
Balde: a microframework to develop web applications in C - ashitlerferad
https://balde.rgm.io/
======
rafaelmartins
Hi guys, I'm the author of this framework, and it seems that someone shared it
here because I started this blog post series this weekend:
[https://rgm.io/post/balde-internals-
part1-foundations/](https://rgm.io/post/balde-internals-part1-foundations/)

This is why most of the documentation is marked as TODO, but the API docs are
reasonably up-to-date.

If someone has interest on it or is willing to help, please let me know :)

EDIT:

simple url shortener example, using redis:
[https://gist.github.com/rafaelmartins/9f8392a8909e62820ae0](https://gist.github.com/rafaelmartins/9f8392a8909e62820ae0)

"complete" app, with templates and stuff:
[https://github.com/rafaelmartins/bluster](https://github.com/rafaelmartins/bluster)

~~~
znpy
Unless you're going to reference your blog-posts in the documentation and
you're willing to keep such documentation updated, I'd strongly recommend you
to focus on improving the documentation instead of writing long walls of text
on the internals.

If I imagine myself using your framework, well, I would be very angry at you
if I had to stop writing code, leave my editor and go read your shilly-shally.

I would focus on:

1) Topics like "Application structure", "Application Deployment", "Application
command-line interface" (which at the moment of writing are all just a
"TODO").

2) Sample code. A 30 lines example is worth a thousand word blog post

3) More sample code. Ideally, one for every crucial part (cookies? session?
middlewares?)

By the way: I see there are some examples, great! But add some more comments
to your examples.

4) Blog post on internals.

I'd delay the blog post upon internals because I guess that since you'll be
receiving a lot of feedback you might want to change things in the internals
thus "invalidating" your blog posts.

P.s: congratulations on using doxygen so well! I wish more project had such a
well done documentation!

p.p.s: I hope you won't find my comment rude or anything, I actually like this
project.

~~~
rafaelmartins
hey, thanks for the comment, it is far away from being rude :)

blog posts were never the focus, they are mostly for myself, to remember how
things work, as I don't work on the framework for some time, and need to have
it fresh in mind to write proper docs. it may also help other people willing
to help writing docs. also, whoever published balde website here in HN found
it due to these blog posts, then they were worth already. :) and to be honest,
I'd not publish the framework here in hacker news right now, I'd wait for
documentation to be ready, but someone else couldn't wait, so...

but you're right. the focus now is writing documentation.

thanks

~~~
ejanus
Great job! But Balde first appeared on HN about 2 years ago,
[https://news.ycombinator.com/item?id=7765301](https://news.ycombinator.com/item?id=7765301).

------
azov
I would guess most people use C web frameworks for embeddability, not
performance. The use case is to add a web-based UI to some C/C++ application
or device, think configuration UI of your router or something of this sort.

My go to solution for this is libwebsockets. Balde seems to have some nice
features, but SCGI + external webserver requirement makes it difficult to
embed. I'd also question whether GLib is a reasonable dependency for HTTP
microframework.

~~~
a2800276
My thoughts exactly! Apart from embedded systems (or using it as embedded in
an application, e.g. to provide an application's help system via an internal
web browser) I'd find it weird to build websites in C. I'm looking for
something along these lines for embedded systems, but GLib & external
webserver disqualify balde. Still looks like a nice, clean project, though I
was disappointed to find out I can't try it out :)

~~~
tosseraccount
C may have some shortcomings, particulary policing memory vioations, but can
be very lightweight and very fast. Remember, Linux and Apache/NGINX are in C .
Implementing the site specifics in C isn't that much of a stretch. The extra
speed could even make your site that much more useable.

The canonical genome browser is written in C: [http://genome.ucsc.edu/cgi-
bin/hgTracks?db=hg19](http://genome.ucsc.edu/cgi-bin/hgTracks?db=hg19) ... for
pure speed.

------
qaq
"With balde you can serve hundreds of requests per second" is it supposed to
be "hundreds of thousands"?

~~~
EpicEng
They're just playing the expectations game.

~~~
kabdib
Unlike, say, Oracle :-)

------
jaromilrojo
I used my own C code generator for CGIs for years, along mongoose for other
tasks. Nowadays I'm using [https://kore.io](https://kore.io) and I'm VERY
happy with it, great developer experience, well written and understandable
code, minimal in dependencies and no bugs so far. I'm using it quite heavily
in a project, it was easy to add templating and other amenities to it. Highly
recommended.

------
ktRolster
It has potential, but the documentation is full of TODO, so it's hard to say
much about it. For example, I was trying to figure out how it handles unicode,
and also how it handles memory management.

For comparison, ribs2 (
[https://github.com/Adaptv/ribs2](https://github.com/Adaptv/ribs2) ) is a
framework in C that handles garbage collection for you. But it's not really a
comparison because Balde doesn't have the documentation, unfortunately.

~~~
rafaelmartins
yes, it lacks documentation, I started this blog post series to try to address
this: [https://rgm.io/post/balde-internals-
part1-foundations/](https://rgm.io/post/balde-internals-part1-foundations/)

if you have some specific question, feel free to ask

~~~
ktRolster
So, how does it handle memory allocation? Are there memory pools?

~~~
rafaelmartins
as it is a microframework, it does not cares about such details, you can
handle memory allocation by hand, or use memory pools provided by glib, create
gobjects and use refcount, etc. It is up to you :)

Internally used memory should be free'd manually with the balde_app_free
function. it encapsulates most of it for you.

~~~
ktRolster
That actually helps me have a better understanding of how the framework is
structured, thanks.

------
isuckatcoding
This looks very interesting. This being C, I assume the performance is really
good (although yes I know it's not always the case).

However, C is one of those "double-edged sword" kinds of languages. What kind
of trade offs between performance and "safety" would one be making here? Are
they worth it?

~~~
ktRolster
_This being C, I assume the performance is really good_

FWIW, everyone I know who moved web-serving things to C did so primarily
because of latency, and then secondarily to avoid GC time delays. Higher
transactions per server was a bonus, but no one did it for that.

Also, if you have to hit a database, then any efficiency you get from
switching to C will probably be swallowed up by that.

~~~
woodman
> Also, if you have to hit a database...

I can only think of one case where that is pretty much always true - CRUD with
a network connected db backend, several cases where it is debatable, and a
bunch of cases where that is wrong. See sqlite3, situations where you can use
unix sockets, dynamically loaded modules, etc.

I'm finishing up a project that basically builds state models from log events,
automatically, and robustly enough that hopefully the end users wouldn't
notice if I were run down by a bus. With the massive amount of data and high
dimensionality of the problem, I have a hard time seeing how to pull it off
but with C and statically compiled sqlite... or a big bag of money to throw at
IBM.

~~~
ktRolster
_builds state models from log events, automatically_

That sounds really cool, but I'm not quite sure what it means.

~~~
woodman
Take business process modeling [0], and add a dash of directed acyclic graph
[1]. You need both fast access to a massive amount of historical data, and the
ability to finely control what gets stored where in memory - so not something
you can really do in an SQL transaction.

[0]
[https://en.wikipedia.org/wiki/Business_process_modeling](https://en.wikipedia.org/wiki/Business_process_modeling)
[1]
[https://en.wikipedia.org/wiki/Directed_acyclic_graph](https://en.wikipedia.org/wiki/Directed_acyclic_graph)

------
ninguem2
Balde means bucket in Portuguese. I thought that was an accident, but looking
at the logo on the website I guess it's intentional.

------
eatonphil
I've been looking into web frameworks in C recently. The offerings aren't
awesome. It's hard to find a good BSD-like-licensed library.

Frontrunners included Kore and Crow (another microframework). I went with Kore
for a while but it has a pretty terrible API for actually writing web
applications. I couldn't take Crow seriously. I ended up going with fastcgi
because it was the simplest to wrap using the Scheme FFI.

Others included Lwan (gpl) and Mongoose (gpl).

~~~
jytqtrrrrr
Hey, I'm on a phone without my last pass. I've spent a fair amount of time
trying to find a happy web c++ framework.

Implementing fastcgi seemed too daunting to me... hello world was crushingly
painful to set up (using Apache)

lwan and mongoose are GPL.I

I feared kores API as well, but I never got around to actually using it, so
I'll just use your Menton of it as confirmation of my fears .

I'd looked at crow, and it didn't look so bad, but now I'm not so sure. What
did you like about it? What didn't you like about it? What made fcgi less
painful / more fun?

Basically, I'd love any notes on your attempt / experiences / etc. !

~~~
eatonphil
Fastcgi was incredibly simple to get hello world running - both in C and
through the Chicken Scheme FFI. However, "all" it provides is the backend for
a web server so you'd still need to handle things like routes and templates
and responses yourself. Still, I don't find those to be the challenging part.

The issue that I'm having with fastcgi is the random scarcity of API
documentation. I can't believe it's so hard to find - googling for "fcgx
accept_r api documentation" just yields nothing.

Anyway, it was very cool to get it running in Scheme so I'll definitely write
a post on that soon. I'll post it on this thread when I do.

~~~
j120dj201jdwj
I'd read a (hopefully scheme agnostic, or at least, scheme-decoupled) tutorial
on how you got fastcgi up and running painlessly. I really struggled with the
lack of documentation as well.

------
catmanjan
Looks neat, although I think I'd find myself mistyping "blade" a lot.

------
moron4hire
"Why would anyone want this?" \-- There are people who know C--and it's
associate library ecosystem--really well and are very comfortable with it.
They may have projects where it would not be a productive use of their time to
have to learn a new language and a new set of libraries just to get a little
code online.

I know, shock and horror, wailing, gnashing of teeth. /s

Is it just me, or has HN gotten really bitchy towards people's projects lately
(and by "lately", I mean "the last year")? There are real people behind these
projects. They did a thing and it might not be your cup of tea or anything in
your experience bubble, but that doesn't make it stupid or misguided.

~~~
icebraining
It's not a new phenomena, Show HN has had such questions for years:
[https://news.ycombinator.com/item?id=5873619](https://news.ycombinator.com/item?id=5873619)

:)

------
kev009
I really wouldn't want to expose GLib to this level but to each their own.
kcgi is an interesting C API with security taken seriously:
[http://kristaps.bsd.lv/kcgi/](http://kristaps.bsd.lv/kcgi/)

~~~
rafaelmartins
I love kcgi, but we have different focus. I may use it as FCGI layer for
balde, though :)

------
est
Looks like it's using NULL-terminated strings. Is the framework secure? Is it
compatible with (all kinds of) Unicode and data with NULL in it?

~~~
rspeer
Why would you need to be compatible with "all kinds of Unicode", by which I
assume you mean different encodings?

You just need to be fully compatible with _one_ kind of Unicode (UTF-8) and
use it consistently. And null-terminated UTF-8 is no more or less safe than
null-terminated ASCII, because the only UTF-8 codepoint that uses 0x00 is the
same one as in ASCII.

~~~
fauigerzigerk
That's true provided you validate all UTF-8 input. As you probably know, UTF-8
has a lead byte that indicates how many of the following bytes are part of the
same code point. If your code blindly believes what that first byte claims,
then you could easily get tricked into reading beyond '\0'.

~~~
rspeer
Yes, you should validate the UTF-8 at some point before you actually
manipulate the contents of the string. Before that, you can just treat it as a
pile of bytes.

You don't need to go down different paths of how you read those bytes based on
the codepoint lengths until you're actually doing something with codepoints.

------
_RPM
So this has an embedded HTTP server then? Looks cool.

~~~
kbaker
No, I don't think so, it says it requires an SCGI interface to the web server.
Apparently SCGI is like an upgraded CGI.

~~~
aninteger
Looking through the source (app.c) it can do SCGI, CGI, and also has its own
httpd server.

~~~
rafaelmartins
You are supposed to use SCGI in production. The embedded HTTPD is provided to
help during development, so you don't need to setup SCGI in your local
machine. I never did any serious testing on the HTTPD, but it was not
developed with security and performance in mind.

------
sdsk8
Rafael, congratulations on this project, i love seeing Brazilian projects
here.

------
Eun
A comparison in terms of speed between blade and cppcms would be nice.

------
cordite
Seems more promising than g-wan

------
mirekrusin
Why not vala (or genie)?

------
bmedwar
anyone know a good micro web framework written in LLVM IR?

------
gbog
I remember that one big lesson learned after heartbleed bug was that we should
not develop in C anymore. To me, this has probably many exceptions, but still
should be especially true for web dev.

~~~
mrweasel
If that was your takeaway from Heartbleed, then you wheren't paying attention.

