Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Security consultant here.

The fact that Golang has no generic is a huge thing. I've read countless amount of code that abused generics (unfortunarely developers think they have to use generics all the time if they are available) and is probably completely insecure for the simple reason that very few people manage to audit/understand the code. If it generics could only be used when necessary, yes, but there are no technical way to enforce this.

Gofmt is the second blessing. All codebases look the same because it is not customizable. This makes reading Golang code and understanding it fast as hell.

The GOPATH is also a huge win. You always know where everything is and it is really fast to figure out about dependencies or structure of the project.

What I'm saying is that in my years of security consulting, Golang codebases have always been the clearest ones to read and have always been the most secure ones.

I feel like a lot of the negative perspectives are given from the writing point of view, but the reading perspective is clearly a huge win for Golang.



> The GOPATH is also a huge win. You always know where everything is and it is really fast to figure out about dependencies or structure of the project.

I ... have some bad news.


You probably don't. You can still use gopath and choose to use gopath for another project that doesn't.


> You always know where everything is

do you always work on projects in which you made every decision?


sorry, what I meant is that if you're working on a project not using GOPATH, you can still choose to place it in GOPATH while you audit the code.


What's the bad news?


"you always know where everything is" is no longer true.

https://github.com/golang/go/wiki/Modules


Modules can still use GOPATH. If you have GOPATH defined when working with modules, they will be installed into the GOPATH in the pkg/mod/ directory.


I can feel you there, Generics can become unwieldy especially when you're nesting several different generic types.

Can you tell me if you have found any kind of security issue relating to interfaces and reflect(ion) ?


Never, but it's probably because abstractions hid all the bugs.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: