In 1994, a dynamic website meant writing a C program, placing it in a cgi-bin directory, and letting Apache fork it on each request. Thirty-two years later, the author shipped a commercial web product, marketyour.games, using fundamentally the same technology. The product includes user accounts, a search dashboard for content creators, folders for organizing them, payments through Stripe, and transactional emails through Postmark. It follows progressive enhancement and requires no JavaScript.
The stack is BCHS: OpenBSD, C, httpd, and SQLite. There is no framework, no templating language, and no separate database server. The C program reads CGI environment variables and outputs HTML directly. The binary is statically linked and deployed by replacing a single file, so new requests simply pick up the new version without a server restart or downtime. OpenBSD's pledge and unveil help secure the program, and httpd serves from a chroot. Dependencies are limited to libcurl for outbound requests, libsodium for identifiers, password hashing, and Stripe webhook verification, and libcjson for JSON parsing. A clean build takes a few seconds.
The author values CGI for its fundamentals over frameworks. The 1.1 specification, published in 2004, has not changed, and understanding HTTP is enough to understand CGI. It is language and platform agnostic, and it keeps a clear separation of concerns, with a single web server calling the business logic directly rather than reverse-proxying to a separate application server. Applications are ordinary programs that can be run from a shell and debugged with gdb.
The approach also offers minimal supply chain risk, a meaningful advantage given recent attacks on package repositories. With so few dependencies, there is less exposure to compromised packages. The author argues that CGI's decline was justified in 2004 but does not hold up in 2026, and that a modern web application can indeed be written in C.
Source: Hacker News · Summarized by HeadlinesBriefing