Major standard library changes in Go 1.20

Re:Major standard library changes in Go 1.20 by Arbortheus on Tuesday January 17, 2023 @03:09AM (#34410206)

One of my favourite Go security features is the single binary output, it means I can build my binaries into a distroless base image container for running in K8S. It removes a huge attack and vulnerability surface that containers introduce.

My team uses Go whereas the rest of the company heavily uses Python. Our vulnerability scanner tool detects hundreds of high score CVEs just in their container images. Comparably there have been times I haven’t updated our distroless base image for a year and there isn’t even a single vulnerability (this one: https://github.com/GoogleContainerTools/distroless/blob/main...)

In terms of defending your software supply chain, eliminating the cruft that is required to run an interpreted language in a container make a a huge difference.

[ Parent | on HN ]

Re:Major standard library changes in Go 1.20 by doctor_eval on Tuesday January 17, 2023 @06:09AM (#34411210)

Ironically the need to include a distro is true with Java as well. It’s not about running an interpreter so much as having your runtime living external to your code.

Go has a runtime, of course, but it’s part of the binary.

[ Parent | on HN ]