6 ms·

This is a much better solution, I think. Uploading your source code is often easier than uploading your binaries. If, for example, you have a new contributor yo

This is a much better solution, I think. Uploading your source code is often easier than uploading your binaries. If, for example, you have a new contributor you don't yet trust creating a cloud function in Go and you know enough Go to review the code, but it's not convenient for you to compile it yourself, you can just upload the code yourself. You can't easily review the binary.

vira28 8y ago
If i understand correctly the binary is created from the source code right. Am i missing anything?
- benatkin 8y ago
  On AWS Lambda, which has had Go support for almost a year now, you upload the binary, which you create from the source code on your own system, using the go compiler. On Google Cloud Functions, you upload the source code and Google's servers build it.
st3fan 8y ago
I don't really understand what you are saying here .. It should not be difficult to run `go build` locally and then tell a tool to upload `foobar` instead of `main.go`. Uploading source code is a dealbreaker for me because I do not trust Google or myself. Google probably has language in their terms that they may do whatever they want with anything you upload to them. I also do not trust myself to properly configure security parameters around this with the risk of leaking source code. Binaries are a great strength of Go. Too bad this platform doesn't use them. I will take a peek at the new Container platform that they are building, but that sounds more heavyweight, which probably comes with a higher price. (I have not seen any actual pricing)
- nikki93 8y ago
  can't your security params be read out of the binary in any case? i'm not sure how binaries offer more security.
  - weberc2 8y ago
    His post is super unclear but I think he is concerned about someone getting their hands on his source code. In general, a compiled Go binary is not trivial to reverse engineer, so there’s some security through obscurity there.
    - st3fan 8y ago
      Not 'someone'. Google.
      - nikki93 8y ago
        Your secrets are not safe by embedding them in a binary. Compilation is not (necessarily, and at least so in the Go compiler's case) security...
    - saagarjha 8y ago
      Not a whole lot, though. A determined reverse engineer will likely be able to grab something close to your source code without much difficulty, assuming you haven't applied any wacky obfuscation.
omeid2 8y ago
Your code review and deployment pipeline should be all automated from day zero. Setting up a CI pays off in the first couple of days in terms of time investment and massive returns on longer term mostly for avoiding human error and confusions that ensues.
- benatkin 8y ago
  I didn't say that you don't need CI. I use CI regularly, and I think it's best for CI to be for testing, and to minimize the build artifacts except those used for test results. A lot of developers have this preference for client side code. Since the early days heroku has been building the client side bundles for rails.
  - weberc2 8y ago
    The parent’s point was that contributors shouldn’t have permissions to upload binaries; they only commit source code and your CI infrastructure compiles, releases, and deploys it.
- solatic 8y ago
  CI is a continuous integration tool. There are inherent latencies to committing, pushing, deploying to AWS, running tests. Mature development tooling, if it's not REPL-based, will at least allow a local debugger to step through the code compiled/run locally, without these remote latencies. Both tools are necessary for fast engineering, but in different contexts.
skywhopper 8y ago
The fact that it's easier to do things this way just shows how immature the toolchain surrounding serverless development is. It shouldn't be difficult to simulate the serverless environment on a workstation, and yet somehow that's a huge gap, even for Lambda.
- benatkin 8y ago
  Fair enough, but I don't think it's wrong to want a PaaS/FaaS that automagically compiles things. You'll be hard pressed to convince anyone who genuinely likes this approach to switch over to having their IDE, developer tools, or CI do it.
- ricktdotorg 8y ago
  the Cloud Functions emulator works well, and helps https://cloud.google.com/functions/docs/emulator https://cloud.google.com/functions/docs/emulator
- rakoo 8y ago
  Then again, what's the point of controlling your own repository of binaries if their only goal in life is to be deployed somewhere else anyway ? It's much easier to just cut the middleman.

vira28 8y ago

If i understand correctly the binary is created from the source code right. Am i missing anything?

benatkin 8y ago
On AWS Lambda, which has had Go support for almost a year now, you upload the binary, which you create from the source code on your own system, using the go compiler. On Google Cloud Functions, you upload the source code and Google's servers build it.

st3fan 8y ago

I don't really understand what you are saying here .. It should not be difficult to run `go build` locally and then tell a tool to upload `foobar` instead of `main.go`. Uploading source code is a dealbreaker for me because I do not trust Google or myself. Google probably has language in their terms that they may do whatever they want with anything you upload to them. I also do not trust myself to properly configure security parameters around this with the risk of leaking source code. Binaries are a great strength of Go. Too bad this platform doesn't use them. I will take a peek at the new Container platform that they are building, but that sounds more heavyweight, which probably comes with a higher price. (I have not seen any actual pricing)

nikki93 8y ago
can't your security params be read out of the binary in any case? i'm not sure how binaries offer more security.
- weberc2 8y ago
  His post is super unclear but I think he is concerned about someone getting their hands on his source code. In general, a compiled Go binary is not trivial to reverse engineer, so there’s some security through obscurity there.
  - st3fan 8y ago
    Not 'someone'. Google.
    - nikki93 8y ago
      Your secrets are not safe by embedding them in a binary. Compilation is not (necessarily, and at least so in the Go compiler's case) security...
  - saagarjha 8y ago
    Not a whole lot, though. A determined reverse engineer will likely be able to grab something close to your source code without much difficulty, assuming you haven't applied any wacky obfuscation.

omeid2 8y ago

Your code review and deployment pipeline should be all automated from day zero. Setting up a CI pays off in the first couple of days in terms of time investment and massive returns on longer term mostly for avoiding human error and confusions that ensues.

benatkin 8y ago
I didn't say that you don't need CI. I use CI regularly, and I think it's best for CI to be for testing, and to minimize the build artifacts except those used for test results. A lot of developers have this preference for client side code. Since the early days heroku has been building the client side bundles for rails.
- weberc2 8y ago
  The parent’s point was that contributors shouldn’t have permissions to upload binaries; they only commit source code and your CI infrastructure compiles, releases, and deploys it.
solatic 8y ago
CI is a continuous integration tool. There are inherent latencies to committing, pushing, deploying to AWS, running tests. Mature development tooling, if it's not REPL-based, will at least allow a local debugger to step through the code compiled/run locally, without these remote latencies. Both tools are necessary for fast engineering, but in different contexts.

skywhopper 8y ago

The fact that it's easier to do things this way just shows how immature the toolchain surrounding serverless development is. It shouldn't be difficult to simulate the serverless environment on a workstation, and yet somehow that's a huge gap, even for Lambda.

benatkin 8y ago
Fair enough, but I don't think it's wrong to want a PaaS/FaaS that automagically compiles things. You'll be hard pressed to convince anyone who genuinely likes this approach to switch over to having their IDE, developer tools, or CI do it.
ricktdotorg 8y ago
the Cloud Functions emulator works well, and helps https://cloud.google.com/functions/docs/emulator https://cloud.google.com/functions/docs/emulator
rakoo 8y ago
Then again, what's the point of controlling your own repository of binaries if their only goal in life is to be deployed somewhere else anyway ? It's much easier to just cut the middleman.