News for hackers. Stuff that matters.
Re:Golang SSH Security by TheDong on Saturday April 15, 2017 @03:50PM (#14122485)
This isn't the standard library though, and if it were then it wouldn't have been changed.
Re:Golang SSH Security by bradfitz on Saturday April 15, 2017 @08:19PM (#14123637)
We have broken compatibility once before in the standard library for security reasons. The go1compat doc says we're allowed to:

https://golang.org/doc/go1compat

> Security. A security issue in the specification or implementation may come to light whose resolution requires breaking compatibility. We reserve the right to address such security issues.

Re:Golang SSH Security by mbertschler on Saturday April 15, 2017 @05:17PM (#14122910)
I didn't want to imply that. I meant that this kind of fix is a good reason to break something, and I am happy that they quickly reacted to this issue, and don't change everything all the time even though it is in the x/ packages and not covered by the standard library stability promise.

In general I am very happy that the big emphasis on a stable APIs was taken up by the community, and that we have a lot of stable packages out now (even though they might not be 100% stable like the standard library). Since I also have to work with NodeJs where changing APIs and packages are much more common, I came to really appreciate that fact about the ecosystem.

Re:Golang SSH Security by syscomet on Saturday April 15, 2017 @06:46PM (#14123256)
It's a special case though. The golang.org/x/ packages are experimental but also candidates for promotion to the standard library. Eg, "context".

But this sort of issue is exactly the sort of real-world review and hardening which justifies having a namespace for stuff to go _before_ it becomes stdlib.

Re:Golang SSH Security by kardianos on Saturday April 15, 2017 @11:35PM (#14124194)
No, x repos are just eXtra.

/x/exp is expiramental.