Go Security – Past, Present, and Future
summary
A five-person Go Security team maintains crypto, net/http, encoding and other security-critical packages, triages reports via security@, and runs the vulnerability rewards path; historical data shows ~40 crypto CVEs of which four are high-impact (compared with OpenSSL’s ~80), ~20 toolchain CVEs with ~13 tied to CGO, and an external Trail of Bits audit finding 4–5 issues (one serious). Current deliverables include a pure-Go FIPS module (go1.24 path), improved testing for assembly/constant-time code, and plans to merge govulncheck into the go command and harden the module proxy.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 2:55Go security history and CVE analysis
- 9:37Denial of service vulnerabilities
- 13:13Logic bugs and incorrect behavior
- 16:43Low-level APIs risks
- 21:19Deprecating unsafe APIs
- 23:30FIPS compliance and Go cryptography
- 26:42External audit of crypto libraries
- 27:25Future testing and security plans
- 28:30Post-quantum cryptography in Go
- 29:32Go vulnerability checker
related talks
25mExploring Some Essential Security Checks for Any Open Source Go Project
45mEssential security checks for your Go project
24mGoing Secure with Go
57mGo Security
24mVulnerability Management for Go
05mLightning Talk: Improving The Security Of Your Go Applications
21mVulnerability Management for Go
07mSecurity of Go Modules and Vulnerability Scanning in GoCenter