btw, I'm pretty sure you can conditionally set these vars depending on whether you're running `go test` or not, such that the malicious versions only manifest in production
Show this thread
Some especially juicy global variables that a malicious package might redefine: - rand.Reader (replace it with a deterministic one) - http.DefaultClient (snoop all traffic) - time.UTC (mess with time perception) - io.EOF (set it to nil? Probably explodes a lot of things)https://twitter.com/lukechampine/status/1041799929172307974 …
-
-
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.