[nicoburns]

You are however replying to thread where a Dropbox engineer calls it "a right of passage" to introduce such bugs to their codebase. Which suggests that it is by no means unheard of for these problems to crop up in real-world code.

[tptacek]

Again: introducing surprising correctness bugs? Crashing programs? Absolutely. I don't know how many different ways I can say that my concern here is the misuse of a security term of art. Dropbox engineers do not have as a rite of passage introducing or finding RCE vulnerabilities in Go code. Would that it were so! My job would be much more interesting.

[zozbot234]

> correctness bugs? Crashing programs? Absolutely.

Denial of service can absolutely be a security issue, as can any correctness bug if it leads to unintended behavior or corrupted data.

[tptacek]

If that's where we're at, where unhandled exceptions are the security issues we're hanging on, I'll consider my argument won.

[zozbot234]

That might be a reasonable argument if you were guaranteed an unhandled exception in this instance. Unfortunately that's not the case.

[tptacek]

If you could demonstrate something better than that, we wouldn't be arguing about the severity of DOS attacks.

[samus]

Doesn't Dropbox write a lot of Python extensions in C for speedup?

[pclmulqdq]

Excuse me, but in this thread we are bashing go, not making logical arguments.

[ioasuncvinvaer]

What is the argument?

[pclmulqdq]

That Dropbox is very happy with unsafe languages despite the top-level comment.

[blub]

Many FAANG & co engineers are overrated. If every new hire is introducing concurrency bugs in a Golang codebase, refactor, do better review and maybe use concurrency questions instead of leetcode.

I’ll take tptacek’s word over most FAANG type on such topics if we’re doing appeals to authority. The guy is very practical, unlike the Rust community which is incredibly focused on theoretical correctness instead of real-world experiences.