Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

On Go’s Web Application Ecosystem

thechangelog.com

Post reply on HN
Print view View original

1–10 of 50 posts

Re: On Go’s Web Application Ecosystem

#4

Post by jerf »

valevk wrote: post #2

I think Go is still missing its killer-web-app-framework. But maybe it's better that way. Keeps out the people who don't like think before they code.

Most people seem to define killer-web-app-framework to include a "blessed" ORM solution. (I don't personally, but I understand where people are coming from.) Go seems to have been resistant to any large-scale ORMs to date; it's hard to put why into a quick HN post, but the language seems to sort of resist it, despite having some reflection capabilities.

Or at least, the language resists the sort of ORMs that the web world has become accustomed to, with tons of convention-over-configuration and such. A more static one could probably be done.

I find myself wishing the "go" toolchain would give me a defined way of running certain code before the compiler, so I could generate Go code with the go source tools. From there you could easily compile yourself up some ORM code by examining a database at runtime. It's yet another privilege it claims for itself but gives you no way to hook into.

Re: On Go’s Web Application Ecosystem

#5

Post by tootie »

jerf wrote: post #4
valevk wrote: post #2

I think Go is still missing its killer-web-app-framework. But maybe it's better that way. Keeps out the people who don't like think before they code.

Most people seem to define killer-web-app-framework to include a "blessed" ORM solution. (I don't personally, but I understand where people are coming from.) Go seems to have been resistant to any large-scale ORMs to date; it's hard to put why into a quick HN post, but the language seems to sort of resist it, despite having some reflection capabilities. Or at least, the language resists the sort of ORMs that the web…

I've become a real fan of Flask and the core framework does very little beyond managing request routing and having a simple framework for using jinja templates. Everything else should be optional. My day job is Spring MVC which is an absolute behemoth. It's an application framework more than just a web framework and the plethora of gadgets are useful for alleviating a lot of architecture decisions, but I'm sure I could get by without them.

Re: On Go’s Web Application Ecosystem

#7

Post by buro9 »

One thing I'd like to see in Go is a way to sanitise HTML based on a whitelist.

This is to accompany blackfriday (Markdown) and text/template (templating).

Markdown permits HTML, and this allows some scope for nasty stuff to get in, or for bugs that may exist in blackfriday to be exploited leading to HTML that could be the source of a XSS attack.

We're currently running our user generated content through this: https://github.com/microcosm-cc/cleanse and more specifically this: https://github.com/microcosm-cc/cleanse/blob/master/src/main...

Which is a set of rules for OWASPs HTML sanitizer: https://code.google.com/p/owasp-java-html-sanitizer/

This works extremely well, except for the fact that it means in our Go code we're calling out to a process and asking for a Java process to be kicked up for each request.

If no-one beats us to it we'll be porting that to Go... but for us it remains a "When we need to" from a scaling or performance perspective.

Still... we'd love to see group work on a whitelist based sanitiser that we can contribute to rather than us go and write our own at some indeterminate point in the future.

Re: On Go’s Web Application Ecosystem

#8

Post by throwmeaway2525 »

valevk wrote: post #2

I think Go is still missing its killer-web-app-framework. But maybe it's better that way. Keeps out the people who don't like think before they code.

This article seems to be pushing Martini, which at first glance looks interesting (though it doesn't appear to have been mentioned on the mailing list even once, so there may be some boosting involved).

There is Revel, but it seems to be getting a bad rap ("non-idiomatic" label used as a stick).

Post reply on HN