Request: Update Golang Sarama Library Samples with Secure Defaults
michaeljmarshall opened this issue · comments
Description
The following links point to example code that disables TLS certificate validation. Given that disabling certificate validation is an insecure default that is not meant for production use cases, I would not expect these defaults in the sample code. I would expect example usages of the sarama library to show how to correctly configure TLS or at the very least to have a comment indicating that the settings are insecure and not meant for production.
How to reproduce
The issue is an insecure default.
Has it worked previously?
N/A
Checklist
IMPORTANT: We will close issues where the checklist has not been completed or where adequate information has not been provided.
Please provide the relevant information for the following items:
- SDK (include version info):
golang sarama - Sample you're having trouble with: referenced above
- If using Apache Kafka Java clients or a framework that uses Apache Kafka Java clients, version:
<REPLACE with e.g., 1.1.0> - Critical issue
If this is a question on basic functionality, please verify the following:
- Port 9093 should not be blocked by firewall ("broker cannot be found" errors)
- Pinging FQDN should return cluster DNS resolution (e.g.
$ ping namespace.servicebus.windows.netreturns ~ns-eh2-prod-am3-516.cloudapp.net [13.69.64.0]) - Namespace should be either Standard or Dedicated tier, not Basic (TopicAuthorization errors)