Top
Best
New

Posted by candiddevmike 1 day ago

Many hells of WebDAV(candid.dev)
158 points | 83 commentspage 2
cyberpunk 1 day ago|
I’m pretty sure there is a complete webdav implementation which ships with golang in the stdlib… Why do you need an external library for this? You just need to wrap it in a main.go and boom, webdav server.
jerf 1 day ago||
It's in the extended standard library at https://pkg.go.dev/golang.org/x/net/webdav . Whether or not it would meet their needs, they'd have to tell us. I don't think they told us enough to evaluate that ourselves, and even if they did doing even a quick job is probably at least an hour's careful reading and comparing and that's past my budget for an HN post. And they're not obligated to give us an absolutely complete accounting of everything they considered. That just generates other complaints.
packetlost 1 day ago|||
It's in golang.org/x/net, but yeah. I don't know if it's complete though.
bborud 1 day ago|||
Please read the posting. He says why in the second paragraph.
cyberpunk 1 day ago||
I did read the second paragraph:

> Now before you mention NIH syndrome, yes, we looked at the existing Go implementation, go-webdav. This library was lacking some key features we needed, like server-side collection synchronization, and the interfaces didn’t really align with our data model. This is also going to be a key feature of our product, so we should have some level of ownership for what gets implemented.

This is a different, non x/net library.

candiddevmike 1 day ago||
Author here, the stdlib webdav library is less complete than the go-webdav library.

> You just need to wrap it in a main.go and boom, webdav server.

Lol

cyberpunk 1 day ago|||
Okay, webdav server good enough to feed my home media players at least ;)
tracker1 1 day ago||
On not implementing half the RFCs, this is almost always true... some parts of "standards" are impractical or very difficult to implement, have no practical use or just aren't needed for your use case.

I created a test LMS in 2003 based on SCORM, at the time there really wasn't a good server for the standard... The main point was to be able to test the content which the company was hired to generate. I didn't implement several points of functionality that I just didn't need, didn't care about, and would have been difficult to implement.

That testing LMS turned into an actual product used by several aerospace companies (a few F100's, etc) and was in production for over 15 years. I remain friends with the company owner... It was about 12 years later than someone had an actual course that used one of the features that wasn't implemented... and even then, they only implemented it the half way needed, because it would have been difficult to do the rest.

utopiah 1 day ago||
> reverse engineering existing clients and servers by inspecting their requests and responses.

What a strange process... why not read the source code of an open source working library (easy to test, run a client made by someone else on its server, and vice versa) in a language close to the target?

Why not use then those tests as a way to verify your own work after?

FWIW I'm using WebDAV, both with clients and with my own self hosted servers, on a daily basis and... it works.

candiddevmike 1 day ago||
Author here, we wanted a clean room implementation and our own e2e test suite. There are some conformance tooling (like Apples calendar test suite) that we partially used (it's... very comprehensive), but otherwise we wanted to validate our library against existing implementations (manually, for the most part) and then write tests against our own implementation (for the interfaces, mostly to prevent regressions). We created a little CLI tool ("validav") that can spin up a mock server or expose the client interfaces to help with manual testing.

One niceish thing about WebDAV/CalDAV is it's pretty set in stone for now.

philsnow 17 hours ago||
> One niceish thing about WebDAV/CalDAV is it's pretty set in stone for now.

I don't know if you've ever heard "Latin is a dead language"; many people think that statement is a somewhat negative-sentiment one, amounting to something along the lines of "there's no good reason to learn Latin, it's dead", but I've heard that it's actually supposed to be a positive-sentiment statement, something like "we can have confidence that contemporary interpretations of this text haven't changed in the last ~1800 years because the language itself stopped changing around then".

didip 1 day ago||
I have a fun experiment for OP, since you already walked the reverse engineering route.

Why not download the most popular DAV libraries from various languages, Java, C++, PHP, etc. Regardless how ancient they are.

And then have AI like Claude to analyze and bring in the improvements to your own Go library?

I was doing something like that for Kerberos and Iceberg Rest Catalog API, until I got distracted and moved on to other things.

candiddevmike 1 day ago|
Author here, we don't use generative AI for software development. We've been building since 2018, and our number one goal has always been ensuring our software remains maintainable.
brongondwana 1 day ago|||
Did you use the 'litmus' test suite? I found it very useful when building Fastmail's (perl) WebDAV file server implementation.

There were also a bunch of fun things with quirks around unicode filename handling which made me sad (that was just a matter of testing against a ton of clients).

As for CalDAV and CardDAV - as others have said, JMAP Calendars/Contacts will make building clients a lot easier eventually... but yeah. My implementation of syncing as a client now is to look for sync-collection and fall back to collecting etags to know which URLs to fetch. Either way, sync-collection ALSO gives a set of URLs and then I multi-get those in batches; meaning both the primary and fallback codepath revert to the multi-get (or even individual GETs).

mystifyingpoi 1 day ago||||
> Author here, we don't use generative AI for software development.

You don't have to use it to directly write code. You can use it just for the analysis phase, not making any changes.

astrange 1 day ago||
I've tried that (with Sonnet 4.5 at least, not Opus) and Claude isn't good at code analysis because it's too lazy. It just grepped for a few things and then made the rest of it up.

I think the issue is mostly that it desperately tries to avoid filling its context window, and Anthropic writes system prompts that are so long it's practically already full from the start.

A good harness to read code for you and write a report on it would certainly be interesting.

mbreese 1 day ago||||
Those two things aren’t mutually exclusive. It may be worthwhile to at least have Claude (or whatever LLM you favor) to look at the other libraries and compare it to yours. It doesn’t have to write the code, but it could point out areas/features you’re missing.
candiddevmike 1 day ago|||
We know what we're missing (a lot, we didn't implement the full spec). We don't know what weird edge cases the clients/servers will have, and I would bet you decent money a LLM won't either. That's why manual testing and validation is so important to us.
mbreese 1 day ago||
I wouldn’t be so sure about the LLM not helping. The LLM doesn’t need to know about the edge cases itself. Instead, you’d be relying on other client implementations knowing about the edge cases and the LLM finding the info in those code bases. Those other implementations have probably been through similar test cycles, so using an LLM to compare those implementations to yours isn’t a bad option.
BeetleB 1 day ago|||
> Author here, we don't use generative AI for software development.

How close to retirement are you?

aurumque 1 day ago||
Golang is one of the only languages with a more or less working library. I built with it and using some hacks got it hooked up to AWS API Gateway with Lambda. Reading the room, the lack of language support does make it pretty suspect in 2026, even if the client support is still pretty good. Recently I have abandoned in favor of AWS Mountpoint (rust S3 mounting) and combined with Lambda object get and list functions have achieved most of the same functionality. The downside being that you lose the ability to talk to the many varied clients like an old HP printer which (obviously) can't use FUSE.
ekjhgkejhgk 1 day ago||
I started running a DAV server for calendar and contacts. Smooth failing.
ekjhgkejhgk 1 day ago||
Typo. Not smooth failing - smooth sailing.
EvanAnderson 1 day ago|||
Thanks for that. Given the disdain being expressed in other comments on this article it was unclear if you meant it as-written.
tocitadel 1 day ago|||
[dead]
smashed 1 day ago||
What implementation are you using? Can you easily handle things like authentication and calendar sharing? For example sync a family calendar.
ekjhgkejhgk 1 day ago|||
Radicale - https://github.com/Kozea/Radicale

I picked it because it's in a language I know (Python) and free and copyleft. These days I don't contribute to anything unless it's copyleft.

No idea if it supports family calendar, I need to look into that as well at some point.

EDIT Just checked and supports auth, yes.

gh02t 1 day ago|||
YMMV and a lot of people hate it, but I've run Nextcloud for this for years. It has pretty comprehensive support for WebDAV and CalDAV. Has sharing and lots of different authentication options; I use OIDC with PocketID.

It used to be a constant headache to keep running, but ever since I switched to the TrueNAS/Docker plugin it has worked smoothly. I know a lot of other people also have had good luck with the much lighter Radicale if CalDAV is your primary concern.

znpy 1 day ago||
> It used to be a constant headache to keep running

It’s been very easy to run for me since version 15 or something. Basically i just use the stock docker image and mount a few files over there. The data folders are bind-mounded directories.

As usual with anything php, it’s only a mess if you start managing php files and folders yourself. Php has a special capability of making these kind of things messy, i don’t know why.

veggieroll 1 day ago||
> This library was lacking some key features we needed, like server-side collection synchronization

Yes! This is my #1 issue with the library as well.

emersion 1 day ago|
Library maintainer here. Why not send a PR?
veggieroll 1 day ago||
I have some patches saved up coming your way once I leave my current employer, who doesn't allow external open source contributions. Though that is not for a few years probably.

Love the libraries BTW. Thank you for all of your hard work.

Nextgrid 20 hours ago||
Why not publish it anonymously?

If there's actual employer IP in there then just leaving said employer wouldn't magically clear it.

If there isn't and you're just trying to avoid red tape, then publishing it anonymously would work around the issue.

veggieroll 15 hours ago||
I feel like it'd be kinda a jerk move to contribute anonymously when you know that might create an IP issue for an open source project. Even if the code truly has no IP issue, legal attention from an litigious company would likely be devastating to even a well resourced project.
Nextgrid 14 hours ago||
Well the idea is that you determine the intention of the “IP issue” and act accordingly:

If there is an actual IP issue then even waiting after you’re out of the company will not resolve said IP issue. If you’re using your employer’s IP then waiting is unlikely (both legally and especially morally) to magically resolve it - it’s still your employer’s IP.

If it’s just to avoid red tape but otherwise the IP is yours and has nothing to do with your employer (aka you could’ve done it just as well even if you weren’t at your current employer, and your employer’s competitive advantage is not based on having a good WebDAV implementation) then it should be fine and you’re just taking a shortcut to save time on both sides.

Basically, if your employer is a vendor of WebDAV libraries, yeah of course there’s a (legal, or a least moral) issue. If not, then all fine.

(Obviously this is just opinion and not legal advice - but legality only matters if they can figure out who did it ;)

veggieroll 13 hours ago||
I think the situation your missing is when the employer has a much much more aggressive stance to IP. Even if you are 100% confident that your contribution doesn't violate your employer's IP, they can still sue and ruin your life.

Some employers have an unbelievably unreasonable interpretation of non-compete and IP. They think they own everything their employees do, and even though they're wrong. That doesn't stop them from ruining you and whatever unfortunate open source project they set their sights on with vexatious litigation.

Nextgrid 3 hours ago||
> they can still sue and ruin your life.

Thus the suggestion to publish anonymously.

veggieroll 23 minutes ago||
I think it is unwise for a maintainer to accept anonymous contributions.
latchkey 1 day ago||
16 years ago, I wrote a Java client that is still in use today in quite a number of products. It wasn't that bad.

https://github.com/lookfirst/sardine

sorry_i_lisp 1 day ago|
Thank you! I also use it.
BoredPositron 1 day ago|
WebDAV/CalDAv and CardDAV are a minefield for users and devs. I would love to see something new.
morgan814 1 day ago||
JMAP[0], which has in-progress specs for calendar and contacts, is supposed to save us. It can't happen soon enough - if it happens at all.

[0] https://jmap.io/spec.html

TuningYourCode 1 day ago|||
There is at least https://jmap.io/spec-calendars.html just adoption is a bit low for now but I hope it will gain more traction the next years.
n3storm 1 day ago||
what you mean? a new http extension to access/author resources?