Building a High-Performance Web Server in ARM64 Assembly on macOS

Introduction

In an age where web servers are typically built with high-level languages like Python, Go, or Rust, one developer has taken a radically different approach. Introducing ymawky—a static file web server for macOS written entirely in ARM64 assembly. This project is a testament to low-level programming and demonstrates that even in modern computing, assembly language still has a place. Let's dive into what makes ymawky unique, its feature set, and the challenges of crafting a web server from the ground up in the most fundamental computing language.

Building a High-Performance Web Server in ARM64 Assembly on macOS — Source: hnrss.org

Why Assembly for a Web Server?

Writing a web server in assembly is akin to building a skyscraper with hand tools. It's meticulous, unforgiving, but offers unparalleled control over hardware resources. The developer's motivation? Perhaps to push the boundaries of personal achievement, to understand every byte that flows through the network stack, or simply to give life a lack of meaning (as the original title humorously puts it). Whatever the reason, ymawky showcases that assembly allows for extremely efficient resource usage—every instruction is deliberate, every memory access accounted for.

For macOS running on Apple Silicon (M1, M2, etc.), ARM64 assembly is the native instruction set. By coding directly in assembly, ymawky eliminates the overhead of runtime environments, garbage collection, and operating system abstractions. The result is a lean and potentially very fast server, albeit one that requires significant effort to maintain.

Feature Set of ymawky

Despite being written in assembly, ymawky does not skimp on features. It supports a range of HTTP methods, handles video streaming, and provides security measures. Below is a breakdown of its capabilities.

HTTP Method Support

Ymawky handles GET, PUT, DELETE, HEAD, and OPTIONS requests. This means it can serve files, upload new content, delete existing files, check headers, and inform clients about allowed methods. The inclusion of PUT and DELETE makes it more than a simple static server—it's a basic file management server.

Range Requests for Video Streaming

One standout feature is support for the Range: bytes=X-Y header. This is crucial for video scrubbing—allowing users to seek to any position in a video file without downloading the entire content. When a browser or media player requests a byte range, ymawky responds with only that portion, enabling efficient streaming.

Percent-Encoding Decoding

URLs often contain percent-encoded characters (e.g., %20 for spaces). Ymawky properly decodes these, ensuring that filenames with spaces or special characters are correctly resolved. This is a non-trivial task in assembly, as string manipulation must be done manually.

Document Root Enforcement

Security is paramount for any web server. Ymawky strictly enforces the docroot, meaning it will never serve files outside of the specified root directory. This prevents directory traversal attacks where a malicious user might try to access /etc/passwd via ../../ sequences.

Custom Error Pages

Instead of returning a generic error message, ymawky can serve custom error pages for any HTTP error response. This allows the administrator to present branded or informative pages for 404 Not Found, 403 Forbidden, etc.

Directory Listing

When a request arrives for a directory (without an index file), ymawky can generate an automatic directory listing. This is useful for file sharing or simple web-based file browsers.

Slowloris Attack Mitigations

The server includes some mitigations against slowloris-like attacks. Slowloris works by opening many connections and sending partial HTTP headers, exhausting server resources. While the exact mechanisms are not detailed, any defense in this area is valuable for a server written in assembly.

Security Considerations

Beyond docroot enforcement and slowloris mitigations, writing a web server in assembly introduces both risks and benefits. On one hand, the code is minimal and lacks the bloat of larger software stacks, potentially reducing attack surface. On the other hand, assembly is prone to subtle bugs that are hard to debug. Memory safety is entirely the programmer's responsibility; a single pointer error can lead to crashes or vulnerabilities. Ymawky's author appears to have taken care, but as with any custom server, thorough testing is advised.

Performance and Use Cases

Built for macOS on ARM64, ymawky is likely optimized for Apple Silicon. Assembly code can be extremely fast for simple tasks like reading files from disk and writing to sockets. However, performance gains may be marginal compared to a well-tuned server written in C or Rust, since the bottleneck is often I/O rather than CPU. Still, for educational purposes or for serving static content in low-resource environments, ymawky is a fascinating project.

Use cases include learning ARM64 assembly, experimenting with low-level network programming, or deploying a minimal static file server on a Mac with very specific requirements. It's not intended to replace Apache or Nginx, but it demonstrates what's possible when you go down to the metal.

Conclusion

Ymawky is a remarkable achievement: a fully functional web server written entirely in ARM64 assembly. It supports essential HTTP features, streaming, and security measures. While it may not be practical for production use in most scenarios, it serves as an inspiring example of low-level programming. For those interested, the author's detailed writeup is available at imtomt.github.io/ymawky/. Whether you're an assembly enthusiast or just curious, ymawky offers a glimpse into the discipline and precision required to build even a simple web server from scratch.

Tags: