News for hackers. Stuff that matters.

A comment on Go 1.18 will embed source version information into binaries. Parent comment

Re:Go 1.18 will embed source version information into binaries by melony on Wednesday October 27, 2021 @11:36AM (#29014692)
Maybe we should have a specific .metadata section in assembly so we can ignore the timestamps when diffing for reproducible code.
[ Parent | on HN ]
Re:Go 1.18 will embed source version information into binaries by majewsky on Thursday October 28, 2021 @05:50AM (#29024131)
If we allow that, attackers could hide a codepath in the binary that only activates for a specific build time in the .metadata section. That would defeat the purpose of reproducible builds.
[ Parent | on HN ]
Re:Go 1.18 will embed source version information into binaries by WGH_ on Thursday October 28, 2021 @03:03PM (#29030158)
That's an interesting scenario for sure, but "defeats the purpose" is a stretch.
[ Parent | on HN ]
Re:Go 1.18 will embed source version information into binaries by melony on Thursday October 28, 2021 @11:23AM (#29027168)
Make it non-readable for the program.
[ Parent | on HN ]