webpki
CppCoreGuidelines
Our great sponsors
webpki | CppCoreGuidelines | |
---|---|---|
6 | 306 | |
451 | 41,446 | |
- | 0.8% | |
8.0 | 7.6 | |
2 months ago | 5 days ago | |
Rust | Python | |
GNU General Public License v3.0 or later | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
webpki
-
Struggling with the OpenSSL Crate
Beyond that, various things like the ScyllaDB driver are using OpenSSL because WebPKI doesn't support validating connections to IP addresses (as opposed to DNS names) and RusTLS currently delegates to WebPKI.
-
What Is Rust's Hole Purpose?
There's a JIT framework in Rust: https://github.com/bytecodealliance/wasmtime
There's a library for doing full X.509 certificate parsing and verification: https://briansmith.org/rustdoc/webpki/
There's definitely some attempts at doing pure-Rust SSL, but I suspect a lot of them are also doing some sketchy things with crypto that shouldn't be trusted (getting constant-time stuff implemented properly is really challenging, and probably requires large amounts of assembly to guarantee correctness).
-
I think a major issue with the rust ecosystem is that it's full of unexpected design decisions
An issue was raised with webpki to support the IP addressees 5 years ago, and yet it's still not there. What do people use to overcome the fact that rustls can't do IP-based client connections because of it? My guess would be, they are switching to native-tls or openssl-tls.
-
Why is SSL such a pain?
Yes, rustls currently doesn't support certificates without hostnames (only an IP); this is actually an issue with the webpki crate, and work to solve it is ongoing (will hopefully land in a release in a few months or so).
-
Preparing Rustls for Wider Adoption
> Bundling this set with Firefox
I love that they did that; it was actually my idea (https://bugzilla.mozilla.org/show_bug.cgi?id=657228). I believe the list is pretty large and changes frequently and so they download it dynamically.
> short cut to a "Yes"
Do they really do that? That's awesome if so. Then they don't even need to ship the roots.
> I specifically don't like [...] saying "unknown issuer"
https://github.com/briansmith/webpki/issues/221
> If std::fs::File::open() gives me Result with an io:Error that claims "File not found" but the underlying OS file open actually failed due to a permission error, you can see why that's a problem right? Even if this hypothetical OS doesn't expose any specific errors, "File not found" is misleading.
A more accurate analogy: You ask to open "example.txt" without supplying the path, and there is no "example.txt" in the current working directory. You will get "file not found."
Regardless, I agree we could have a better name than UnknownIssuer for this error.
CppCoreGuidelines
- Learn Modern C++
- C++ Core Guidelines
-
Modern C++ Programming Course
You need to talk to Bjarne and Herb...
"C++ Core Guidelines" - https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines
- CLion Nova Explodes onto the C and C++ Development Scene
-
Toward a TypeScript for C++"
In addition to the other comments -
TypeScript deliberately takes a "good enough" approach to improving JavaScript, instead of designing an ideal but incompatible approach. For example, its handling of [function parameter bivariance](https://www.typescriptlang.org/docs/handbook/type-compatibil...) is unsound but works much better with the existing JavaScript ecosystem. By contrast, a more academic functional programming language would guarantee a sound type system but would be a huge shift from JavaScript.
By analogy, Herb Sutter is arguing that something like the [C++ Core Guidelines](https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines), with tooling help in this new Cpp2 syntax, can bring real improvements to safety. Something like Rust's borrow checker would bring much stricter guarantees, backed by academic research and careful design, but would be incompatible and a huge adjustment.
-
MechE student here. Is there benefit to learning C in addition to C++, or can one do everything with C++ that can be done with C?
https://www.youtube.com/watch?v=2olsGf6JIkU
-
C++ is everywhere, but noone really talks about it. What are people's thoughts?
Take a look at Effective Modern c++ by Scott Meyers and the ISO c++ core guidelines. These resources are great for learning how to write better, more modern C++. I don't think it would be hard to grasp if you're already familiar with the language, just make sure to actually write some code which makes use of this stuff, otherwise it's easy to forget.
-
What are some C++ specific antipatterns that might be missed by C#/Java devs?
Look to the C++ Core Guidelines. It's not perfect, it has some flaws, including some sabotaging advice apparently adopted for political reasons. But at least it has some C++ authorities (Bjarne and Herb) as authors.
- How to improve the code quality
What are some alternatives?
rust-native-tls
Crafting Interpreters - Repository for the book "Crafting Interpreters"
rustls - A modern TLS library in Rust
github-cheat-sheet - A list of cool features of Git and GitHub.
rust-crypto - A (mostly) pure-Rust implementation of various cryptographic algorithms.
LearnOpenGL - Code repository of all OpenGL chapters from the book and its accompanying website https://learnopengl.com
rust-openssl - OpenSSL bindings for Rust
git-internals-pdf - PDF on Git Internals
schannel-rs - Schannel API-bindings for rust (provides an interface for native SSL/TLS using windows APIs)
Power-Fx - Power Fx low-code programming language
ring - Safe, fast, small crypto using Rust
clojure-style-guide - A community coding style guide for the Clojure programming language