News for hackers. Stuff that matters.
Re:Writing web applications using only the Go Standard Library by candiodari on Sunday December 25, 2016 @10:59AM (#13254468)
This is extremely, extremely bad advice. Do NOT run code like this, ever, exposed to anything, not even your own internal network. This is just ridiculously risky.

This gets you code generating html pages. It doesn't store anything. It doesn't do anything. It doesn't create any relation between any data and what is on screen. It stores things extremely insecurely (it can probably overwrite the application serving this with random binary data, trivial to privilege escalate (just overwrite the application itself)). It's slow, no caching layer, no ... It can't work, really, without tons of extra code. And it doesn't support all sorts of necessities of today's web apps. No auth, no users, no client identification, not even bloody cookies (although yes, all of those are doable with extra code). There's nothing in front of the application, allowing you to serve multiple applications.

This does:

    filename := title + ".txt"
    body, err := ioutil.ReadFile(filename)
(with filename taken directly from the url. It then proceeds to ignore any error upon loadPage return ... well done !)

(I love how the code making an extreme security error of using unchecked pathnames includes a discussion about exactly what permissions to use in the open call to open that file. Talk about missing the forest for the trees)

Just found a way to crash the application : just upload an invalid template, because the error is ignored on the template parsing, which can NULL the pointer the template, which will panic the app upon rendering the template. Hell, you're pretty much bound to do that by accident.

Please, people: DO NOT run code like this, unless you want to run a bitcoin miner for someone else, an illegal file mirror, or worse. For the love of God, do NOT give code on the same server any payment details for your web app and do NOT run this behind a firewall, or within your amazon virtual private cloud.

This brings back the very bad old days of C code serving webpages: so exploitable you're bound to exploit it by accident (ie. crash it). And it doesn't even have the good parts of the old C code : this thing uses introspection, which will make rendering templates about as fast as in python or ruby.

Re:Writing web applications using only the Go Standard Library by banku_brougham on Thursday January 05, 2017 @03:44PM (#13331219)
can anyone else comment here on the stated un-safety of using this web app tutorial? I have no idea, but it seems like a good tutorial and it is posted on the official golang.org site. Can it be as bad as candiodari says?
Re:Writing web applications using only the Go Standard Library by JacksonGariety on Monday December 26, 2016 @04:54AM (#13257681)
Just started with go ~5 days ago and I can confirm that after reading all the example/tutorial/gettingstarted posts this is a serious problem with standard golang. Error handling is seriously tedious.