3 ms·

I wasn't emphasising, I was quoting a hypothetical developer yelling in frustration because he just wants to write a safe web app and people keep talking about

• tptacek 10y ago
  Again, the guidelines ask you not to do that at all, so regardless of the intention, please don't. Your hypothetical developer has 3 options: (1) Accept the Golang defaults. They might be exposed to one more in a very long series of possible compute DOS vectors, due to the fact that curves other than P-256 aren't assembly optimized in Go. (2) Do what most prod networks do and run the Go app server behind an nginx reverse proxy. This is probably the right architecture regardless. (3) Change the SSL configuration to allow only P-246 and Curve25519, like the article suggests. Option (1) with respect to curves is just fine for virtually everybody. There's really no issue here.