<story><title>Nweb: a tiny, safe web server (static pages only)</title><url>http://www.ibm.com/developerworks/systems/library/es-nweb/index.html</url></story><parent_chain></parent_chain><comment><author>kragen</author><text>A few months ago, I wrote httpdito, a tiny web server that serves static pages only.  It&amp;#x27;s about the same amount of code as nweb, but less functionality, and I have more confidence in its security: &lt;a href=&quot;http://canonical.org/~kragen/sw/dev3/server.s&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;canonical.org&amp;#x2F;~kragen&amp;#x2F;sw&amp;#x2F;dev3&amp;#x2F;server.s&lt;/a&gt;, with README at &lt;a href=&quot;http://canonical.org/~kragen/sw/dev3/httpdito-readme&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;canonical.org&amp;#x2F;~kragen&amp;#x2F;sw&amp;#x2F;dev3&amp;#x2F;httpdito-readme&lt;/a&gt;.  It&amp;#x27;s 296 instructions.&lt;p&gt;I&amp;#x27;m not saying it&amp;#x27;s secure, but I certainly intended it to be, and it doesn&amp;#x27;t suffer from the particular problems tptacek, evmar, kedean, and nknighthb identify in nweb.  I&amp;#x27;d like to think I&amp;#x27;m not naïve enough to have written problems like that, but that&amp;#x27;s probably not true.&lt;p&gt;(I&amp;#x27;m pretty sure that &amp;quot;Try my new secure software!&amp;quot; is something that should not be followed with &amp;quot;I wrote it in C!&amp;quot; but usually assembly language is not going to be an improvement.  In this case I think it happens to be.)&lt;p&gt;httpdito was discussed on HN a bit before it was finished; for example, it&amp;#x27;s no longer completely trivial to DoS it, although I could do more to protect it against that.</text></comment>
<story><title>Nweb: a tiny, safe web server (static pages only)</title><url>http://www.ibm.com/developerworks/systems/library/es-nweb/index.html</url></story><parent_chain></parent_chain><comment><author>tptacek</author><text>Adding to what everyone else has said, this also &amp;quot;how not&amp;quot; to write socket code; for instance, the assumption that you can read a whole HTTP request &amp;quot;in one go&amp;quot; with a single large read call is false.&lt;p&gt;Also, casting function calls to (void) is nonsensical.&lt;p&gt;You can perhaps forgive the sprintf() call because, AIX. (Believe it or not, there was a time when snprintf was a portability problem). You can&amp;#x27;t forgive the log() function that doesn&amp;#x27;t explicitly bounds check its argument (though it&amp;#x27;s not exploitable in this code).</text></comment>