1. Footguns in Golang

Talk Submissions: [email protected] Footguns in Golang - Zoltan (@loltan) Automated tooling and AI assistants have raised the floor for code review — the obvious Go bugs now get caught on the first pass by anyone. But that floor is also where most reviewers stop, because the tooling only flags what it already knows to look for. This talk goes past it, into Go's subtle and dangerous behaviours: silent integer overflows that smuggle SQL queries at the protocol level, null-byte auth bypasses at the CGO boundary, JSON marshallers that silently leak the very secrets they were written to redact, reverse-proxy hop-by-hop header abuse, and the JSON-parsing quirks that keep CSRF alive in modern REST APIs. These footguns and the Semgrep rules to catch them were the subject of a recent elttam blog post — but rules are only interesting once you point them at real code. So for Ruxmon, we've turned them loose on a swathe of large, widely-used open source Go projects to see what actually falls out Location Room 080.02.002 at RMIT (Building 80) - 445 Swanston St, Melbourne Discord Discord Invite