3 ms·
Golang works well for this application because it can easily cope with very large numbers of idle goroutines. What the author may be missing is that golang als
by gnfargbl 3y ago
Golang works well for this application because it can easily cope with very large numbers of idle goroutines.
What the author may be missing is that golang also works well for bots and scanners, for exactly the same reason. Attackers' time isn't being "wasted" by this, their goroutines are just sitting idle for longer.
- da768 3y agoThough for a large amount of HTTP bots, the authors don't even bother changing the default Python User-Agent. I'd assume a large proportion of these bots still can't run concurrently.
- aesh2Xa1 3y agoI think it still works. You have two scenarios where the attacker is efficiently using goroutines; (1) you also use goroutines or (2) you do not. In the latter, the attack is more expensive for you. Another detail is that an attacker with many idle connections to your host might not instantiate any new ones. Of course, in the scenarios where the attacker is not using goroutines then you have the upper hand as well.
- gnfargbl 3y agoThis isn't a real ssh server, so the "cost" to you of the attack isn't really relevant. You can choose not to run this software at all, and the additional cost to you is zero.