top | item 15014557

Rust for the Web

244 points| huydotnet | 8 years ago |thefullsnack.com

95 comments

order
[+] modalduality|8 years ago|reply
Web developers may be also interested in https://gotham.rs/, which was released very recently and looks to be a promising competitor to Rocket.
[+] runevault|8 years ago|reply
And for those who care, unlike Rocket it runs on stable rust. IMO that is useful as I personally prefer running on stable than nightly.
[+] huydotnet|8 years ago|reply
Yeah, Gotham looks promising, and it has even better document than Rocket. It's always good to see more competitors coming around.
[+] bb-z|8 years ago|reply
I'm one of the developers of Gotham. Don't hesitate to reach out if you have any questions about it.
[+] PascalW|8 years ago|reply
Great to see a few new web frameworks popping up.

It seems that the older frameworks like Iron and Nickel.rs are not (yet) catching the async train.

[+] pankajdoharey|8 years ago|reply
Man Rust is super hard already! I mean people told me it would be harder to think functionally but after clojure, i think lisps are super easy. But i feel Rust is way harder than anything. Infact i feel Haskell is comparatively easier than Rust. So i am not sure why one wants to use it for web. I think Rust has a place and that is to replace C++ for system software, possibly even C for writing Kernels because why not? But definitely not for web. Go is probably the right choice for that sort of performance scenario in the backend. But for frontend neither Go or Rust are good simply because of the huge size of the runtimes. Clojure-script comparatively has a smaller runtime than either Go or Rust runtimes compiled to JS.
[+] steveklabnik|8 years ago|reply
> But for frontend neither Go or Rust are good simply because of the huge size of the runtimes.

Rust has a comparable amount of runtime as C, here it is: https://github.com/rust-lang/rust/blob/master/src/libstd/rt....

wasm/asmjs does bring in some stuff, because it's mostly in a "it works" state than a "this is as good as it gets" state; our initial implementations didn't even do much optimization at all. Last I checked (last November), an example TodoMVC was to ~650K total, and given that the smallest known Rust binary is 151 bytes, I'd imagine that only gets smaller into the future.

https://cryze.github.io/advent-of-code-2016/ has a bunch of Advent of Code programs in Rust, compiled this way; Day 1 is weighing in at 300kb, it looks like.

asmjs is also much larger than wasm, day 3 is showing 1.4 MB for asm, but 69kb for wasm.

[+] mathw|8 years ago|reply
I disagree. I think Rust is pretty easy once you've spent a bit of time learning about lifetimes.

It should be substantially less surprising when it's got non-lexical lifetimes, though.

Rust seems to me eminently suited to write high-performance web applications.

[+] pcwalton|8 years ago|reply
I'm using Rust/Rocket for Web apps and I'm as productive with that stack as I would be with, say, Go or Python/Flask. I'm more productive with Rust than I would be in Java. Programmers generally write the same amount of code (measured in LOC) per day regardless of the language, and Rust is pretty succinct. That said, I suspect if you want the absolute fastest development time, Rails and full-stack frameworks like it are still king.

In my case I'm writing a Web app to expose the functionality of a library that's written in Rust, and Rocket was a natural choice for that—it would make little sense to use some other language and go over the FFI. On the client side, I've found that TypeScript 2.x in strict mode goes nicely with Rust on the server, as both Rust and TS 2.x have comparably feature-rich and expressive type systems (generics, tuples, discriminated unions, a distinct null/option type, etc.)

[+] haskellandchill|8 years ago|reply
Haskell has more concepts than Rust (like higher kinder types) and should get linear types soon. Rust seems like Go with some Java and the great borrow checking system.
[+] EugeneOZ|8 years ago|reply
No, Rust is simple enough, just few first steps are difficult.
[+] legulere|8 years ago|reply
Rust is pretty much runtime-less. There's some unwinding stuff you could see as a runtime. You can simply replace it with a compiler flag. There is a standard library which you might mean, but you can opt out of that as well.
[+] jbg_|8 years ago|reply
I built https://dtmf.io/ using Rust. The first prototype was using the Iron framework but then after fighting some parts of Iron, I pared it back to just using async hyper & handlebars-rs directly for the HTTP and templating. The glue to put them together is really minimal. Overall, I've been really impressed with Rust.
[+] vvanders|8 years ago|reply
Nice overview, it might be worth mentioning that Emscripten isn't a tier 1 platform[1]. We've seen some asserts thrown in LLVM when building debug but go away when build release.

I've been trying to isolate it down to a reproducible sample but haven't nailed down exactly what's causing it yet.

Even with that issue it's been great to work with. I find myself so much more productive with Rust compared to C/C++.

[1] https://forge.rust-lang.org/platform-support.html

[+] dbaupp|8 years ago|reply
If you've got something large that asserts consistently, you could consider throwing some CPU time at it via creduce. It is designed for C, but Rust is close enough that a lot of its heuristics still work just fine.

Alternatively, since setting up/running creduce can be bit fiddly, if the code is open source, I suspect that someone would do it for you if you filed a bug against Rust pointing to an exact commit that demonstrates the problem with `cargo build --target=...` (or xargo) and requested/suggested creduce.

[+] IshKebab|8 years ago|reply
> NamedFile::open(Path::new("www/").join(file)).ok()

Is this vulnerable to the classic "../../../../../../../etc/passwd"?

[+] rahkiin|8 years ago|reply
I was thinking the exact same thing. Rust being a more memory-safe language does not mean it is a secure one. Still needs proper input validation.

EDIT: I opened the documentation and found https://api.rocket.rs/rocket/request/trait.FromSegments.html I don't fully understand if the checking they do on '..' fixes the attack vector here.

[+] JimDabell|8 years ago|reply
FYI, this is called a path traversal attack.
[+] RussianCow|8 years ago|reply
Just a small nitpick, but #3 is not actually an isomorphic app, it's just a regular server-rendered one. Isomorphic typically means that the app is rendered in the same way (e.g. via React) on both the frontend and backend, and the frontend degrades gracefully when JS isn't enabled.

More on-topic: I just recently started a new web app using Rust on the backend. Though there is definitely a lot still missing, it's amazing how far the language and its ecosystem have come in the past year or so. I expect that within a couple years, Rust will be a viable alternative to Python and Ruby for backend web development.

[+] Drdrdrq|8 years ago|reply
> I expect that within a couple years, Rust will be a viable alternative to Python and Ruby for backend web development

I like Rust, but I don't see this happening. Python, Ruby and PHP/Node.js languages became popular (and thus useful) because their learning curve is not steep - which is not something one can say about Rust. I consider myself capable developer but I struggled with many concepts. It's true that I didn't use it for a real project though, it might have been easier if I had clear goal in my mind.

[+] ricardobeat|8 years ago|reply
It _is_ isomorphic since he is shipping the rust code to the browser using web assembly.
[+] Animats|8 years ago|reply
It's cool that you can do this, but it's probably not something you want to do unless you have an unusual application. A reasonable application might be a heavily used API at the HTTP level, where the web-facing part is really a subroutine call interface, performance may be a big issue, and safety against bad parameters is a big issue.
[+] EugeneOZ|8 years ago|reply
You are cool, and it's all is amazing work. I bet it was very interesting to implement. But reading comments I think people don't understand that it's just demonstration of how much Rust evolved, not a tutorial of what they should do to use Rust for the Web. Kind of overkill :)
[+] thinbeige|8 years ago|reply
The 'Client-sode JS in Rust' part is a promising showcase for WebAssembly and I hope to see more languages compiling to WebAssembly soon. But looking closer at the code which does not a lot compared to its size I rather prefer the JS version.
[+] ryan-allen|8 years ago|reply
I do believe big change is coming over the next few years, as we can develop reliable solutions on Web Assembly we're going to be able to use better languages.

It's going to be glorious!

[+] jrs95|8 years ago|reply
In practice, I don't think Rust is really particularly well suited for this use case (especially the frontend stuff). But this is a really cool demo nonetheless, and the underlying WebAssembly will be something a lot of languages can use someday.
[+] huydotnet|8 years ago|reply
Yeah, the only convenience in this approach is to give you an ability to write JS right inside your Rust code. Somebody already starts implementing VIrtualDOM and something so we can expect more in the future.
[+] spankalee|8 years ago|reply
This makes no mention of the size of these applications. Given the recent focus on shipping less JavaScript to the browser to better support mobile and slow networks, I wonder how feasible this project even is?
[+] anotherbrownguy|8 years ago|reply
Well, that focus is if you are looking to market your apps in those markets. If your market has ubiquitous fast affordable internet, shipping more javascript is not that much of an issue, specially if it makes your web application faster and easier to run or develop or provides other benefits.
[+] gfodor|8 years ago|reply
I guess unless the author made size reduction a priority it doesn't really make too much sense to judge the project on those characteristics. It seems like an interesting path.
[+] roywiggins|8 years ago|reply
I can't help thinking something like Wt, but in Rust, would be an awfully handy way to write webapps.
[+] Siilwyn|8 years ago|reply
Nice blog! Do you have a RSS feed? Can't find any...
[+] jackblack8989|8 years ago|reply
This is all good and dandy but I don't like the webpage font-color! Can we have more of black on black so that it's even more modern and minimal? Or white-on-white which is more of a trend these days?
[+] lsh|8 years ago|reply
+1 for the snark, however I think the site looks good and the contrast is just right.

there is an official Chrome plugin that lets you meddle with a site's contrast these days if you're having trouble (like me) with this awful trend that's approaching white-on-white: https://chrome.google.com/webstore/detail/high-contrast/djcf...

[+] anhtran|8 years ago|reply
Rust is cool. But I don't think it's good for web backend at this time. I will try it when working with WebAssembly.
[+] littlestymaar|8 years ago|reply
I don't understand why you are downvoted : that's absolutely true, Rust isn't quite the best choice for web backend ATM, by far.

It's way better than last summer though, rocket and the recently announced gotham framework look great, and I'm really excited to see how it evolves in the next few months.