Hacker News new | past | comments | ask | show | jobs | submit login

Nice. I've done this in the past. But I feel like attempting to make a file serving http server is like adding preservants and high fructose corn syrup to home made baked goods.

You have the opportunity to really make something custom and of high quality, hard code the paths of your files and avoid a whole class of vulnerabilities for example.

Configuration files? That makes sense when programmer and sysadmin are distinct, you can just modify variables and recompile.






I think you'll like dwm and other suckless tools. They have configuration as code and require a recompile after a configuration change.

Not sure if serious…

Not the only time it’s been brought up in this thread: https://news.ycombinator.com/item?id=41643198

I’m waiting for someone to chime in and explain why that would be a bad idea cause I can’t think of it from a security perspective.


Once at a certain level of complexity, e.g. having several hundred/thousand resources, then you start automating your hardcoded paths, and then you still can get bitten.

vs just putting things in a subfolder of your repo or whatever and having the default handling not accept `..` path components




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: