Top all-time · #2114
Kristaps
Personal blog · kristaps.bsd.lvsecurityprogramming
Kristaps writes Not Awful Underwater Photographs, a personal blog at kristaps.bsd.lv about security and programming. Since 2012, 38 different Hacker News readers have linked it 43 times, most often “Kcgi – minimal CGI and FastCGI library for C/C++”. The last post was in 2021, but the archive is still widely read.
Kristaps' site
Most-linked posts?
- Kcgi – minimal CGI and FastCGI library for C/C++7 people · 7 mentions · first linked 2017-01-20
- Lowdown – Simple Markdown Translator6 people · 7 mentions · first linked 2021-10-04
- /acme-client/6 people · 7 mentions · first linked 2016-09-20
- Let's Encrypt client from BSD in C3 people · 3 mentions · first linked 2016-07-11
- How easy is it for a developer to "sandbox" a program?3 people · 3 mentions · first linked 2025-06-11
- SQLite: Securely Using SQLite3 with Pledge(2) on OpenBSD2 people · 2 mentions · first linked 2019-10-15
- Secure CGI Applications in C on BSD (2016)2 people · 2 mentions · first linked 2019-04-01
What Hacker News says?
> Why not use sqlite? Here's one example - I like to access my database from my IDE remotely - my understanding is that remote access is not possible with sqlite. I found https://kristaps.bsd.lv/sqlbox/ to be an interesting approach.
Comment linking /sqlbox/
on “SQLite the only database you will ever need in most cases”Submitted Kcgi – minimal CGI and FastCGI library for C/C++ as a story · 82 points
HN discussionPushing the burden of network permissions management outside the browser, to the OS? Heresy! To be serious, this has introduced me to sandboxing on BSD via pledge [0] and comparisons against Linux seccomp [1] - thank you! [0] https://news.ycombinator.com/item?id=17289654 [1] https://kristaps.bsd.lv/devsecflops/ (submission by same poster at https://news.ycombinator.com/item?id=44264021 )
Comment linking /devsecflops/
on “Ask HN: Why does the US Visa application website do a port-scan of my network?”Submitted How easy is it for a developer to "sandbox" a program? as a story · 66 points
HN discussionI’m an OpenBSD developer (mostly a packager). IMO you’ve mischaracterized both Theo’s response and OpenBSD’s culture. If OpenBSD has a culture, it’s not “real men,” but “show me the code.” That’s plain from the mail linked in the post you responded to: mailing lists are full of people making suggestions (like “rewrite OpenBSD in Rust”), but few people doing the necessary work (like implementing or testing a reasonab…
Comment linking /acme-client/
on “WireGuard Merged into OpenBSD”Submitted Secure CGI Applications in C on BSD (2016) as a story · 14 points
HN discussionNow all we need is a Markdown to roff converter… which apparently already exists. https://github.com/postmodern/kramdown-man https://rtomayko.github.io/ronn/ronn.1.html https://kristaps.bsd.lv/lowdown/
Comment linking /lowdown/
on “Serving my blog posts as Linux manual pages”Submitted Kcgi – minimal CGI and FastCGI library for C/C++ as a story · 13 points
HN discussionMy main authoring tool is then Emacs Markdown Mode ( https://jblevins.org/projects/markdown-mode/ ). For data entry, it comes with some bells and whistles similar to org-mode, like C-c C-l for inserting links etc. I seldom export my notes for external usage, but if it is the case, I use lowdown ( https://kristaps.bsd.lv/lowdown/ ) which also comes with some nice output targets (among the more unusual are Groff and T…
Comment linking /lowdown/
on “Beautifying Org Mode in Emacs (2018)”Submitted Let's Encrypt client from BSD in C as a story · 5 points
HN discussionThis is really hilarious... I just followed the third given example ( https://kristaps.bsd.lv/absdcon2017/database-conclusions.htm... ) and that's how it goes: "the simplicity of SQLite is a lie". Ok, thanks, I'll pass on the "BCHS" stack then. I now consider this website satire.
Comment linking /absdcon2017/database-conclusions.html
on “BCHS: OpenBSD, C, httpd and SQLite web stack”Submitted Letskencrypt is a client for Let's Encrypt users, but one designed for security as a story · 4 points
HN discussionI really wouldn't want to expose GLib to this level but to each their own. kcgi is an interesting C API with security taken seriously: http://kristaps.bsd.lv/kcgi/
Comment linking /kcgi/
on “Balde: a microframework to develop web applications in C”Submitted Lowdown – Simple Markdown Translator as a story · 3 points
HN discussionThis looks great! I too have been working on a critter tracker[0], but writing it in C using kcgi[1] (no JS at all). I have never done a web project before, so this has been a great learning experience. I still have some functionality to complete, but so far it has been pretty useful, even just the "available now" feature. [0] https://xvetrd.tilde.institute/index.cgi [1] https://kristaps.bsd.lv/kcgi/
Comment linking /kcgi/
on “Show HN: A site to keep track of critters you can catch in Animal Crossing”Submitted Secure CGI Applications in C on OpenBSD as a story · 3 points
HN discussionImportant pieces of the puzzle are Kristaps' kcgi (perhaps kwebapp/ksql). https://kristaps.bsd.lv/kcgi/ And also OpenBSD pledge / "sandboxing" on other OSs https://man.openbsd.org/pledge https://learnbchs.org/pledge.html https://kristaps.bsd.lv/kcgi/tutorial6.html
Comment linking /kcgi/tutorial6.html
on “OpenBSD, C, httpd and SQLite – Web App stack”Submitted Slant – remote system monitor as a story · 3 points
HN discussionWeb programming in C and CGI is alive and well: http://www.learnbchs.org/tools.html (mirror: https://archive.is/d1BXC ) http://kristaps.bsd.lv/absdcon2016
Comment linking /absdcon2016
on “A Fortran Web Framework”Submitted Source Code Sandboxing as a story · 2 points
HN discussionI’m trying to understand your question. Typically, a process once compromised can do all sorts of things: touch files, access the network, execute programs, and so on. Among other things, OpenBSD’s security culture focuses on mitigating the damage done by compromised code through development practices such as privilege separation. Traditionally this was done by splitting functionality into multiple processes, each s…
Comment linking /acme-client/
on “Openrsync imported into the tree”Submitted Kcgi: Securing CGI web applications [pdf] as a story · 2 points
HN discussionIt's not a joke, just look at the author's work on the supporting kcgi and kwebapp libraries: https://kristaps.bsd.lv/kcgi/ https://github.com/kristapsdz/kcgi https://github.com/kristapsdz/kcgi-framework https://github.com/kristapsdz/kwebapp
Comment linking /kcgi/
on “BCHS stack – BSD, C, httpd, SQLite”Submitted SQLite: Securely Using SQLite3 with Pledge(2) on OpenBSD as a story · 2 points
HN discussionI probably wouldn't trust implementing important network speaking services as a shell script, potentially running as root. OpenBSD's acme-client [0] is a fork of Kristaps Dzonsons' project (formerly letskencrypt), it's a properly privilege separated ACME v1 client, written in C, using pledge(2) on OpenBSD, libseccomp on Linux. https://kristaps.bsd.lv/acme-client/ [0] https://man.openbsd.org/acme-client
Comment linking /acme-client/
on “A Unix shell script implementing ACME client protocol”Submitted Minimal CGI and FastCGI library in C as a story · 2 points
HN discussionAcme clients are a space where there are a lot of bad choices. My favorite acme client is this: https://kristaps.bsd.lv/acme-client/ It is: - Small - Written in C - Can be statically linked against LibreSSL and curl No nonsense, does what it says on the tin, works on many operating systems.
Comment linking /acme-client/
on “A Unix shell script implementing ACME client protocol”Submitted A secure Let's Encrypt client as a story · 2 points
HN discussionIf you want to do web applications in C, you may also be interested in the kcgi[1] and ksql[2]. kcgi takes a more traditional approach by using CGI rather than embedding a static file server in the final binary. [1] https://kristaps.bsd.lv/kcgi/ [2] https://kristaps.bsd.lv/ksql/
Comment linking /ksql/
on “Facil.io: A micro-framework for C web applications”Submitted Bsddistmake - distributed extension to bsdmake as a story · 2 points
HN discussion
