Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It seems unlikely that this C++ library written by a solo dev is somehow more secure than the Python standard library would be for such a security-sensitive task.


Hi, can_ada (but not ada!) dev here. Ada is over 20k lines of well-tested and fuzzed source by 25+ developers, along with an accompanying research paper. It is the parser used in node.js and parses billions of URLs a day.

can_ada is simply a 60-line glue and packaging making it available with low overhead to Python.


Ah, that makes more sense -- it might be a good idea to integrate with the upstream library as a submodule rather than lifting the actual .cpp/.h files into the bindings repo. That way people know the upstream C++ code is from a much more active project.

Despite my snarky comments, thank you for contributing to the python ecosystem, this does seem like a cool project for high performance URL parsing!


Not in the sense of differential vulnerabilities, since the standard library refuses to match any sort of modern standard.

It's also

1. not a solo dev

2. Daniel Lemire

3. a serious engineering and research effort: https://arxiv.org/pdf/2311.10533.pdf


This is the commit history: https://github.com/TkTech/can_ada/commits/main/

I guess you are right that there are 2 commits from a different dev, so it is technically not a solo project. I still wouldn't ever use this in production code.


...

can_ada is just the python bindings.

The actual underlying project is at https://github.com/ada-url/ada


The can_ada repo threw me off, too. It looks super amateurish because of the lack of tests, fuzzers, etc.

But it appears that they've just exported the meat of the Ada project and left everything else upstream.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: