The private keys of eight eMudhra intermediate CA certificates have been compromised news.ycombinator.com/item?id…. sslnotify.com is one of the few tools that was able to find that the intermediate certificate is revoked since it parses CRLs. Here's how SSL tools compare.

I have written an article about using the principle of least privilege to write secure Go code. It covers *Over privileged DB handles *Inadvertently logging sensitive data * Unmarshalling user input using over privileged structs Tutorial URL: golangbot.com/secure-go-code… #golang

The preconnect keyword for the rel attribute of the <link> element is a hint to browsers that the user is likely to need resources from the target resource's origin, and therefore the browser can likely improve the user experience by preemptively initiating a connection to that origin. Preconnecting speeds up future loads from a given origin by preemptively performing part or all of the handshake. Example code <link rel="preconnect" href="example.com" /> Read more: developer.mozilla.org/en-US/…

Bulk inserts for Postgres in sqlc without batch queries is possible using Postgres' unnest() function. For example, unnest(ARRAY[1,2]) is expanded to the rows 1 2 The following is an example of multiple insert query using unnest INSERT INTO domain (id, domain, port_no, customer_id) VALUES ( unnest(@id_array::uuid[]), unnest(@domain_array::text[]), unnest(@port_array::text[]), unnest(@customer_id_array::uuid[]) ) RETURNING *; #golang #sqlc

I have been hosting my SAAS apps in baremetal servers/virtual machines for quite sometime. Here are some of the basic security measures that should be implemented to secure the server 1. Disable ssh login via password. Enforce ssh using only public/private key authentication. 2. Disable root user login and create a new user with sudo privileges. 3. Setup a jump host and allow ssh access to the baremetal server only from the jump host using IP allow listing. 4. Configure IP tables and only expose ports required by the application. 5. Run applications with the least privileges required. Avoid running services as root. #linux #security #tips

I have started working on the ssl monitoring and alerting feature for sslnotify.com This is one of the mockups I came up with for the page that lists all the domains being monitored. The front end is built using Bootstrap, jQuery and Go templates with most of the pages rendered on the server using Go templates. No fancy SPA, no React, no fancy JavaScript libraries. I like creating frontends the way they used to be done in the good old days!

#golang #tip The go mod why command can be used to find out why a particular package is needed. For example, let's stay there is a indirect dependency on a particular package in go.mod. You need to find out the import graph of this particular dependency. This is possible using `go mod why`.

I am using sqlc for coding sslnotify.com and found it quite useful. Writing queries and getting sqlc to generate the Go code is impressive. It does have a few features missing like 1. Inability to rename the functions sqlc generates 2. Limited support for /lib/pq when compared to jackc/pgx. These are the types I have overridden in my sqlc.yaml overrides: - db_type: "uuid" go_type: import: "github.com/google/uuid" type: "UUID" - db_type: "timestamptz" nullable: true go_type: type: "*time.Time" sqlc also has the ability to understand the DB migration format of golang-migrate. Overall I am impressed! #golang #sqlc

I have started creating the data model for sslnotify.com to support SSL expiry reminder notifications. If you have not heard about dbdiagram.io, I recommend you try it. It's a great tool for data model diagrams as code.

I usually read books during my commute in TfL. Some of the gems that I have read in the past few months "The last house in the street" by Diane Chamberlain "Hunted" by Roberta Kray "Richest Man In Babylon" by George S. Clason "Just After Sunset" by Stephen King "Stolen focus: why you can't pay attention" by Johann Hari

The new widgets in Firefox are amazing!

Let's encrypt has a staging server which can be used for testing certificate issue without hitting production rate limits letsencrypt.org/docs/staging…

I wrote a tutorial about deploying a Go binary using systemd in Ubuntu. The tutorial is available at golangbot.com/golang-systemd… I hope it helps. Feedback is appreciated! #golang #ubuntu #systemd

The kubectl command has a `-v` flag to control the logging verbosity. This is useful for debugging when kubectl fails. For example, log level 8 display the http request contents. `kubectl get po -A -v=8` prints the following output #kubernetes #kubectl

#golang #tip If a web service needs to be accessible only from the local machine, bind it to 127.0.0.1:<port> instead of 0.0.0.0:<port>. 127.0.0.1 accepts connections only from the host itself, while 0.0.0.0 listens on all network interfaces.

The tool also verifies whether the SSL cert is revoked by validating against Certification Revocation Lists (CRLs) and also using Online Certificate Status Protocol(OCSP). Tech stack: #golang Bootstrap jQuery Hosted in Hetzner.

Launching sslnotify.com/, a tool to track SSL cert expiry and also to validate the entire cert chain for all resolved IP addresses. Cert expiry notifications will be added soon.

I have been inactive in twitter for sometime. Reason being, I was hacking yet another side project. I have leased a Hetzner cloud server and installed caddy ready to go at http://62.238.18.22/ Expecting to launch my project in a day or two! Exciting times.

VS Code is inserting 'Co-Authored-by Copilot' into commits regardless of usage news.ycombinator.com/item?id…. As a fan of VSCode, I also found that the last few updates were purely to push copilot. Please suggest any other open source editor that works well for Go programming.