3 ms·
Last time this was discussed: https://news.ycombinator.com/item?id=14192383 https://news.ycombinator.com/item?id=14192383 Still not convinced about the usefuln
by Twirrim 9y ago
Last time this was discussed: https://news.ycombinator.com/item?id=14192383 https://news.ycombinator.com/item?id=14192383
Still not convinced about the usefulness of the source, given the criticisms raised here and there.
- MajesticHobo 9y agoThis guide still has some issues. It's missing common classes of web app vulns I've seen in Go code (e.g. CSRF, SSRF) and has some weird advice here and there (scan uploaded files with AV? Really?)
- wbl 9y agoFail to scan with AV and you might be an unwitting malware distributor.
- MajesticHobo 9y agoIf you allow binary uploads, you're going to be a malware distributor whether you scan or not. AV just introduces complexity and attack surface and doesn't really belong in a guide about Golang secure coding practices.