You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
138 lines
6.4 KiB
138 lines
6.4 KiB
11 months ago
|
<!DOCTYPE html>
|
||
|
|
<html lang="en">
|
||
|
|
<head>
|
||
|
|
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||
|
|
<meta http-equiv="content-type" content="text/html; charset=utf-8">
|
||
|
|
|
||
|
|
<!-- Enable responsiveness on mobile devices-->
|
||
|
|
<!-- viewport-fit=cover is to support iPhone X rounded corners and notch in landscape-->
|
||
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1, viewport-fit=cover">
|
||
|
|
|
||
|
|
<title>Julio Biason .Me 4.3</title>
|
||
|
|
|
||
|
|
<!-- CSS -->
|
||
|
|
<link rel="stylesheet" href="https://blog.juliobiason.me/print.css" media="print">
|
||
|
|
<link rel="stylesheet" href="https://blog.juliobiason.me/poole.css">
|
||
|
|
<link rel="stylesheet" href="https://blog.juliobiason.me/hyde.css">
|
||
|
|
<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=PT+Sans:400,400italic,700|Abril+Fatface">
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
</head>
|
||
|
|
|
||
|
|
<body class=" ">
|
||
|
|
|
||
|
|
<div class="sidebar">
|
||
|
|
<div class="container sidebar-sticky">
|
||
|
|
<div class="sidebar-about">
|
||
|
|
|
||
|
|
<a href="https://blog.juliobiason.me"><h1>Julio Biason .Me 4.3</h1></a>
|
||
|
|
|
||
|
|
<p class="lead">Old school dev living in a 2.0 dev world</p>
|
||
|
|
|
||
|
|
|
||
|
|
</div>
|
||
|
|
|
||
|
|
<ul class="sidebar-nav">
|
||
|
|
|
||
|
|
|
||
|
|
<li class="sidebar-nav-item"><a href="/">English</a></li>
|
||
|
|
|
||
|
|
<li class="sidebar-nav-item"><a href="/pt">Português</a></li>
|
||
|
|
|
||
|
|
<li class="sidebar-nav-item"><a href="/tags">Tags (EN)</a></li>
|
||
|
|
|
||
|
|
<li class="sidebar-nav-item"><a href="/pt/tags">Tags (PT)</a></li>
|
||
|
|
|
||
|
|
|
||
|
|
</ul>
|
||
|
|
</div>
|
||
|
|
</div>
|
||
|
|
|
||
|
|
|
||
|
|
<div class="content container">
|
||
|
|
|
||
|
|
<div class="post">
|
||
|
|
<h1 class="post-title">Go problem is not the XML vulnerability</h1>
|
||
|
|
<span class="post-date">
|
||
|
|
2020-12-15
|
||
|
|
|
||
|
|
<a href="https://blog.juliobiason.me/tags/go/">#go</a>
|
||
|
|
|
||
|
|
<a href="https://blog.juliobiason.me/tags/golang/">#golang</a>
|
||
|
|
|
||
|
|
<a href="https://blog.juliobiason.me/tags/thoughts/">#thoughts</a>
|
||
|
|
|
||
|
|
<a href="https://blog.juliobiason.me/tags/stdlib/">#stdlib</a>
|
||
|
|
|
||
|
|
<a href="https://blog.juliobiason.me/tags/patterns/">#patterns</a>
|
||
|
|
|
||
|
|
</span>
|
||
|
|
<p>Yesterday I posted <a href="https://blog.juliobiason.me/links/go-xml-vulnerability/">some comments about the vulnerability in go XML
|
||
|
|
stdlib</a><sup class="footnote-reference"><a href="#1">1</a></sup> and some people said it was not a big
|
||
|
|
deal.</p>
|
||
|
|
<p>The problem is not the vulnerability in itself, though.</p>
|
||
|
|
<span id="continue-reading"></span>
|
||
|
|
<p>Also, the problem is just partially related the fact that it can't be reliable
|
||
|
|
fixed. And it is not related with the "http" library had a DoS problem. And it
|
||
|
|
is not related with the natural number functions (and specifically
|
||
|
|
<code>divRecursiveStep</code>) had an error that put Etherium network down. And it is not
|
||
|
|
related with the "ssh" library had a vulnerability that had to be fixed.</p>
|
||
|
|
<p>The problem is the pattern.</p>
|
||
|
|
<p>I'm don't expect projects to be some mythical "everything should be flawless".
|
||
|
|
Heck, with the exception of the "xml" issue in the original post, all other
|
||
|
|
issues are already fixed.</p>
|
||
|
|
<p>But there is a pattern emerging from go stdlib that shows that little care was
|
||
|
|
taken when building it. And, along with this pattern, we have the issue that
|
||
|
|
this is in the stdlib. Stdlibs should, even more than just provide an
|
||
|
|
infrastructure for bigger applications, be reference implementations. For
|
||
|
|
example, if you want to see how the heck Python managed to add SQLite, you just
|
||
|
|
need to check Python stdlib (FFI); you can check the source (FFI); or if you
|
||
|
|
want to know how can sets in Python be fast (faster then everything else in
|
||
|
|
Python, that is) you can also check the stdlib (it is written in C); or how they
|
||
|
|
managed to make "namedtuples" create objects dynamically (<code>eval</code>). All those
|
||
|
|
describe how you can build something that connects to something external, that
|
||
|
|
is fast or that is magical.</p>
|
||
|
|
<p>And the pattern shows that go stdlib is doing it wrong. It seems the go team
|
||
|
|
focused too much in "adding value" and too little in "being a reference".</p>
|
||
|
|
<p>Another example that there is something wrong with the language: in four
|
||
|
|
months, the problem with the ordering could not be fixed. In half of that time,
|
||
|
|
I can write binding for libxml2 in Python, or even Rust, even if I'm not that
|
||
|
|
experienced with Python or Rust FFI. That means that the layer that gives the
|
||
|
|
stdlib access to external things is taking too much control, in a way that you
|
||
|
|
can't let external libraries use their own structures without that being messed
|
||
|
|
up with the runtime. If the FFI had enough freedom to just expose the top
|
||
|
|
layers, writing their own implementation of a XML parser in C and just exposing
|
||
|
|
to the top layers would be completely doable in four months -- even without the
|
||
|
|
use of libxml2.</p>
|
||
|
|
<p>All those are patterns of things going wrong with the language architecture.
|
||
|
|
And that's why I said that anything half-serious shouldn't be written in go in
|
||
|
|
the first place.</p>
|
||
|
|
<p>I'm someone that likes to say something controversial from time to time. At the
|
||
|
|
start of this year, in one event, I said that any technical leader worth its
|
||
|
|
salt wouldn't recommend go for anything. And I stand by that. Tech leaders
|
||
|
|
should see this kind of problem appear and take steps to not be dragging into
|
||
|
|
some hole they can't get out, and the pattern of architectural problems with go
|
||
|
|
was emerging a long time already.</p>
|
||
|
|
<p>PS: You may have noticed that I typed "go" instead of "Go" in most of this
|
||
|
|
post. This is on purpose; I don't believe the language deserves getting a
|
||
|
|
capital "G".</p>
|
||
|
|
<hr />
|
||
|
|
<div class="footnote-definition" id="1"><sup class="footnote-definition-label">1</sup>
|
||
|
|
<p>From now on, I'll use "stdlib" for "standard libraries", the
|
||
|
|
libraries/modules that come with a language.</p>
|
||
|
|
</div>
|
||
|
|
|
||
|
|
</div>
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
</div>
|
||
|
|
|
||
|
|
</body>
|
||
|
|
|
||
|
|
</html>
|