Hacker News new | past | comments | ask | show | jobs | submit login

Caddy provides higher memory safety guarantees than C servers.



Garbage-collected language seems to be slower.

Discord have switched away from Go for some performance-critical services because of it. [0] https://discord.com/blog/why-discord-is-switching-from-go-to...


The webserver will rarely be your bottleneck. Your application or database will be long before the webserver is.


I don't find it convincing to switch to a slower alternative.


What are your performance requirements?

Go is fast enough for Google. It's too slow for you?


Aren't proxy server more performance critical than usual backend code?


No. The proxy is almost never the bottleneck.


Source? Any content on memory safety concerns in "C" servers or problems that lead to catastrophic results in production? I'm interested in reading about it.


Uh, google “heartbleed bug”, that’s just one example of a massive and catastrophic result of lack of memory safety in C. It probably costed something on the order of $1B for remediation efforts globally.


Heartbleed was in openssl. I didn't ask about memory safety in C. Caddy author was pretty accurate with his statement, I asked for proof. Heartbleed is not the only memory leak, there's plenty, C's been around like software written in it. I'm aware of shortcomings.


Sorry, I don’t get understand your response. Most Caddy’s competitors use OpenSSL, and so are vulnerable to bugs in it. A lot of those bugs, like for example heartbleed, are only possible due to the nature of the C language. Those kinds of bugs, the memory safety bugs, are prevented when using memory safe languages like Go. These bugs are real and serious, and collectively cost billions of dollars in damages.


I don't understand your response.

There's not a single proof except heartbleed in OpenSSL. I merely asked the author to provide the proof, not for you and I to engage in Go's memory safety and billions in damages and inherent nature of C and so on.

If we were to sum all the "damages" caused by faulty software, we'd arrive at a number that exceeds the total sum of money on planet Earth, let's not use that false metric for this discussion.

Is there an actual problem right now with nginx that Caddy circumvents with its architecture? Yes or no? That's the question.



Yes


Guess which web servers use(d) openssl...





Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: