3 ms·

I am a bit worried about accepting software from vendors written in Go given those circumstances. For example, the recent OpenSSL patches would be an example.

I am a bit worried about accepting software from vendors written in Go given those circumstances. For example, the recent OpenSSL patches would be an example. Are the Go programs fine if I update OpenSSL or did they include OpenSSL's libraries statically? If someone writes a Go replacement for OpenSSL does that change the scenario. Given a lot of software makes it to my door written by government contractors for grant management / compliance, I don't have the source code.

skybrian 11y ago
Go has its own crypto library that's maintained by a real crypto expert so that might not be the best example. Still, if they do find a bug, there will be a new release of Go and you (or your supplier) should be prepared to recompile. Running unmaintainable, unfixable binaries may be standard practice in other places but for Go it's not really viable. It's a different culture with different practices.
- protomyth 11y ago
  > Running unmaintainable, unfixable binaries may be standard practice in other places but for Go it's not really viable. It's a different culture with different practices. Well, since I cannot just patch a library, I am a lot more worried about the implications of Go programs being the "unmaintainable, unfixable binaries".