You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
137 lines
6.4 KiB
137 lines
6.4 KiB
<!DOCTYPE html> |
|
<html lang="en"> |
|
<head> |
|
<meta http-equiv="X-UA-Compatible" content="IE=edge"> |
|
<meta http-equiv="content-type" content="text/html; charset=utf-8"> |
|
|
|
<!-- Enable responsiveness on mobile devices--> |
|
<!-- viewport-fit=cover is to support iPhone X rounded corners and notch in landscape--> |
|
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1, viewport-fit=cover"> |
|
|
|
<title>Julio Biason .Me 4.3</title> |
|
|
|
<!-- CSS --> |
|
<link rel="stylesheet" href="https://blog.juliobiason.me/print.css" media="print"> |
|
<link rel="stylesheet" href="https://blog.juliobiason.me/poole.css"> |
|
<link rel="stylesheet" href="https://blog.juliobiason.me/hyde.css"> |
|
<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=PT+Sans:400,400italic,700|Abril+Fatface"> |
|
|
|
|
|
|
|
|
|
|
|
</head> |
|
|
|
<body class=" "> |
|
|
|
<div class="sidebar"> |
|
<div class="container sidebar-sticky"> |
|
<div class="sidebar-about"> |
|
|
|
<a href="https://blog.juliobiason.me"><h1>Julio Biason .Me 4.3</h1></a> |
|
|
|
<p class="lead">Old school dev living in a 2.0 dev world</p> |
|
|
|
|
|
</div> |
|
|
|
<ul class="sidebar-nav"> |
|
|
|
|
|
<li class="sidebar-nav-item"><a href="/">English</a></li> |
|
|
|
<li class="sidebar-nav-item"><a href="/pt">Português</a></li> |
|
|
|
<li class="sidebar-nav-item"><a href="/tags">Tags (EN)</a></li> |
|
|
|
<li class="sidebar-nav-item"><a href="/pt/tags">Tags (PT)</a></li> |
|
|
|
|
|
</ul> |
|
</div> |
|
</div> |
|
|
|
|
|
<div class="content container"> |
|
|
|
<div class="post"> |
|
<h1 class="post-title">Go problem is not the XML vulnerability</h1> |
|
<span class="post-date"> |
|
2020-12-15 |
|
|
|
<a href="https://blog.juliobiason.me/tags/go/">#go</a> |
|
|
|
<a href="https://blog.juliobiason.me/tags/golang/">#golang</a> |
|
|
|
<a href="https://blog.juliobiason.me/tags/thoughts/">#thoughts</a> |
|
|
|
<a href="https://blog.juliobiason.me/tags/stdlib/">#stdlib</a> |
|
|
|
<a href="https://blog.juliobiason.me/tags/patterns/">#patterns</a> |
|
|
|
</span> |
|
<p>Yesterday I posted <a href="https://blog.juliobiason.me/links/go-xml-vulnerability/">some comments about the vulnerability in go XML |
|
stdlib</a><sup class="footnote-reference"><a href="#1">1</a></sup> and some people said it was not a big |
|
deal.</p> |
|
<p>The problem is not the vulnerability in itself, though.</p> |
|
<span id="continue-reading"></span> |
|
<p>Also, the problem is just partially related the fact that it can't be reliable |
|
fixed. And it is not related with the "http" library had a DoS problem. And it |
|
is not related with the natural number functions (and specifically |
|
<code>divRecursiveStep</code>) had an error that put Etherium network down. And it is not |
|
related with the "ssh" library had a vulnerability that had to be fixed.</p> |
|
<p>The problem is the pattern.</p> |
|
<p>I'm don't expect projects to be some mythical "everything should be flawless". |
|
Heck, with the exception of the "xml" issue in the original post, all other |
|
issues are already fixed.</p> |
|
<p>But there is a pattern emerging from go stdlib that shows that little care was |
|
taken when building it. And, along with this pattern, we have the issue that |
|
this is in the stdlib. Stdlibs should, even more than just provide an |
|
infrastructure for bigger applications, be reference implementations. For |
|
example, if you want to see how the heck Python managed to add SQLite, you just |
|
need to check Python stdlib (FFI); you can check the source (FFI); or if you |
|
want to know how can sets in Python be fast (faster then everything else in |
|
Python, that is) you can also check the stdlib (it is written in C); or how they |
|
managed to make "namedtuples" create objects dynamically (<code>eval</code>). All those |
|
describe how you can build something that connects to something external, that |
|
is fast or that is magical.</p> |
|
<p>And the pattern shows that go stdlib is doing it wrong. It seems the go team |
|
focused too much in "adding value" and too little in "being a reference".</p> |
|
<p>Another example that there is something wrong with the language: in four |
|
months, the problem with the ordering could not be fixed. In half of that time, |
|
I can write binding for libxml2 in Python, or even Rust, even if I'm not that |
|
experienced with Python or Rust FFI. That means that the layer that gives the |
|
stdlib access to external things is taking too much control, in a way that you |
|
can't let external libraries use their own structures without that being messed |
|
up with the runtime. If the FFI had enough freedom to just expose the top |
|
layers, writing their own implementation of a XML parser in C and just exposing |
|
to the top layers would be completely doable in four months -- even without the |
|
use of libxml2.</p> |
|
<p>All those are patterns of things going wrong with the language architecture. |
|
And that's why I said that anything half-serious shouldn't be written in go in |
|
the first place.</p> |
|
<p>I'm someone that likes to say something controversial from time to time. At the |
|
start of this year, in one event, I said that any technical leader worth its |
|
salt wouldn't recommend go for anything. And I stand by that. Tech leaders |
|
should see this kind of problem appear and take steps to not be dragging into |
|
some hole they can't get out, and the pattern of architectural problems with go |
|
was emerging a long time already.</p> |
|
<p>PS: You may have noticed that I typed "go" instead of "Go" in most of this |
|
post. This is on purpose; I don't believe the language deserves getting a |
|
capital "G".</p> |
|
<hr /> |
|
<div class="footnote-definition" id="1"><sup class="footnote-definition-label">1</sup> |
|
<p>From now on, I'll use "stdlib" for "standard libraries", the |
|
libraries/modules that come with a language.</p> |
|
</div> |
|
|
|
</div> |
|
|
|
|
|
|
|
|
|
</div> |
|
|
|
</body> |
|
|
|
</html>
|
|
|