HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
ethereum
go-ethereum
Go2015–2024
ethereum / go-ethereum

go-ethereum

Go implementation of the Ethereum protocol

NetworkingFinance & Commerce
Explore on GitHubRead Hacker News discussions
43Distinct people
51Mentions
1Explicit recommenders
51.5KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Go implementation of the Ethereum protocol

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

I'm an active RSS consumer. I use NewsBlur after Google Reader closed down. I highly recommend it. I found that RSS became an assumed protocol. It's so rare that RSS is missing…

JamesLeonis used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 10:49:33 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year51 dated mentions

Observed mentions: 2015-01-26 18:05:08 UTC to 2024-03-20 17:56:58 UTC.

0369122015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 6 mentions; 0 submissions, 6 comments20152016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 9 mentions; 3 submissions, 6 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 11 mentions; 5 submissions, 6 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 10 mentions; 1 submissions, 9 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments20192020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 5 mentions; 2 submissions, 3 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2024

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC606
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC936
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC1156
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC1019
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC202
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC202
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC404
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC523
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC101
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC101

What Hacker News says

10 sources
baby·Mar 12, 2018
I'm old to the thread but I figured I would bring some arguments against ranking this vulnerability as a high severity one for geth: * This is a "browser bypass of SOP" issue. All your "unauthenticated" local services should be vulnerable. * A good part of Geth's usage is for servers that do not browse the internet. * You usually do not handle accounts inside of a geth node, instead you open the node's API via RPC and have another tool that sends already-signed transactions to it. That means that this attack would probably not yield much if not allow someone to use the geth node as a public node to query public information. * If you do decide to handle accounts in there, you would probably (1) not open the node with RPC and (2) have the accounts be encrypted. See Ethereum's documentation[1] : > It supports interactive mode, when you are p
Read the rest
rompted for password as well as non-interactive mode where passwords are supplied via a given password file. Non-interactive mode is only meant for scripted use on test networks or known safe environments. [1]: https://github.com/ethereum/go-ethereum/wiki/Managing-your-a...
In How Ethereum can be stolen through DNS rebinding
karalabe·Mar 11, 2018
TL;DR Geth 1.8.0 shipped with [DSN rebind protection](https://github.com/ethereum/go-ethereum/pull/15962), so as far as we know, it's not vulnerable. --- We originally rejected the bounty report because: * We always recommend people communicate with Geth via IPC, not HTTP. The APIs are too powerful for public access: even if noone can steal your Ether, they can exhaust all your local resources via eth_call for example. Our suggestion is to always run a custom proxy that properly rate limits and authenticates outside users vs. running an HTTP server inside Geth. CORS is a protection that always depends on browsers correctly enforcing it, which have been circumvented multiple times, so it's not a good enough security measure. * For a very long time now, we considered unlocking an account a dangerous operation recommended only to power user
Read the rest
s who can properly protect their setup. Mist and other applications transact via API endpoints that do not unlock accounts, so unless a user explicitly manually unlocks their account, they should be fine. That being said... even though we consider the attack vector fairly convoluted and would require a lot of bad user practices to pull off; we agreed that if we can do anything meaningful to prevent it, then we should most definitely do that. For that reason we introduced the `--rpcvhosts` flag which is similar to CORS, but checks the requests origin via different means, and rejects DNS rebound HTTP actions server side. As for the original report, although we rejected the bounty request initially, we agreed that it should be rewarded with a low-impact value since we did make a software modification based on the report. Unfortunately this bounty decision is waiting for approval since the 5th of February. Not sure why it got stuck in the pipeline, we apologize for the delay.
In How Ethereum can be stolen through DNS rebinding
rargulati·Mar 3, 2018
For those interested, here's the paper: https://www.cs.bu.edu/~goldbe/projects/eclipseEth.pdf Here's the partial-implementation of Countermeasure 2 in geth: https://github.com/ethereum/go-ethereum/pull/16069 Of note, this fix is still susceptible to attacks, though still an improvement: > Since geth v1.8.0 still allows the attacker to freely craft node IDs that land in specific buckets, the partial implementation of Countermeasure 2 in geth v1.8.0 means that for a given victim’s table, there can be at most 10 attacker node IDs associated with each attacker IP address. While this improves on the situation prior to geth v1.8.0 (where we could eclipse our victim using just one or two IP addresses), it does not raise the bar for attackers quite as high as we had hoped. Still making my way through the paper and the PR to identify other things
Read the rest
fixed. Here's the entire 1.8 release: https://github.com/ethereum/go-ethereum/releases/tag/v1.8.0
In Ethereum fixes serious “eclipse” flaw
JamesLeonis·Jan 24, 2018Recommendation phrase
I'm an active RSS consumer. I use NewsBlur after Google Reader closed down. I highly recommend it. I found that RSS became an assumed protocol. It's so rare that RSS is missing that it's absence makes me startlingly grumpy. Beyond content RSS is embedded in many machine announcement services. I use Github's release feed for Ethereum[1] to monitor updates, for example. One stellar feature of NewsBlur is it's ability to find the feed address from a given URL, which makes discovering feeds far easier. For what it's worth, RSS and feeds have graduated from the Hype Curve into widespread unobserved use. EDIT: I forgot to mention my favorite Meta-Feed[2] for Clojure! It's all RSS all the way down. [1]: https://github.com/ethereum/go-ethereum/releases.atom [2]: http://planet.clojure.in/
In Ask HN: Is RSS making a real resurgence?

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.