6 ms·

I've been meaning to implement libsodium's sodium_memzero instead of zeroing out. It's next on the Agenda.

• slrz 9y ago
  I don't think it's worth it to add a cgo dependency to the package. Maybe write a set of assembly functions? The compiler can't omit calls to them and there isn't much more you can do anyway than to zero the memory.
• stouset 9y ago
  Hey there! Thanks for building this. I hate to rain on your parade, but your approach, unfortunately, won't work as currently written[1]. You have to manage the memory yourself. https://news.ycombinator.com/item?id=14174500 https://news.ycombinator.com/item?id=14174500
  • libeclipse 9y ago
    Hey there stouset! I've read your comments and I thank you for the tips you've given. I do realise that there are a lot of things that I have missed, and I plan on having them fixed soon. I definitely will be managing memory myself. The project is in very early stages at this point, just in v0.1.0 right now.
    • eropple 9y ago
      I'm not trying to pick on you or discourage you, but "just v0.1.0" doesn't excuse that it doesn't work. Whether they should or not, people trust projects like this because they, too, don't have the capability to evaluate whether or not this works. I wouldn't expect potential consumers to understand that Go's garbage collector makes this a nonviable approach any more than this project currently does. Right now, this is a primed hand grenade of a project. You should disclaim its insecurity at the top of the README. Be very, very specific that it is not currently functional and discourage anyone from using this until it is functional.
      • eropple 9y ago
        And to be clear, saying "don't use it in production" isn't the same thing as saying it doesn't work at all. Your change is irresponsible, because it doesn't work at all.