the case, I use lowdown (https://kristaps.bsd.lv/lowdown/) which also comes with some nice output targets (among the more unusual are Groff and Terminal). Of cource pandoc (https://pandoc.org/) does a very good job here, too.

Now all we need is a Markdown to roff converter… which apparently already exists. https://github.com/postmodern/kramdown-man https://rtomayko.github.io/ronn/ronn.1.html https://kristaps.bsd.lv/lowdown/

If you like the sound of glow, check out lowdown. Renders to colorized term or man page, in addition to odf, latex, html & pdf https://kristaps.bsd.lv/lowdown/

Not an expert, but I think kcgi uses fastcgi under the hood. https://kristaps.bsd.lv/kcgi/

> Why not use sqlite? Here's one example - I like to access my database from my IDE remotely - my understanding is that remote access is not possible with sqlite. I found https://kristaps.bsd.lv/sqlbox/ to be an interesting approach.

IIUC, you would usually have a separate subprocess responsible for file access only, communicating over IPC with a less trusted and more complex process (eg. one that parses documents and renders fonts). See: architecture of acme-client(1): https://kristaps.bsd.lv/acme-client/

If you want to do web applications in C, you may also be interested in the kcgi[1] and ksql[2]. kcgi takes a more traditional approach by using CGI rather than embedding a static file server in the final binary. [1] https://kristaps.bsd.lv/kcgi/ [2] https://kristaps.bsd.lv/ksql/

Important pieces of the puzzle are Kristaps' kcgi (perhaps kwebapp/ksql). https://kristaps.bsd.lv/kcgi/ And also OpenBSD pledge / "sandboxing" on other OSs https://man.openbsd.org/pledge https://learnbchs.org/pledge.html https://kristaps.bsd.lv/kcgi/tutorial6.html

I probably wouldn't trust implementing important network speaking services as a shell script, potentially running as root. OpenBSD's acme-client [0] is a fork of Kristaps Dzonsons' project (formerly letskencrypt), it's a properly privilege separated ACME v1 client, written in C, using pledge(2) on OpenBSD, libseccomp on Linux. https://kristaps.bsd.lv/acme-client/ [0] https://man.openbsd.org/acme-client

It's not a joke, just look at the author's work on the supporting kcgi and kwebapp libraries: https://kristaps.bsd.lv/kcgi/ https://github.com/kristapsdz/kcgi https://github.com/kristapsdz/kcgi-framework https://github.com/kristapsdz/kwebapp

Web programming in C and CGI is alive and well: http://www.learnbchs.org/tools.html (mirror: https://archive.is/d1BXC) http://kristaps.bsd.lv/absdcon2016

I really wouldn't want to expose GLib to this level but to each their own. kcgi is an interesting C API with security taken seriously: http://kristaps.bsd.lv/kcgi/

I like the premise of embedded generating inline c. Kinda like php for c, rather than html I'm not sure of custom BNF per generating command. I notice they're mostly order independent, which makes it a little easier to learn, but what's the advantage over c syntax? Is it roughly that pointers etc are impossible. Maybe a c-esque syntax would be more learnable How does the existing syntax compose, i.e. can the user run away with writing tcl-style scripts If you don't get a lot of feedback, I would guess it is inpart due to custom syntax being an entry barrier to understanding I don't know, I think html is easy, so people want power with php. On the other hand for an audience that is using c, by the time I'm doing that, does Vely's custom syntax give me more than a set of convenient c library calls... such as https://kristaps.bsd.lv/kcgi/ In any case, I like the apis, and aim, and I think the premise has legs

I’m an OpenBSD developer (mostly a packager). IMO you’ve mischaracterized both Theo’s response and OpenBSD’s culture. If OpenBSD has a culture, it’s not “real men,” but “show me the code.” That’s plain from the mail linked in the post you responded to: mailing lists are full of people making suggestions (like “rewrite OpenBSD in Rust”), but few people doing the necessary work (like implementing or testing a reasonably POSIX‐compatible userland, handling the 8+ architectures that would immediately have to be dropped, measuring the performance impacts on the project build clusters…). Contrast the above response with the WireGuard implementation this whole discussion is about. A non‐OpenBSD contributor sent a draft patchset, which received suggestions and was iterated upon several times, and despite some complaints about the concept from one quarter (https://marc.info/?l=openbsd-cvs&m=159273877612032&w=2), it was committed by the very person who had those complaints! In the end Jason and Matt of WireGuard described the process as “extremely pleasant” (https://lists.zx2c4.com/pipermail/wireguard/2020-June/005588.html). This is feedback I see often from external contributors. You describe safety guards like privilege separation and pledge/unveil as “real men programming”, but they’re the complete opposite: they exist precisely to mitigate the damage that results from human error. acme-client’s design does keep private keys inaccessible this way (see…