<story><title>BCHS: OpenBSD, C, httpd and SQLite web stack</title><url>https://learnbchs.org/index.html</url></story><parent_chain><item><author>theamk</author><text>It seems pretty crazy to write web-facing apps in C, with no memory safety at all.&lt;p&gt;(They do have &amp;quot;pledge&amp;quot; but even in the most restricted case, this still leaves full access to database)</text></item></parent_chain><comment><author>rossy</author><text>It seems like the database libraries they recommend for security, ksql and sqlbox, mitigate the risk with process separation and RBAC, so the CGI process doesn&amp;#x27;t have full access to the database.&lt;p&gt;It&amp;#x27;s definitely contrary to modern assumptions about web app security, but it&amp;#x27;s interesting to see web apps that are secure because they use OS security features as they were designed to be used, rather than web apps that do things that are insecure from an OS-perspective, like handling requests from multiple users in the same process, but are secure because they do it with safe programming languages.</text></comment>
<story><title>BCHS: OpenBSD, C, httpd and SQLite web stack</title><url>https://learnbchs.org/index.html</url></story><parent_chain><item><author>theamk</author><text>It seems pretty crazy to write web-facing apps in C, with no memory safety at all.&lt;p&gt;(They do have &amp;quot;pledge&amp;quot; but even in the most restricted case, this still leaves full access to database)</text></item></parent_chain><comment><author>galdosdi</author><text>Funny to reflect that there was a time not so long ago when writing web apps (CGI usually) in C wasn&amp;#x27;t at all unusual (shortly before Perl became much more popular for this). And today, it is indeed kind of crazy.</text></comment>