31–38 of 38 posts
I thought this was gonna be about how it's hard to keep secrets out of memory in a GC language. I had a friend working with Go and was surprised that on some heap-dump there was some secret-key they did not want exposed. So you have to set some ENV var (GOGC) so it clears faster.
Go has a clear() function now, but I haven't checked to see how it actually behaves in terms of secret abatement in memory. https://tip.golang.org/ref/spec#Clear
Where do all the symbols come from if the binary has been stripped? Does go add its own proprietary symbol table sections to go binaries?
I don't see the author stripping any binaries. (And features of Go assume the binary is not stripped, too. The symbol table is useful!)
> And this program has used -ldflags "-s -w" to remove the debug information and symbol information when compiling, which shows that if no processing is done for the program written in golang, there will be no secrets at all.
Though perhaps those flags were just not effective. Maybe Go places it's own stuff after the user-specified flags, or maybe they're only used in cgo mode?
Edit: https://words.filippo.io/shrink-your-go-binaries-with-this-o...
It retains the symbols needed to format stack traces, so most symbols remain. So go-link's "-s" is rather different from how normal linkers interpret "-s" (don't link symbols or debug information, functionally equivalent to strip(1)).
Earlier quoted context omitted.
Why would the company relying on scarcity of knowledge they deem "trade secrets" to gather revenue instead of directly being productive? Expecting unbounded ongoing revenue from a constant amount of work they did once to describe the "trade secrets" into code is extractive and doesn't incentivize future productivity.
It’s still a valid strategy and it makes sense in the current economic system.
Earlier quoted context omitted.
I don't see the author stripping any binaries. (And features of Go assume the binary is not stripped, too. The symbol table is useful!)
> Here is an application written with golang, decompiled with IDA 8.3 Pro, we can see that IDA not only restores all the function names , but also restores the business code with good readability. > And this program has used -ldflags "-s -w" to remove the debug information and symbol information when compiling, which shows that if no processing is done for the program written in golang, there will be no secrets at al…
Earlier quoted context omitted.
I don't see how a small company with actual know how can protect their trade secrets otherwise. Software patents and other legal means seem much worse to me than trying to obfuscate trade secrets. Going open source is not a viable solution for most companies either.
Why would the company relying on scarcity of knowledge they deem "trade secrets" to gather revenue instead of directly being productive? Expecting unbounded ongoing revenue from a constant amount of work they did once to describe the "trade secrets" into code is extractive and doesn't incentivize future productivity.
> This tool is only for legitimate programs only. It is strictly forbidden to use it for any malicious programs. I'm sure the authors of malicious software will be certain to respect this clause