Top
Best
New

Posted by candiddevmike 1/7/2026

Many hells of WebDAV(candid.dev)
170 points | 96 commentspage 2
tracker1 1/7/2026|
On not implementing half the RFCs, this is almost always true... some parts of "standards" are impractical or very difficult to implement, have no practical use or just aren't needed for your use case.

I created a test LMS in 2003 based on SCORM, at the time there really wasn't a good server for the standard... The main point was to be able to test the content which the company was hired to generate. I didn't implement several points of functionality that I just didn't need, didn't care about, and would have been difficult to implement.

That testing LMS turned into an actual product used by several aerospace companies (a few F100's, etc) and was in production for over 15 years. I remain friends with the company owner... It was about 12 years later than someone had an actual course that used one of the features that wasn't implemented... and even then, they only implemented it the half way needed, because it would have been difficult to do the rest.

whizzter 1/7/2026||
Actually done some WebDAV, did a small client (talking to Apache) from JS that worked well enough for my purposes.

The nasty surprise was doing the server-side (for a hobby-project), many layers. Luckily found out that something called DavTest exists (it's included with Debian) so testing most basic things wasn't too bad.

Then tried mounting from Windows and running into a bunch of small issues (iirc you need to support locking), got it to mount before noticing notes about a 50mb file-size limit by default (raisable.. but yeah).

It's a shame it's all such a fragmented hodge-podge because adding SMB (the only other "universal" protocol) to an application server is just way too much complexity.

latchkey 1/7/2026||
16 years ago, I wrote a Java client that is still in use today in quite a number of products. It wasn't that bad.

https://github.com/lookfirst/sardine

sorry_i_lisp 1/8/2026|
Thank you! I also use it.
cyberpunk 1/7/2026||
I’m pretty sure there is a complete webdav implementation which ships with golang in the stdlib… Why do you need an external library for this? You just need to wrap it in a main.go and boom, webdav server.
jerf 1/7/2026||
It's in the extended standard library at https://pkg.go.dev/golang.org/x/net/webdav . Whether or not it would meet their needs, they'd have to tell us. I don't think they told us enough to evaluate that ourselves, and even if they did doing even a quick job is probably at least an hour's careful reading and comparing and that's past my budget for an HN post. And they're not obligated to give us an absolutely complete accounting of everything they considered. That just generates other complaints.
packetlost 1/7/2026|||
It's in golang.org/x/net, but yeah. I don't know if it's complete though.
bborud 1/7/2026|||
Please read the posting. He says why in the second paragraph.
cyberpunk 1/7/2026||
I did read the second paragraph:

> Now before you mention NIH syndrome, yes, we looked at the existing Go implementation, go-webdav. This library was lacking some key features we needed, like server-side collection synchronization, and the interfaces didn’t really align with our data model. This is also going to be a key feature of our product, so we should have some level of ownership for what gets implemented.

This is a different, non x/net library.

candiddevmike 1/7/2026||
Author here, the stdlib webdav library is less complete than the go-webdav library.

> You just need to wrap it in a main.go and boom, webdav server.

Lol

cyberpunk 1/7/2026|||
Okay, webdav server good enough to feed my home media players at least ;)
utopiah 1/7/2026||
> reverse engineering existing clients and servers by inspecting their requests and responses.

What a strange process... why not read the source code of an open source working library (easy to test, run a client made by someone else on its server, and vice versa) in a language close to the target?

Why not use then those tests as a way to verify your own work after?

FWIW I'm using WebDAV, both with clients and with my own self hosted servers, on a daily basis and... it works.

candiddevmike 1/7/2026||
Author here, we wanted a clean room implementation and our own e2e test suite. There are some conformance tooling (like Apples calendar test suite) that we partially used (it's... very comprehensive), but otherwise we wanted to validate our library against existing implementations (manually, for the most part) and then write tests against our own implementation (for the interfaces, mostly to prevent regressions). We created a little CLI tool ("validav") that can spin up a mock server or expose the client interfaces to help with manual testing.

One niceish thing about WebDAV/CalDAV is it's pretty set in stone for now.

philsnow 1/8/2026||
> One niceish thing about WebDAV/CalDAV is it's pretty set in stone for now.

I don't know if you've ever heard "Latin is a dead language"; many people think that statement is a somewhat negative-sentiment one, amounting to something along the lines of "there's no good reason to learn Latin, it's dead", but I've heard that it's actually supposed to be a positive-sentiment statement, something like "we can have confidence that contemporary interpretations of this text haven't changed in the last ~1800 years because the language itself stopped changing around then".

aurumque 1/7/2026||
Golang is one of the only languages with a more or less working library. I built with it and using some hacks got it hooked up to AWS API Gateway with Lambda. Reading the room, the lack of language support does make it pretty suspect in 2026, even if the client support is still pretty good. Recently I have abandoned in favor of AWS Mountpoint (rust S3 mounting) and combined with Lambda object get and list functions have achieved most of the same functionality. The downside being that you lose the ability to talk to the many varied clients like an old HP printer which (obviously) can't use FUSE.
ekjhgkejhgk 1/7/2026||
I started running a DAV server for calendar and contacts. Smooth failing.
ekjhgkejhgk 1/7/2026||
Typo. Not smooth failing - smooth sailing.
EvanAnderson 1/7/2026|||
Thanks for that. Given the disdain being expressed in other comments on this article it was unclear if you meant it as-written.
tocitadel 1/8/2026|||
[dead]
smashed 1/7/2026||
What implementation are you using? Can you easily handle things like authentication and calendar sharing? For example sync a family calendar.
ekjhgkejhgk 1/7/2026|||
Radicale - https://github.com/Kozea/Radicale

I picked it because it's in a language I know (Python) and free and copyleft. These days I don't contribute to anything unless it's copyleft.

No idea if it supports family calendar, I need to look into that as well at some point.

EDIT Just checked and supports auth, yes.

gh02t 1/7/2026|||
YMMV and a lot of people hate it, but I've run Nextcloud for this for years. It has pretty comprehensive support for WebDAV and CalDAV. Has sharing and lots of different authentication options; I use OIDC with PocketID.

It used to be a constant headache to keep running, but ever since I switched to the TrueNAS/Docker plugin it has worked smoothly. I know a lot of other people also have had good luck with the much lighter Radicale if CalDAV is your primary concern.

znpy 1/7/2026||
> It used to be a constant headache to keep running

It’s been very easy to run for me since version 15 or something. Basically i just use the stock docker image and mount a few files over there. The data folders are bind-mounded directories.

As usual with anything php, it’s only a mess if you start managing php files and folders yourself. Php has a special capability of making these kind of things messy, i don’t know why.

veggieroll 1/7/2026||
> This library was lacking some key features we needed, like server-side collection synchronization

Yes! This is my #1 issue with the library as well.

emersion 1/8/2026|
Library maintainer here. Why not send a PR?
veggieroll 1/8/2026||
I have some patches saved up coming your way once I leave my current employer, who doesn't allow external open source contributions. Though that is not for a few years probably.

Love the libraries BTW. Thank you for all of your hard work.

Nextgrid 1/8/2026||
Why not publish it anonymously?

If there's actual employer IP in there then just leaving said employer wouldn't magically clear it.

If there isn't and you're just trying to avoid red tape, then publishing it anonymously would work around the issue.

veggieroll 1/8/2026||
I feel like it'd be kinda a jerk move to contribute anonymously when you know that might create an IP issue for an open source project. Even if the code truly has no IP issue, legal attention from an litigious company would likely be devastating to even a well resourced project.
Nextgrid 1/9/2026||
Well the idea is that you determine the intention of the “IP issue” and act accordingly:

If there is an actual IP issue then even waiting after you’re out of the company will not resolve said IP issue. If you’re using your employer’s IP then waiting is unlikely (both legally and especially morally) to magically resolve it - it’s still your employer’s IP.

If it’s just to avoid red tape but otherwise the IP is yours and has nothing to do with your employer (aka you could’ve done it just as well even if you weren’t at your current employer, and your employer’s competitive advantage is not based on having a good WebDAV implementation) then it should be fine and you’re just taking a shortcut to save time on both sides.

Basically, if your employer is a vendor of WebDAV libraries, yeah of course there’s a (legal, or a least moral) issue. If not, then all fine.

(Obviously this is just opinion and not legal advice - but legality only matters if they can figure out who did it ;)

veggieroll 1/9/2026||
I think the situation your missing is when the employer has a much much more aggressive stance to IP. Even if you are 100% confident that your contribution doesn't violate your employer's IP, they can still sue and ruin your life.

Some employers have an unbelievably unreasonable interpretation of non-compete and IP. They think they own everything their employees do, and even though they're wrong. That doesn't stop them from ruining you and whatever unfortunate open source project they set their sights on with vexatious litigation.

Nextgrid 1/9/2026||
> they can still sue and ruin your life.

Thus the suggestion to publish anonymously.

veggieroll 1/9/2026||
I think it is unwise for a maintainer to accept anonymous contributions.
BoredPositron 1/7/2026||
WebDAV/CalDAv and CardDAV are a minefield for users and devs. I would love to see something new.
morgan814 1/7/2026||
JMAP[0], which has in-progress specs for calendar and contacts, is supposed to save us. It can't happen soon enough - if it happens at all.

[0] https://jmap.io/spec.html

TuningYourCode 1/7/2026|||
There is at least https://jmap.io/spec-calendars.html just adoption is a bit low for now but I hope it will gain more traction the next years.
n3storm 1/7/2026||
what you mean? a new http extension to access/author resources?