News for hackers. Stuff that matters.
Re:Show HN: Securely Handle Encryption Keys in Go by libeclipse on Saturday April 22, 2017 @02:51PM (#14174064)
I've been meaning to implement libsodium's sodium_memzero instead of zeroing out. It's next on the Agenda.
Re:Show HN: Securely Handle Encryption Keys in Go by stouset on Saturday April 22, 2017 @04:28PM (#14174561)
Hey there! Thanks for building this. I hate to rain on your parade, but your approach, unfortunately, won't work as currently written[1]. You have to manage the memory yourself.

https://news.ycombinator.com/item?id=14174500

Re:Show HN: Securely Handle Encryption Keys in Go by libeclipse on Saturday April 22, 2017 @05:22PM (#14174885)
Hey there stouset! I've read your comments and I thank you for the tips you've given. I do realise that there are a lot of things that I have missed, and I plan on having them fixed soon.

I definitely will be managing memory myself. The project is in very early stages at this point, just in v0.1.0 right now.

Re:Show HN: Securely Handle Encryption Keys in Go by eropple on Saturday April 22, 2017 @05:35PM (#14174955)
I'm not trying to pick on you or discourage you, but "just v0.1.0" doesn't excuse that it doesn't work. Whether they should or not, people trust projects like this because they, too, don't have the capability to evaluate whether or not this works. I wouldn't expect potential consumers to understand that Go's garbage collector makes this a nonviable approach any more than this project currently does.

Right now, this is a primed hand grenade of a project. You should disclaim its insecurity at the top of the README. Be very, very specific that it is not currently functional and discourage anyone from using this until it is functional.

Re:Show HN: Securely Handle Encryption Keys in Go by eropple on Saturday April 22, 2017 @10:56PM (#14176202)
And to be clear, saying "don't use it in production" isn't the same thing as saying it doesn't work at all. Your change is irresponsible, because it doesn't work at all.
Re:Show HN: Securely Handle Encryption Keys in Go by slrz on Saturday April 22, 2017 @03:11PM (#14174175)
I don't think it's worth it to add a cgo dependency to the package. Maybe write a set of assembly functions? The compiler can't omit calls to them and there isn't much more you can do anyway than to zero the memory.