That being said, developers often have a bit of learning to get there, but that can greatly be accelerated by good team/mentor code review and discussion.

    package main

    import (
        "crypto/sha1"
        "hash"
        "sync"
    )

    func main() {
        hasher := getHasher()
        defer poolHasher(hasher)
    }

    var hasherPool sync.Pool = sync.Pool{
        New: func() interface{} {
            return sha1.New()
        },
    }

    func getHasher() hash.Hash {
        return hasherPool.Get().(hash.Hash)
    }

    func poolHasher(hasher hash.Hash) {
        hasher.Reset()
        hasherPool.Put(hasher)
    }

I thought you could test for bacterial nuclear material in the blood?

Edit found it: Its a PCR Assay: https://www.ncbi.nlm.nih.gov/pubmed/26469112

The parallel reddit thread seems to agree too: https://www.reddit.com/r/golang/comments/biexq0/go_113_xerro...

  0. Home page
  1. Select product: https://puri.sm/products/
  2. View prod descs, select product: https://puri.sm/products/librem-13/
  3. Scroll down, view prod desc, click shop now
  4. At product configuration page: https://shop.puri.sm/shop/librem-13/

  Client: asks server for nonce
  Server: sends nonce
  ---- OR ----
  Nonce arrives with login page

  Client: sends HMAC(nonce + HMAC(username + password + appname) + Unix Epoch rounded to last 5 min block))

  Server: 
  1. gets response
  2. using username as key pulls HMAC(username + password + appname) from DB
  3. Computes HMAC(last nonce sent to username + DB HMAC + Unix Epoch rounded to last 5 min block)) and compares to user token
  4. last nonce is cleared

All the transport encryption and DB encryption/hashing/salting won't protect you from this kind of logging mistake, but the above would.

P.S. There are ways to make the above even better by adding a nonce that has to be requested from the server before POST etc.