3 ms·
Go does bounds checking and doesn't have dangling pointers, so it's inherently safe from buffer overflows. You don't have to run Caddy as root in production, e
by mholt 7y ago
Go does bounds checking and doesn't have dangling pointers, so it's inherently safe from buffer overflows.
You don't have to run Caddy as root in production, even to bind to low ports. (None of my sites do.) https://memorysafety.fail https://memorysafety.fail for more info on memory unsafety.
- vinaypai 7y agoThank you for your condescending reply. I understand Go's memory model quite well (and have used Go quite a bit). News flash: you can have bugs of other kinds besides buffer overflows.
- mholt 7y agoEr, sorry, I wasn't being condescending. I intended to clarify some relevant facts, please don't take it personally. You had said: > Go's memory safety isn't some kind of automatic security guarantee... But in some cases, it is. I'm not claiming more than that, nor am I saying that you can't have "bugs of other kinds" -- on which point I agree with you.
- vinaypai 7y ago> Er, sorry, I wasn't being condescending. I intended to clarify some relevant facts, please don't take it personally. Fair enough, it's easy to misunderstand the intended tone in online comments.