5 ms·

Every time I see new languages and frameworks being used for web applications I get scared. One reason I am super gung-ho about Golang for an API or website, i

by ejcx 11y ago

Every time I see new languages and frameworks being used for web applications I get scared. One reason I am super gung-ho about Golang for an API or website, is it came with the net httplistener package, html/template package, and has several fairly well made open source packages (and standard packages) for secure sessions, CSRF tokens, output filtering, shelling out, so much more... Without these types of features, people are doomed to build web-apps no more secure than everyone's first, broken, PHP webapp. I'm not sure what the purpose of a truly system's oriented back-end is similar to this[0], it kinda of scares me. Some have mentioned for embedded systems. I don't know if people are using rust in embedded systems yet. But please be aware of just how wild-west writing a full webapp or API with this would be. [0] - http://www.gnu.org/software/libmicrohttpd/ http://www.gnu.org/software/libmicrohttpd/

aikah 11y ago
> One reason I am super gung-ho about Golang for an API or website, is it came with the net http listener package, html/template package, and has several fairly well made open source packages (and standard packages) for secure sessions, CSRF tokens, output filtering, shelling out, so much more... I'd argue that it's not a good thing. net/http is flawed. They either should have done like Nodejs , provide something barebone or provide something with more features. Why provide some embryo of a router(since it supports some form of string pattern matching) without supporting route variables? The result is people go through hoops to try to keep a certain level of compatibility with the default handler signature while trying to add features, and it leads to a galaxy of horrible packages,because net/http is all you need ... no it isn't . > Without these types of features, people are doomed to build web-apps no more secure than everyone's first, broken, PHP webapp. But Go net/http doesn't magically make an app secure either, on the contrary. It doesn't put some CSRF token by magic in your forms, or force tsl , or force strong parameters when de-serializing form data to an entity that has to be persisted in the DB , or come with any kind of extensive data validation framework , or force http only cookies by default ... so it's not much more secure that your first broken PHP webapp ... My point is Go isn't magically more secure nor superior to the things you are "afraid" of.
pcwalton 11y ago
All of the features you mentioned have Rust equivalents in the crates.io ecosystem. So what in particular do you prefer about Go?
- viraptor 11y ago
  What's the CSRF library? I couldn't find one on crates.
  - pcwalton 11y ago
    Yeah, I guess crates.io is missing that one. It should be straightforward to write though.
AgentME 11y ago
But PHP does come with lots of built-in functions for stuff like secure sessions, templates, output filtering, and shelling out! A lot of them aren't really designed well or cohesively, but you could argue that the fact they exist and are bundled with PHP causes people to not look for better third party libraries, which can evolve and not need to eternally keep all old functions for backwards compatibility. (I have a similar complaint about Python. Python has both urllib and urllib2 bundled with it, and neither are that great, but the number of different ways to install 3rd party Python libraries appears to be ridiculous -- pip, distutils, setuptools, virtualenv, easy_install... -- which lead to me just avoiding them and settling for the built-in things when I use Python.) Node has a great package manager for easily using 3rd party libraries, keeping them up-to-date, and avoiding dependency hell between different applications. The package manager is bundled with Node, so all libraries use the same system and people are encouraged to look for (and make) libraries for what they need. Rust also has a recommended package manager: Cargo.
Scarbutt 11y ago
I still haven't found a decent authentication library for Go that you can trust.
- f2f 11y ago
  You'll never find a decent authentication library for any language that I can trust.
  - Scarbutt 11y ago
    If you want to be pedantic about it then sure ;) Show me a well known, battle-tested and mature authentication library for Go? btw, I was just showing the parent that Go doesn't have everything for a secure website/api as he claims and other languages are way ahead of Go for making average Joe programmer write secure web services because of their mature library ecosystem.
threeseed 11y ago
By your own statement why would I bother with Go ? It is equally a new language/framework that is new and hardly used compared to Java, Scala, Ruby, Python etc. All of these have dozens of well made open source packages which will be far more full featured and understood. And for me I would be deferring front end security to the web server layer i.e. Nginx.

by ejcx 11y ago

aikah 11y ago

> One reason I am super gung-ho about Golang for an API or website, is it came with the net http listener package, html/template package, and has several fairly well made open source packages (and standard packages) for secure sessions, CSRF tokens, output filtering, shelling out, so much more... I'd argue that it's not a good thing. net/http is flawed. They either should have done like Nodejs , provide something barebone or provide something with more features. Why provide some embryo of a router(since it supports some form of string pattern matching) without supporting route variables? The result is people go through hoops to try to keep a certain level of compatibility with the default handler signature while trying to add features, and it leads to a galaxy of horrible packages,because net/http is all you need ... no it isn't . > Without these types of features, people are doomed to build web-apps no more secure than everyone's first, broken, PHP webapp. But Go net/http doesn't magically make an app secure either, on the contrary. It doesn't put some CSRF token by magic in your forms, or force tsl , or force strong parameters when de-serializing form data to an entity that has to be persisted in the DB , or come with any kind of extensive data validation framework , or force http only cookies by default ... so it's not much more secure that your first broken PHP webapp ... My point is Go isn't magically more secure nor superior to the things you are "afraid" of.

pcwalton 11y ago

All of the features you mentioned have Rust equivalents in the crates.io ecosystem. So what in particular do you prefer about Go?

viraptor 11y ago
What's the CSRF library? I couldn't find one on crates.
- pcwalton 11y ago
  Yeah, I guess crates.io is missing that one. It should be straightforward to write though.

AgentME 11y ago

But PHP does come with lots of built-in functions for stuff like secure sessions, templates, output filtering, and shelling out! A lot of them aren't really designed well or cohesively, but you could argue that the fact they exist and are bundled with PHP causes people to not look for better third party libraries, which can evolve and not need to eternally keep all old functions for backwards compatibility. (I have a similar complaint about Python. Python has both urllib and urllib2 bundled with it, and neither are that great, but the number of different ways to install 3rd party Python libraries appears to be ridiculous -- pip, distutils, setuptools, virtualenv, easy_install... -- which lead to me just avoiding them and settling for the built-in things when I use Python.) Node has a great package manager for easily using 3rd party libraries, keeping them up-to-date, and avoiding dependency hell between different applications. The package manager is bundled with Node, so all libraries use the same system and people are encouraged to look for (and make) libraries for what they need. Rust also has a recommended package manager: Cargo.

Scarbutt 11y ago

I still haven't found a decent authentication library for Go that you can trust.

f2f 11y ago
You'll never find a decent authentication library for any language that I can trust.
- Scarbutt 11y ago
  If you want to be pedantic about it then sure ;) Show me a well known, battle-tested and mature authentication library for Go? btw, I was just showing the parent that Go doesn't have everything for a secure website/api as he claims and other languages are way ahead of Go for making average Joe programmer write secure web services because of their mature library ecosystem.

threeseed 11y ago

By your own statement why would I bother with Go ? It is equally a new language/framework that is new and hardly used compared to Java, Scala, Ruby, Python etc. All of these have dozens of well made open source packages which will be far more full featured and understood. And for me I would be deferring front end security to the web server layer i.e. Nginx.