Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Programs written in Golang have no secrets

gopacker.dev

Post reply on HN
Print view View original

11–20 of 38 posts

Re: Programs written in Golang have no secrets

#11

Post by Thaxll »

djbusby wrote: post #4

I thought this was gonna be about how it's hard to keep secrets out of memory in a GC language. I had a friend working with Go and was surprised that on some heap-dump there was some secret-key they did not want exposed. So you have to set some ENV var (GOGC) so it clears faster.

I don't see a difference between GC languages and others, so your secret is in a rust heap then what?

Every language have their memory exposed, GC has nothing to do with it.

Re: Programs written in Golang have no secrets

#14

Post by 65a »

djbusby wrote: post #4

I thought this was gonna be about how it's hard to keep secrets out of memory in a GC language. I had a friend working with Go and was surprised that on some heap-dump there was some secret-key they did not want exposed. So you have to set some ENV var (GOGC) so it clears faster.

Go has a clear() function now, but I haven't checked to see how it actually behaves in terms of secret abatement in memory. https://tip.golang.org/ref/spec#Clear

Re: Programs written in Golang have no secrets

#15

Post by blindman »

reportgunner wrote: post #10
jchw wrote: post #6

FYI, you have a small typo in the gopacker.dev URL in the docs here: https://gopacker.dev/docs/#how-to-use > Download gopacker from https://gopcker.dev

Also right below that in title of step 3. - says pakcing instead of packing 3. Pakcing the programs with gopacker

and in the "Packing golang programs" section, digital is spelled incorrectly

> After processing by our tool, 6 engines reported the program as malicious when without signing by *digigal* certificate.

Re: Programs written in Golang have no secrets

#16

Post by slooonz »

bruxis wrote: post #2

> This tool is only for legitimate programs only. It is strictly forbidden to use it for any malicious programs. I'm sure the authors of malicious software will be certain to respect this clause

It’s a way of saying "I decline any responsibility if anyone uses this tool for malicious purposes".

Re: Programs written in Golang have no secrets

#17

Post by weinzierl »

planede wrote: post #7
djbusby wrote: post #4

I thought this was gonna be about how it's hard to keep secrets out of memory in a GC language. I had a friend working with Go and was surprised that on some heap-dump there was some secret-key they did not want exposed. So you have to set some ENV var (GOGC) so it clears faster.

Reducing the time a secret lingers in memory is at best a mitigation. Linux has MADV_DONTDUMP for the madvise system call to exclude certain pages from core dumps. I'm not sure if something like this could be available in golang, preferably wrapped in some platform-agnostic way.

Also mlock to prevent the memory page being written to disk and make sure to properly overwrite the secret data once you no longer need it. Make sure this doesn't get optimized away.

libsodium has functions for all of that. Rust has the "secrets" crate that is a wrapper around these.

I don't know much Go, but a quick search looks like it has libraries that take care of these things as well - unsurprisingly.

Re: Programs written in Golang have no secrets

#20

Post by jetti »

bruxis wrote: post #2

> This tool is only for legitimate programs only. It is strictly forbidden to use it for any malicious programs. I'm sure the authors of malicious software will be certain to respect this clause

I would imagine that it is there in order to protect themselves if someone uses their tool for malicious purposes as they can point to that statement and say they were not complicit.
Post reply on HN