Hacker News Reader

Last time this was discussed: https://news.ycombinator.com/item?id=14192383

Still not convinced about the usefulness of the source, given the criticisms raised here and there.

This guide still has some issues. It's missing common classes of web app vulns I've seen in Go code (e.g. CSRF, SSRF) and has some weird advice here and there (scan uploaded files with AV? Really?)

Fail to scan with AV and you might be an unwitting malware distributor.

If you allow binary uploads, you're going to be a malware distributor whether you scan or not. AV just introduces complexity and attack surface and doesn't really belong in a guide about Golang secure coding practices.

Reply on news.ycombinator.com