hellerve

Didn’t necessarily think you were saying that, but everyone’s looking for an easy excuse with security problems, so best we can do is hit them with the ol' “it depends" :)

Great article, by the way, thank you!

This feels very AI-slop-y, and the green username comments are triggering my spidey senses, but maybe I’m just getting old and grumpy?

That was quite fun, and I enjoyed the data mining aspect of it. Quite edifying, thanks!

i’d argue against just saying "An adversary with write access to files on your machine has better things to do than tamper with your Go cache — by rational choice, they’ll steal your secret keys instead." because that’s only true if I have access to both. If I only have access to the cache, I might use that capability to get a chain into the next level going etc.

I’m not saying that "a poisoned Go cache" should necessarily be part of everyone’s threat model, but I’d also not just dismiss it by saying "well, it requires disk access". Either might be wrong, depending on your situation.