5 ms·

It seems unlikely that this C++ library written by a solo dev is somehow more secure than the Python standard library would be for such a security-sensitive tas

It seems unlikely that this C++ library written by a solo dev is somehow more secure than the Python standard library would be for such a security-sensitive task.

masklinn 3y ago
Not in the sense of differential vulnerabilities, since the standard library refuses to match any sort of modern standard. It's also 1. not a solo dev 2. Daniel Lemire 3. a serious engineering and research effort: https://arxiv.org/pdf/2311.10533.pdf https://arxiv.org/pdf/2311.10533.pdf
- Areading314 3y ago
  This is the commit history: https://github.com/TkTech/can_ada/commits/main/ https://github.com/TkTech/can_ada/commits/main/ I guess you are right that there are 2 commits from a different dev, so it is technically not a solo project. I still wouldn't ever use this in production code.
  - bqmjjx0kac 3y ago
    The can_ada repo threw me off, too. It looks super amateurish because of the lack of tests, fuzzers, etc. But it appears that they've just exported the meat of the Ada project and left everything else upstream.
  - masklinn 3y ago
    ... can_ada is just the python bindings. The actual underlying project is at https://github.com/ada-url/ada https://github.com/ada-url/ada
TkTech 3y ago
Hi, can_ada (but not ada!) dev here. Ada is over 20k lines of well-tested and fuzzed source by 25+ developers, along with an accompanying research paper. It is the parser used in node.js and parses billions of URLs a day. can_ada is simply a 60-line glue and packaging making it available with low overhead to Python.
- Areading314 3y ago
  Ah, that makes more sense -- it might be a good idea to integrate with the upstream library as a submodule rather than lifting the actual .cpp/.h files into the bindings repo. That way people know the upstream C++ code is from a much more active project. Despite my snarky comments, thank you for contributing to the python ecosystem, this does seem like a cool project for high performance URL parsing!

It seems unlikely that this C++ library written by a solo dev is somehow more secure than the Python standard library would be for such a security-sensitive task.

masklinn 3y ago

Not in the sense of differential vulnerabilities, since the standard library refuses to match any sort of modern standard. It's also 1. not a solo dev 2. Daniel Lemire 3. a serious engineering and research effort: https://arxiv.org/pdf/2311.10533.pdf https://arxiv.org/pdf/2311.10533.pdf

Areading314 3y ago
This is the commit history: https://github.com/TkTech/can_ada/commits/main/ https://github.com/TkTech/can_ada/commits/main/ I guess you are right that there are 2 commits from a different dev, so it is technically not a solo project. I still wouldn't ever use this in production code.
- bqmjjx0kac 3y ago
  The can_ada repo threw me off, too. It looks super amateurish because of the lack of tests, fuzzers, etc. But it appears that they've just exported the meat of the Ada project and left everything else upstream.
- masklinn 3y ago
  ... can_ada is just the python bindings. The actual underlying project is at https://github.com/ada-url/ada https://github.com/ada-url/ada

TkTech 3y ago

Hi, can_ada (but not ada!) dev here. Ada is over 20k lines of well-tested and fuzzed source by 25+ developers, along with an accompanying research paper. It is the parser used in node.js and parses billions of URLs a day. can_ada is simply a 60-line glue and packaging making it available with low overhead to Python.

Areading314 3y ago
Ah, that makes more sense -- it might be a good idea to integrate with the upstream library as a submodule rather than lifting the actual .cpp/.h files into the bindings repo. That way people know the upstream C++ code is from a much more active project. Despite my snarky comments, thank you for contributing to the python ecosystem, this does seem like a cool project for high performance URL parsing!