Show HN: CMS Server written in Go (alpha)

Re:Show HN: CMS Server written in Go (alpha) by mappu on Saturday June 01, 2013 @07:30AM (#5803572)

No problem, thanks for sharing your project with everyone! Just people definitely like to use symbols in passwords.

Your fundamentals are fine, i don't think those are very serious problems compared to the average custom web app in the wild (most of which probably use plaintext passwords with no concern for sqli or xss...)

[ Parent | on HN ]

Re:Show HN: CMS Server written in Go (alpha) by ryalfalpha on Saturday June 01, 2013 @01:19PM (#5804908)

Haven't done much golang and don't have it installed on this laptop, but are string comparisons constant time?

If not, I think there is potential for a timing attack here?

if usr == _admin_usr && pw == _admin_pw { return RootMode, nil }

[ Parent | on HN ]

Re:Show HN: CMS Server written in Go (alpha) by omra on Saturday June 01, 2013 @01:47PM (#5805039)

Go does not have constant time string comparisons by default. The crypto/subtle package supplies constant time comparisons.

[ Parent | on HN ]

Re:Show HN: CMS Server written in Go (alpha) by wilsonfiifi on Saturday June 01, 2013 @03:00PM (#5805405)

Thanks for pointing that out. Will look into it

[ Parent | on HN ]