nginx is a big state machine built around epoll, and there's not much to do with the raw kernel ABI anyway (of course using safer and more powerful tools helps with the general quality of the end result, but not really with speed). it took many years for the uring ABI to emerge (and even using it efficiently is not trivial).

that being said, its common for new servers to have old vulns, not many coders will go over cve reports of apache and nginx and test their own code against old vulns in those.

i do find a lot of claims about performance or security are oftend unsupported as with this server. it just says it on the readme but provides no additional contex or proof or anything to back up those claims.

my thought is that original commenter gott riggered by that, perhaps rightfully, and points out thia fact more than anything. if you want to claim high performance or security, back it up with proof.

the simple fact its in rust doesnt make it more secure. and using async in rust doesnt imply good performance. it could in both cases. wheres the proof.?

Here’s the rocket.rs source I used:

    #[rocket::main]
    async fn main() -> Result<(), rocket::Error> {
        rocket::build()
            .mount("/", rocket::fs::FileServer::from("/tmp/test"))
            .ignite()
            .await?
            .launch()
            .await?;
        Ok(())
    }

My nginx config:

    worker_processes auto;
    master_process off;
    pid /dev/null;

    events {}

    http {
        sendfile on;
        access_log /dev/stdout;
        error_log /dev/stderr;
        server {
            listen 8089;
            server_name localhost;
            root /tmp/test;

            location / {
                try_files $uri $uri/ =404;
            }
        }
    }

The results for a 1GB file for me on an nvme ssd, averaged over 100 runs:

    nginx: 150ms
    rocket: 4 seconds

You can definitely write slow code in rust if you’re naive about reading/writing between channels a few kilobytes at a time, which is what rocket does, vs using sendfile(2), like nginx does.

Edit: These numbers were from a few months ago... I tried it again by just pasting the above into a new project with `cargo init` and adding rocket and tokio to my deps, and it's now 2.3s in debug and 1.2s in release mode. It may have improved since a few months ago, but it's still 10x slower.

I think this is really cool. More competition in this space is better not worse, I am merely curious to know how it stacks up

For example with HAProxy you can configure separate timeouts for just about everything. The time a request is queued (if you exceed the max connections), the time for the connection to establish, the time for the request to be recived, inactivity timeout for the client or server, inactivity timeout for websocket connections... The list goes on: https://docs.haproxy.org/3.1/configuration.html#4-timeout%20...

Slowloris is more than just the header timeout. What if the headers are received and the request body is sent, or response consumed very slowly? And even if this is handled with a "safe" default, it must be configurable to cater to a wide range of applications.