> If I program in C, I need to defend against the compiler maintainers.
> If I program in Go, the language maintainers defend me from my mistakes.
> If you’re choosing software to deploy on your systems, which language would you rather that the vendors be writing in?
I think this is my favorite take-away. I spend a lot of time programming in Ruby, where more than a few parts of the standard library declare themselves to be security vulnerabilities, but there are no code-level protections to warn a programmer. I'm thinking specifically about FileUtils.rm_r, and all the various stdlib serialization modules that provide one or more ways to eval() when loading data. Is it YAML.load(x) or YAML.parse(x).to_ruby that's safe? I use YAML.safe_load, but how can I trust third-party libraries when the stdlib makes this SO EASY to get wrong?
+1 for the Golang maintainers and Go's approach here. Another reason to use Go...
> If I program in Go, the language maintainers defend me from my mistakes.
> If you’re choosing software to deploy on your systems, which language would you rather that the vendors be writing in?
I think this is my favorite take-away. I spend a lot of time programming in Ruby, where more than a few parts of the standard library declare themselves to be security vulnerabilities, but there are no code-level protections to warn a programmer. I'm thinking specifically about FileUtils.rm_r, and all the various stdlib serialization modules that provide one or more ways to eval() when loading data. Is it YAML.load(x) or YAML.parse(x).to_ruby that's safe? I use YAML.safe_load, but how can I trust third-party libraries when the stdlib makes this SO EASY to get wrong?
+1 for the Golang maintainers and Go's approach here. Another reason to use Go...