johnwilson / bytengine Goto Github PK

Your readme notes:

Install Go
go get github.com/vmihailenco/redis
go get labix.org/v2/mgo
go get github.com/gorilla/mux
go get github.com/gorilla/schema

but in theory, just go get github.com/johnwilson/bytengine should be sufficient for go get to fetch and build all dependencies. (Haven't in fact tried it, but it's just how go get is supposed to work :)

Hi,

If golang has optimised string comparisons then this is vulnerable to a timing attack and the attacker will gain access to the system in RootMode. You should use a constant time string comparison, or even better only store the admin details hashed with bcrypt or similar and compare the input after bcrypting it also, this should make such attacks infeasible.

https://github.com/johnwilson/bytengine/blob/master/kernel/modules/auth.go#L58

if usr == _admin_usr && pw == _admin_pw {
    return RootMode, nil
}

Hi! This is a really interesting project.

But it would be easier to deploy if were used togethere to any database in pure Go:

• A low-level key/value database for Go
• A high performance NoSQL like Redis powered by Go
• tiedot - Your NoSQL database powered by Golang