3 ms·
Seems useful, but I'm not really sure how it reports. If you write a web server (and that's what a lot of go programs are), quite a few packages will have netwo
by tgv 3y ago
Seems useful, but I'm not really sure how it reports. If you write a web server (and that's what a lot of go programs are), quite a few packages will have network and file access capabilities. How can I find out which ones are unwanted?
- tgv 3y agoI've checked its output on my server application, and it's a bit hard to get something useful out of it. E.g., it seems to label anything unsafe as CAPABILITY_ARBITRARY_EXECUTION, which includes json-iterator. However, it doesn't say so, it says it at every point where a path to json-iterator starts, and the path ends in some other package. So you have to inspect each of these messages and find out which package is "really" responsible. However, the output is 200k lines. That's longer than my program. And even if I crawl through all messages, it won't help me when the libraries update. So, this may be a step towards safety, but it's not a very practical one.