Going Secure with Go
summary
Shows concrete fixes: replace time-seeded rng with crypto/rand, stop printing PII by masking logs with Sumo Logic Splunk Fluentd or Elasticsearch, and move secrets out of code into Vault rather than environment variables. Run gosec and golangci-lint (use depguard/card to ban unsafe imports), separate pprof handlers, and use multi-stage Docker builds plus Kubernetes PodSecurity and NetworkPolicies. Track transitive libraries, lock versions, auto-review updates with a bot, and note real failures like Equifax’s 148 million record breach and npm supply-chain outages.
AI-written summary · about
chapters (22)
- 0:00Intro
- 0:48Meet Natalie
- 2:05Special thanks
- 2:30Data
- 4:27Logs
- 4:58Secrets
- 6:45Environment variables
- 7:13Vault
- 7:27Input Validation
- 9:11Static Code Analysis
- 9:41GoSEC
- 10:20PPROP
- 11:22Dependencies
- 12:31Checklist
- 13:27Equifax Breach
- 14:03Peek Safe
- 15:42JavaScript
- 17:50Containers
- 19:18Kubernetes Policies
- 20:08Dev Cycles
- 20:49Recap
- 21:54DEFCON
related talks
25mExploring Some Essential Security Checks for Any Open Source Go Project
05mLightning Talk: Improving The Security Of Your Go Applications
32mSecure and reliable development with Go
45mEssential security checks for your Go project
31mGo Security – Past, Present, and Future
35mA Go Security Journey
56mThe shimmy to the left: why security is coming for engineers
45mCloud, Containers & Security