Webhooks · 9 min read
Webhook signature checks that fail or quietly pass in Go
Avoid the mistakes that break or weaken webhook signature checks in Go, and see how GitHub, Stripe and Standard Webhooks differ in practice.
Posts tagged “security”
8 articles about security.
Webhooks · 8 min read
Verify Standard Webhooks (Polar) signatures in Go
Write a dependency-free Go verifier for Standard Webhooks signatures as used by Polar, with secret rotation, replay protection and a known-answer test.
Packaging and releasing CLIs · 10 min read
Verify a downloaded binary: checksums, GPG, minisign, cosign
Learn what sha256sum, GPG, minisign and cosign each protect against, how to verify a release by hand, and how an installer should chain the checks.
VPS operations · 10 min read
SSH, ufw and fail2ban basics for a single VPS
Which sshd_config options matter, how to write ufw rules, and how to set up a fail2ban jail, with a plain account of what each layer does and does not stop.
Packaging and releasing CLIs · 11 min read
Reproducible Go builds: build twice, compare the hashes
Build the same Go commit in two directories, compare the bytes, and learn which flags and settings make the hashes match or differ.
VPS operations · 11 min read
Harden a fresh Debian VPS in the first hour, step by step
A first-hour checklist for a new Debian VPS: updates, a non-root user, SSH keys, a firewall, unattended-upgrades, swap and time sync, with real commands.
Go in production · 10 min read
Go HTTP server timeouts that survive slow and stuck clients
Set ReadHeaderTimeout, ReadTimeout, WriteTimeout and IdleTimeout correctly, add per-handler deadlines, and prove a slowloris client gets cut off.
Packaging and releasing CLIs · 10 min read
What a curl | sh installer for a Go binary should refuse
Write an install script for a Go release that stops on a bad checksum, odd version, plain http or unknown platform, and test each refusal.