MatthiasDev

Joined 3 years ago

Karma

Submissions

Member since

Jun 23

Recent submissions

A big thing is that Go does not install the latest version of transitive dependencies. Instead it uses Minimal version selection (MVS), see https://go.dev/ref/mod#minimal-version-selection. I highly recommend reading the article by Russ Cox mentioned in the ref. This greatly decreases your chances of being hit by malware released after a package is taken over.

In Go, access to the os and exec require certain imports, imports that must occur at the beginning of the file, this helps when scanning for malicious code. Compare this JavaScript where one could require("child_process") or import() at any time.

Personally, I started to vendor my dependencies using go mod vendor and diff after dependency updates. In the end, you are responsible for the effect of your dependencies.

Comment · 2 years ago

Because browsers can require certificates to be in the certificate transparency logs to be valid. Chrome already does this. If a government convinces a CA to create a malicious certificate and publishes this cert to the CT logs to perform MITM, it will get found out and that CA can close its doors.

Comment · 3 years ago

Type reflection with TypeScript is fairly limited at the moment, though what you are describing can be done with decorators.

I have made such a library myself: https://github.com/decoverto/decoverto

Another library would be https://github.com/typestack/class-transformer