4 ms·
"Go has its own SSL library, crypto/tls, which is not linked to any C libraries and wasn't affected by Heartbleed 1.0." Is it going to be affected by Heartblee
by s73v3r 11y ago
"Go has its own SSL library, crypto/tls, which is not linked to any C libraries and wasn't affected by Heartbleed 1.0."
Is it going to be affected by Heartbleet 2.0? How about whatever the next exploit is?
"The argument is specious anyway, there's nothing difficult about building a binary from an old version of your code or just upgrading in most cases."
Not in every case, and not for customers who don't have access to the code.
- eropple 11y agoI'm not even particularly worried about applications to which I don't have code access. I'm worried about getting off my OS's upgrade track because the minor version of the application I've verified to be usable and correct in my environment is no longer the one I'm going to have because a vendored dependency was upgraded during a release of the application itself rather than as an independent, dynamically linked library.
- serge2k 11y agoNo, it will just have its own vulnerabilities instead.