Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Programs written in Golang have no secrets

gopacker.dev

Post reply on HN
Print view View original

1–10 of 38 posts

Re: Programs written in Golang have no secrets

#3

Post by golergka »

bruxis wrote: post #2

> This tool is only for legitimate programs only. It is strictly forbidden to use it for any malicious programs. I'm sure the authors of malicious software will be certain to respect this clause

What about legitimate programs that are created to help legitimate penetration testers? And are forbidden from being used by people with malicious intent.

Re: Programs written in Golang have no secrets

#4

Post by djbusby »

I thought this was gonna be about how it's hard to keep secrets out of memory in a GC language. I had a friend working with Go and was surprised that on some heap-dump there was some secret-key they did not want exposed. So you have to set some ENV var (GOGC) so it clears faster.

Re: Programs written in Golang have no secrets

#5

Post by michaelcampbell »

bruxis wrote: post #2

> This tool is only for legitimate programs only. It is strictly forbidden to use it for any malicious programs. I'm sure the authors of malicious software will be certain to respect this clause

This reminds me of the once-often used phrase on CraigsList: "No scammers"

I mean, why even put that there?

Re: Programs written in Golang have no secrets

#7

Post by planede »

djbusby wrote: post #4

I thought this was gonna be about how it's hard to keep secrets out of memory in a GC language. I had a friend working with Go and was surprised that on some heap-dump there was some secret-key they did not want exposed. So you have to set some ENV var (GOGC) so it clears faster.

Reducing the time a secret lingers in memory is at best a mitigation. Linux has MADV_DONTDUMP for the madvise system call to exclude certain pages from core dumps. I'm not sure if something like this could be available in golang, preferably wrapped in some platform-agnostic way.

Re: Programs written in Golang have no secrets

#8

Post by klabb3 »

michaelcampbell wrote: post #5
bruxis wrote: post #2

> This tool is only for legitimate programs only. It is strictly forbidden to use it for any malicious programs. I'm sure the authors of malicious software will be certain to respect this clause

This reminds me of the once-often used phrase on CraigsList: "No scammers" I mean, why even put that there?

It makes a bit of sense. Some scammers target the extremely naive, who don’t even know there are scams. Those scammers might skip such victims to save time. These days, when scamming is so automated I doubt it makes a difference.

Re: Programs written in Golang have no secrets

#9

Post by djbusby »

planede wrote: post #7
djbusby wrote: post #4

I thought this was gonna be about how it's hard to keep secrets out of memory in a GC language. I had a friend working with Go and was surprised that on some heap-dump there was some secret-key they did not want exposed. So you have to set some ENV var (GOGC) so it clears faster.

Reducing the time a secret lingers in memory is at best a mitigation. Linux has MADV_DONTDUMP for the madvise system call to exclude certain pages from core dumps. I'm not sure if something like this could be available in golang, preferably wrapped in some platform-agnostic way.

Oh yea. They moved on from Go and are now fiddling w/Rust. Kinda laughed at me when I said: just use C.

Re: Programs written in Golang have no secrets

#10

Post by reportgunner »

jchw wrote: post #6

FYI, you have a small typo in the gopacker.dev URL in the docs here: https://gopacker.dev/docs/#how-to-use > Download gopacker from https://gopcker.dev

Also right below that in title of step 3. - says pakcing instead of packing

3. Pakcing the programs with gopacker

Post reply on HN