cryptography VS maud

Congratulations to the authors, this was a feature that was dearly missing from pyca/cryptography. It took a long time to get right.

For the history: https://github.com/pyca/cryptography/issues/2381

Some context:

- The cryptography dependency used by the current release of mitmproxy has a CVE related to an OpenSSL vulnerability (https://github.com/pyca/cryptography/security/advisories/GHS...)

- The main branch of mitmproxy has already upgraded to the latest version of the cryptography package

- The author of the package does not believe the CVE impacts users of mitmproxy so a release including this commit has not been made

Also you'll use https://github.com/pyca/cryptography

first, I did see a correlation between an endpoint being heavily hit in a given time window, and an increase of memory usage that didn't went down afterwards. The endpoint didn't do much so I went through every instruction - is a global variable appended indefinitely ? Is a cache decorator growing without a limit set ? Do I use a 3rd party that has a known issue ? Turns out, it was using cryptography, so I looked up known issues. Saw an issue about a leak when using load_pem_x509_certificate https://github.com/pyca/cryptography/issues/4833 - which I used ! I could fortunately just upgrade the library

Après le kerfuffle du paquet de cryptographie cette semaine (https://github.com/pyca/cryptography/issues/5771), J’ai passé en revue l’état des outils de gestion des dépendances en Python.

> A big problem with Rust, long-term, is that the kind of programs that really need it are somewhat out of today's mainstream. It's not that useful for webcrap. It's not that useful for phone apps. The AI people use Jupyter notebooks and Python to drive code on GPUs.

One thing this is missing is that Rust is useful for libraries callable by many different languages. You may or may not want to use it to build an actual Web app (I personally think it's a solid choice, but reasonable people can disagree). But for building, say, the Python cryptography library [1], which is used as a part of "webcrap" and Jupyter notebooks, Rust is clearly an excellent option. Nobody is going to build core Python infrastructure in Go or Node, and there will always be a need for plumbing libraries.

[1]: https://github.com/pyca/cryptography

Also, I see more and more examples where rust gets included in different technologies using FFI. Ie for python https://github.com/pyca/cryptography for security/performance critical pieces.

> I am curious. Could you give some more context?

Probably talking about this: https://github.com/pyca/cryptography/issues/5771

You will be hard pressed to find a cryptography library that doesn't depend on openssl. Fortunately openssl bindings can be installed on Windows. One of the more popular libraries for python is cryptography, but it does depend on libssl.

I would like to mention maud in this context:

https://github.com/lambda-fairy/maud

It is refreshingly different from other Rust templating libraries. It uses a proc-macro that compiles your HTML into Rust code. I also happen to use it in conjunction with HTMX and it works very well for me (at least in small projects).

You can also use HTML templating with crates like askama, tera and maud! This can be combined with the power of lightweight JavaScript libraries like htmx to speed up time to production. You can read more about this on our other article about using HTMX with Rust which you can find here.. We also collaborated with Stefan Baumgartner on an article for serving HTML with Askama!

I think a lot of us reach for Jinja-style templates so it feels a little more like we're writing bare HTML. But they're of course still just templates, and they need a build step before they become valid HTML.

So it's true, if you're willing to use a DSL embedded in your server language (like JSX), then you'll have the full language tooling available to you. And this probably isn't giving up much over language-specific templates.

A JSX-equivalent for the Rust server-side rendering world would probably be maud [1] or leptops [2].

[1] https://github.com/lambda-fairy/maud

[2] https://github.com/leptos-rs/leptos

Maud as a performant templating engine that will ensure your templates are well-formed at compile-time and, in effect, minify the generated HTML output by not passing through unnecessary whitespace.

Maud is a fast Slim/Haml-esque templating engine which will automatically minify your HTML at no extra charge because whitespace isn't significant in its syntax.

If you want to do backend development, give actix-web or Axum a try. If you need templating, take a look at Maud and if you want an ORM, take a look at SeaORM.

Personally, I'd recommend Maud if you don't need something with runtime reloading. Not only is it much faster, it implements a template language that is effectively the Rust-syntax equivalent to Slim or Haml using a procedural macro, so you get compile-time verification that your HTML output is well-formed.

For templating, Maud is fast, gives compile-time well-formedness guarantees, and outputs minified HTML by default as a side-effect of it being based on Rust macros. (It's of a similar design philosophy to Slim and Haml)