Re:Leaving Beta, New Sponsors
by Titanous on Tuesday April 12, 2016 @01:58PM
(#11481915)
There are a bunch of great unofficial clients, several written in Go (I like acmetool): https://www.metachris.com/2015/12/comparison-of-10-acme-lets...
[ Parent
| on HN ]
Unfortunately lots of Go code on GitHub has significant oversights, this included. I remember reporting a DoS bug in a different Go acme library identical to this one I found in acmetool in less than 60s:
https://github.com/hlandau/acme/blob/master/acmeapi/ocsp.go#...
In case it is not obvious, anyone in a privileged point on the network can fill resb with enough data that the program panics due to OOM and crashes. ioutil.ReadAll really needs a big warning in the docs because I have seen this pattern far too often.