<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Mark,<div class=""><br class=""></div><div class="">If you are communicating to servers via HTTPS, Hackney and other HTTP clients allow you to pass options to the underlying SSL/TLS socket, including some verification of the peer certificate. For example:<div class=""><br class=""></div><div class=""><a href="https://github.com/talko/httpcbench/blob/master/src/httpcbench_client.erl#L79-L86" class="">https://github.com/talko/httpcbench/blob/master/src/httpcbench_client.erl#L79-L86</a></div><div class=""><br class=""></div><div class="">Gun has an open issue to address this (<a href="https://github.com/extend/gun/pull/27" class="">https://github.com/extend/gun/pull/27</a>), but it is not implemented. If you use Gun as your HTTPS client, you’re open to man-in-the-middle attacks.</div><div class=""><br class=""></div><div class="">Do not fall into a false sense of security that any Erlang HTTPS clients provide complete protection against man-in-the-middle attacks out of the box. You’ll also want to consider cases where your peer certificate was revoked by a Certificate Authority. You’d want to know how your HTTPS client handles certificates when their revocation data has been published via a CRL or OCSP. CRL verification has made some headway in Erlang (see the ssl module docs and <a href="http://erlang.org/doc/man/ssl.html" class="">https://github.com/Vagabond/erl_crl_example</a>). You’ll also want to look at hostname verification (<a href="https://github.com/benoitc/ssl_verify_hostname" class="">https://github.com/deadtrickster/ssl_verify_hostname.erl</a>). </div><div class=""><br class=""></div><div class="">HTTPS is as secure as you make it.</div><div class=""><br class=""></div><div class="">Felix mentioned ESL’s lhttpc repo. I’d take a look at Talko’s: <a href="https://github.com/talko/lhttpc" class="">https://github.com/talko/lhttpc</a> It’s the underlying HTTP client for erlcloud.</div><div class=""><br class=""></div><div class="">Hackney also has nice multipart/form functionality.</div><div class=""><br class=""></div><div class="">Cheers,</div><div class="">Drew</div><div class=""><br class=""></div><div class=""><div class=""><div><blockquote type="cite" class=""><div class="">On Dec 12, 2014, at 3:45 PM, Mark Nijhof <<a href="mailto:mark.nijhof@cre8ivethought.com" class="">mark.nijhof@cre8ivethought.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">I meant to mention Hackney. Why would you choose Hackney over Gun and vise verse?</div><div class="gmail_extra"><br class=""><div class="gmail_quote">On Fri, Dec 12, 2014 at 9:27 PM, Alex Shneyderman <span dir="ltr" class=""><<a href="mailto:a.shneyderman@gmail.com" target="_blank" class="">a.shneyderman@gmail.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class="">nobody mentioned hackney: well written, mature, filled with features. not to mention very active.</div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br class=""><div class="gmail_quote">On Fri, Dec 12, 2014 at 3:17 PM, Mark Nijhof <span dir="ltr" class=""><<a href="mailto:mark.nijhof@cre8ivethought.com" target="_blank" class="">mark.nijhof@cre8ivethought.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class="">Hi Felix, <span style="font-size:13px" class="">Iñaki</span>,<div class=""><br class=""></div><div class="">Thanks for your reply, you confirm what I was thinking myself about using Gun but I asked because of: </div><span class=""><div class=""><br class=""></div><div class="">> <span style="font-size:13px" class="">In general the state of http clients in erlang is a bewildering, overgrown thicket of ancient decaying masonry and beguiling dead ends filled with poisonous invisible gila monsters.</span></div><div class=""><span style="font-size:13px" class=""><br class=""></span></div></span><div class=""><span style="font-size:13px" class="">Cheers,</span></div><div class=""><span style="font-size:13px" class=""><br class=""></span></div><div class=""><span style="font-size:13px" class="">-Mark</span></div><div class=""><span style="font-size:13px" class=""><br class=""></span></div></div><div class=""><div class=""><div class="gmail_extra"><br class=""><div class="gmail_quote">On Fri, Dec 12, 2014 at 9:03 PM, Felix Gallo <span dir="ltr" class=""><<a href="mailto:felixgallo@gmail.com" target="_blank" class="">felixgallo@gmail.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class="">httpc has some weird bugs under load and should be retired from the standard distribution.<div class=""><br class=""></div><div class="">lhttpc is better but is a dead project and has a variety of forks, some of which are buggy or incomplete. The 'esl' fork seems to be the closest although in my experience it seems to have a broken pooling mechanism. Additionally it uses 'let it crash' for the common case of timeouts, which can fill up crash.log quickly and impede investigation into real issues.</div><div class=""><br class=""></div><div class="">dlhttpc is a fork of lhttpc that ferd put together to handle high volume requests to a low number of endpoints. It's also not actively maintained, but ferd is still alive and kicking and has recently responded to pull requests there. I intended on using this but rustled up my own nasty pool mechanism on top of my own hacked fork of lhttpc.</div><div class=""><br class=""></div><div class="">gun appears to be the most actively maintained; I haven't tried it yet but if it's as solid as cowboy, this is probably the right one to use for new projects.</div><div class=""><br class=""></div><div class="">shotgun is just an SSE convenience wrapper on gun, so if you don't need SSE, sticking with gun is probably your best bet.</div><div class=""><br class=""></div><div class="">fusco is an alpha quality http client that doesn't appear to be actively maintained.</div><div class=""><br class=""></div><div class="">In general the state of http clients in erlang is a bewildering, overgrown thicket of ancient decaying masonry and beguiling dead ends filled with poisonous invisible gila monsters.</div><span class=""><font color="#888888" class=""><div class=""><br class=""></div><div class="">F.</div><div class=""><br class=""></div></font></span></div><div class=""><div class=""><div class="gmail_extra"><br class=""><div class="gmail_quote">On Fri, Dec 12, 2014 at 11:44 AM, Iñaki Garay <span dir="ltr" class=""><<a href="mailto:igarai@gmail.com" target="_blank" class="">igarai@gmail.com</a>></span> wrote:<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr" class="">We love our tool shotgun[1], built on top of gun:<div class=""><br class=""></div><div class="">[1] <a href="https://github.com/inaka/shotgun" target="_blank" class="">https://github.com/inaka/shotgun</a></div><div class=""><br class=""></div><div class="">It improves on gun's SSE support. </div><div class=""><br class=""></div><div class="">good luck, </div><div class="">Iñaki</div></div><div class="gmail_extra"><br class=""><div class="gmail_quote"><div class=""><div class="">On Fri, Dec 12, 2014 at 4:38 PM, Mark Nijhof <span dir="ltr" class=""><<a href="mailto:mark.nijhof@cre8ivethought.com" target="_blank" class="">mark.nijhof@cre8ivethought.com</a>></span> wrote:</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class=""><div class=""><div dir="ltr" class="">Hi,<div class=""><br class=""></div><div class="">I am looking for the atm best solution to make http requests, from downloading a small file till larger (100mb) archives. I know of f.ex. the httpc, ibrowse, gun.</div><div class=""><br class=""></div><div class="">Any preferences? And why?</div><span class=""><font color="#888888" class=""><div class=""><br class=""></div><div class="">-Mark<br clear="all" class=""><div class=""><br class=""></div>-- <br class=""><div class=""><div dir="ltr" class="">Mark Nijhof<br class=""><div class=""><div class="">t: <a href="https://twitter.com/MarkNijhof" target="_blank" class="">@MarkNijhof</a><br class="">s: marknijhof</div></div><div class=""><br class=""></div></div></div>
</div></font></span></div>
<br class=""></div></div>_______________________________________________<br class="">
erlang-questions mailing list<br class="">
<a href="mailto:erlang-questions@erlang.org" target="_blank" class="">erlang-questions@erlang.org</a><br class="">
<a href="http://erlang.org/mailman/listinfo/erlang-questions" target="_blank" class="">http://erlang.org/mailman/listinfo/erlang-questions</a><br class="">
<br class=""></blockquote></div></div>
<br class="">_______________________________________________<br class="">
erlang-questions mailing list<br class="">
<a href="mailto:erlang-questions@erlang.org" target="_blank" class="">erlang-questions@erlang.org</a><br class="">
<a href="http://erlang.org/mailman/listinfo/erlang-questions" target="_blank" class="">http://erlang.org/mailman/listinfo/erlang-questions</a><br class="">
<br class=""></blockquote></div></div>
</div></div></blockquote></div><br class=""><br clear="all" class=""><div class=""><br class=""></div>-- <br class=""><div class=""><div dir="ltr" class="">Mark Nijhof<br class=""><div class=""><div class="">t: <a href="https://twitter.com/MarkNijhof" target="_blank" class="">@MarkNijhof</a><br class="">s: marknijhof</div></div><div class=""><br class=""></div></div></div>
</div>
</div></div><br class="">_______________________________________________<br class="">
erlang-questions mailing list<br class="">
<a href="mailto:erlang-questions@erlang.org" target="_blank" class="">erlang-questions@erlang.org</a><br class="">
<a href="http://erlang.org/mailman/listinfo/erlang-questions" target="_blank" class="">http://erlang.org/mailman/listinfo/erlang-questions</a><br class="">
<br class=""></blockquote></div><br class=""></div>
</div></div></blockquote></div><br class=""><br clear="all" class=""><div class=""><br class=""></div>-- <br class=""><div class="gmail_signature"><div dir="ltr" class="">Mark Nijhof<br class=""><div class=""><div class="">t: <a href="https://twitter.com/MarkNijhof" target="_blank" class="">@MarkNijhof</a><br class="">s: marknijhof</div></div><div class=""><br class=""></div></div></div>
</div>
_______________________________________________<br class="">erlang-questions mailing list<br class=""><a href="mailto:erlang-questions@erlang.org" class="">erlang-questions@erlang.org</a><br class="">http://erlang.org/mailman/listinfo/erlang-questions<br class=""></div></blockquote></div><br class=""></div></div></div></body></html>