Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Shay Nehmad (00:00):
This show is supported by you. Stick around
(00:02):
till the outbreak to hear moreabout that. This is Capu Go for
11/07/2025. Keep up to date withthe important happenings in the
Go community in about fifteenminutes per week. I'm Shay
(00:23):
Nehmad.
And I'm Jonathan Hall. And I'mcompensating for feeling a
little sick. Yes. No worry. Inthree minutes, the energy is
gonna come back to, you know,back to the meme.
I am excited for this, new patchrelease because it's not
(00:44):
strictly a security release thistime. Woah. Yeah, let me tell
you about it. So, it's actuallybugs from the security release.
No, and some other bugs, likethis is not normally what we see
in patch releases, but there's alot of, I call it bugs, but it's
not like, it's like edge casesthat were eventually found,
(01:05):
feels to me, in the compiler andthe linker and in the net
library.
So I picked three that I liked.
Jonathan Hall (01:11):
Would you say these are subtle bugs? Yeah.
Yeah. Because one of them is inthe crypto subtle package.
Shay Nehmad (01:19):
The ones that are in the subtle, I just the ones
that are in crypto, I just glazeover. I have no, no way to parse
them even. But I wanted to sortof quiz you to see if you would
have been able to evenunderstand that these are bug.
Jonathan Hall (01:34):
Try me.
Shay Nehmad (01:35):
So, let me, this is gonna make for great audio, by
the Let me read you this HTTPaddress and you let me know if
you think it's correct.
Jonathan Hall (01:46):
I'll tell you right now, it's not correct. Can
tell you right now.
Shay Nehmad (01:51):
Alright, alright. You're putting your bed right
now even before I start readingit? I am, yes. Alright, let's
check. Httpscolon/slash.
That's that's fine, right?That's all.
Jonathan Hall (02:02):
Yeah, that
Shay Nehmad (02:02):
seemed good. Open square brackets.
Jonathan Hall (02:05):
Okay.
Shay Nehmad (02:06):
Colon colon.
Jonathan Hall (02:07):
Okay.
Shay Nehmad (02:08):
FFFF colon. Uh-huh. One nine two dot zero dot two
dot one, close square brackets.
Jonathan Hall (02:16):
Sounds like it's an IPv6 that a
Shay Nehmad (02:18):
valid address or no?
Jonathan Hall (02:19):
It sounds like an IPv6 address, but I don't know.
My IPv6 But it ends with,
Shay Nehmad (02:24):
with, IPv4 address. So it it starts with a thing
that looks like, you know, thecolon colon ffff.
Jonathan Hall (02:31):
Uh-huh.
Shay Nehmad (02:32):
After the last colon, it's an IPv4 address, one
eighty two dot zero the one.
Jonathan Hall (02:36):
I'll tell you, if if I were to counter that, I
would assume it was a spammer ora a scammer and I would just
skip it, whether it waslegitimate, like, syntactically
correct or not. That's about asfar as I would get with thinking
it through.
Shay Nehmad (02:49):
So, the Go runtime agrees with you. Okay. Which is
why in a recent fix to avulnerability, which I even
think we discussed on the show,like in passing, Uh-huh. That
the parse function permitsvalues that aren't IPv6 Uh-huh.
In the host component in thesquare brackets.
Someone added this this exacttest case to the URL test parse
(03:11):
function and said, like, false,this should return false, this
shouldn't work. And then,Hartwork, which is Sebastien
Pipping doing open source workin the Free Software Foundation,
Europe from Berlin, was justlike, hey, this is not actually
true because you can put IPv4addresses inside IPv6 addresses
(03:32):
and that is legitimate. Look atRFC three thousand nine eighty
six. You know me, the moment weopen RFCs I'm happy, I'm a happy
camper. So, yeah, this isactually a valid address and a
recent security fix they made itlike, oh, this shouldn't work.
But it actually should work.Yeah, very, very surprising
behavior for sure. I would beable to read these addresses, I
(03:52):
hope I'll never have toimplement this parser. Luckily I
don't have to because Sebastianalready implemented URI parser,
which is a strict RFC compliantURI parser, written in like C.
So, he knows what he's talkingabout, I hope at least.
Cool. On the end, by the way, ifyou thought, like, this IPv6
(04:13):
syntax is pretty complicated,here's another, like, riddle for
you.
Jonathan Hall (04:17):
Okay.
Shay Nehmad (04:18):
That they resolved that they resolved in, in this,
release. Do you know the any,keyword?
Jonathan Hall (04:26):
Yeah. The All right. Like the empty interface,
right? Yeah. Yeah, yeah.
Shay Nehmad (04:30):
So, any, that accepts an empty function equals
equals any ex empty function.
Jonathan Hall (04:38):
Say it again.
Shay Nehmad (04:38):
What what should it return? You're, comparing
Comparing two empty. Tointerface values, basically.
Jonathan Hall (04:44):
I don't have any idea what that should return. I
don't think comparing interfacevalues is necessarily supported
or I I don't know what thatdoes.
Shay Nehmad (04:53):
So it should panic. The documentation says, oh, if
you compare it to interfacevalues with identical dynamic
types, you should have a runtimepanic. Okay. And we just forgot
to implement it. So someone waslike, hey, I found this.
Like, the code is it's so funny,you see the issue, it's like,
what do you see happen? The codeis working without problem, what
(05:14):
do you expect to see? It shouldpanic. It's like a completely
the opposite way, but this issomething that, like, regressed
in 1.25 because 1.24 it doespanic. It was just a bug in the
compiler and someone, someonebisect it to find the specific
(05:35):
commit, which is by the way atrick I love using whenever I
use git bisect.
Feel super smart. It turned outto be an optimization. So they
added an optimization, you know,in in some super internal, like,
reflect dot, Go in the internalcompiler. And Alan Donovan
(05:57):
summarized it very nicely in theGitHub. He's like, no good
optimization goes unpunished.
Jonathan Hall (06:04):
I'm a little surprised that they didn't have
a test covering that already.That seems like something like,
I don't know, when I'mimplementing the spec, I would
be like, yeah, let's make surethat this really simple obvious
case works, but okay.
Shay Nehmad (06:14):
So I don't know what would, you know, cause
someone to write such code. Thisis like nonsense You would never
write it in production. It'sjust like an edge case you have
to cover.
Jonathan Hall (06:24):
Maybe Claude was writing it.
Shay Nehmad (06:26):
Oh, that's that's a good segue. I don't think Claude
should do software.
Jonathan Hall (06:33):
Foreshadowing.
Shay Nehmad (06:34):
So anyway, there's a new release with these super
esoteric bug fixes, and I likeour recommendation to, you
should upgrade because it hassecurity fixes. If these bug hit
your code, man, what are youwriting? Jesus. But still
probably good to upgrade. Andthis was back ported, so it's on
1.24 as well.
That's it about the new release.
Jonathan Hall (06:55):
Nice. So I I guess we'll try to I'm gonna
return this as a useful segue.Next, I wanna talk about
standards of code. Codestandards, I guess.
Shay Nehmad (07:05):
Oh.
Jonathan Hall (07:06):
Yeah. So long, long time ago, you know, in
Galaxy Far Away, we had FilippoValsorta on the show, and he
talked about his open sourcework. He does a lot of crypto
work for the Go centered libraryand some other work, and he he
makes his money doing that,right? So he has recently
released his standard of carethat he and his his group
Shay Nehmad (07:26):
of Manifesto.
Jonathan Hall (07:27):
Open source folks adhere to. Yeah. He has a
manifesto. It's called theGeomys. Is that how you
pronounce this?
G e o m y s, Geomys Standard ofCare. And it just sort of
outlines for all to see how theygo about maintaining high
quality code. And there's somethings in here that might be a
little bit surprising to somefolks. One of the first things
(07:49):
that jumps out at me was theydon't use Dependabot, which I
think a lot of people use. It'skind of the standard tool to
make sure you're always running,you know, the latest and
greatest software.
You're a security guy, Shay. Ibet you can think of reasons not
to use Dependabot, but I'mcurious if you know the same
reasons he doesn't use it. Whatdo you think?
Shay Nehmad (08:07):
First of all, increased churn part, like
Dependabot is shoving PRs atyour face and it's, like,
automated so you trustDependabot is, for now, I'm I'm
not, like, bashing GitHub.Right? This is true for Snyk.
This is true for all the otherapplication security companies.
You get these PRs, at some pointyou just start approving them.
(08:28):
It just doesn't make sense toreview every single release. And
also, I like the approach of itincreases the risk of supply
chain. Like, if you have amodule that you vetted, you went
into the code, you went intoGitHub, you double checked the
hashes, whatever, and then someautomated tools offers you to
upgrade, you're like, this whatif this new version has a
(08:53):
vulnerability that hasn't beendiscovered yet? Like, what
shouldn't I let it cook for awhile and upgrade only when I
need to? There is the flip sideof that.
Oh, they mentioned anotherthing, which I don't care about
because I don't work in opensource right now. But if I
worked in open source, I would.It's very easy to impersonate
Dependabot. You can just createa user and name it Dependabot or
(09:15):
any other similar, like,application security tool, six
months opening proper PRslooking like an automated tool.
Uh-huh.
Or even legitimately, likebuilding these application
security tools is not that hard,to be honest. Yeah. So just like
building a tool that opens thisPR for real for six months,
(09:36):
gaining like reputation as areal tool and then starting to
inject, like, bad dependency.
Jonathan Hall (09:42):
Oh, wow.
Shay Nehmad (09:42):
These are all legitimate concerns. I mostly
care about the, the first twobecause I work in Closos right
now. Mhmm. But it's not likethey're not doing anything at
all on the on the readme. It'snot readme.
Oh, it is a readme. On thestandard of care project,
they're saying like, oh, we run,go vuln check. We they check
like a high signal to noise,notification to find actual
(10:07):
vulnerable dependencies. Yep.And they also run their CI with
the latest version.
So if they need to upgrade, theyit's it's easy. It's not a big
deal.
Jonathan Hall (10:16):
Well, and and more more than just if they need
to upgrade, but, like, if if oneof the consumers of the library
is using the latest version,they're not they know they're
not gonna be broken, right? Sothat's
Shay Nehmad (10:25):
also I think that's actually a a more sophisticated
and smarter approach todependency management than most,
people use. Most people, Iassume, don't actually care
about this stuff and just dowhatever policy they have to
adhere to. So if their companyor whatever they work on don't
have a dependency managementpolicy, they just won't upgrade
ever unless they want the newfeature. I and like most of the
(10:48):
areas where I'm developing, likeenterprise, software y, you have
like SOC two or whatever, youknow, compliance framework that
like forces you to upgrade. Butthen it's like more of a
checkbox thing, you know what Imean?
Like, it's, oh, yeah, I have todo a safety check every now and
then, but I I won't actuallythink about it, because that's
not my focus. It is important toknow that the Geomiss project
(11:10):
usually, the open source workthey do is, like, scope is the
crypto libraries and the Gostandard library and cert
related stuff and YubiKeyrelated stuff, like, things that
people truly rely on, from asecurity perspective. So, I
(11:30):
think the standard should behigher. Like, it's great that
they're raising the standard. Idon't think everybody should
have this focus on, oh, mysupply chain should be the best.
For most people it doesn'tmatter as much, but I'm really
happy to see this part in thereading.
Jonathan Hall (11:45):
I think this is a good document for anybody who
has security concerns abouttheir code to look at, not to
implement as is, but to getideas for things they might be
overlooking with regard tosecurity in in their their code.
There's many other things here.I'm not gonna go into as much
detail on all of them, but theytalk about long lived
credentials and how they try toavoid those, how they do
(12:05):
security in in CI pipelines, howand when they grant third party
access to, you know, like GitHubtokens and stuff like that that
can modify the code, monitoring,logging, and and even even
licensing. So, I think it wouldbe rare that anybody would wanna
copy this exactly, but I thinkit's a great resource if you
(12:26):
work, whether it's an opensource project or even for your
internal code. There's probablysomething you could learn from
this and you might want to pickand choose two or three things
from this to implement on yourown projects.
Shay Nehmad (12:36):
And not to Like, I'm I'm in security. I learned
about a new tool here from this,this document. I learned about
ZisSmore. I haven't tried it yetbut, I I added it to my, like,
ever increasing to do list ofthings to check out. Yeah.
I've heard Which it is a good,opportunity to talk about why we
(12:57):
think Filippo is doing reallybad work on crypto. So we would
all this all this stuff was justlike, oh, so much attention, so
much work, so much like humanattention into crafting
incredible software. Then youadd it to the trail to the
backlog of things to talk aboutin the show. Oh, Filippo is vibe
coding all of our all of ourcrypto code. Yes.
(13:20):
I'm just I'm just click baiting.I'm just click baiting.
Jonathan Hall (13:23):
You are very click baiting. I don't think
vibe coding is the rightdescription, but let's let's
talk about this. So Filippo, hehe wrote this himself, so he's
telling us we're not we're notreading between the lines here.
Shay Nehmad (13:33):
Yeah. We we didn't we didn't like spy on him and
find and like by the way,Filippo, the new couch looks
great from the tree outsidewhere I'm sitting in with my
binoculars. Looks great. Switchthe pillows though. Anyway, what
has he been doing with Claude?
Jonathan Hall (13:51):
Yeah, so last week he wrote this blog post
called Claude Code Can Debug LowLevel Cryptography. And he goes
into some work he was doing on anew implementation of MLDSA. I
don't have any idea what thatis, except that it's a post
quantum signature algorithm. Buthe's working on that and there
was a hairy bug and he had adifficult time with it. And so
he started using Cloud Codeversion 2.0.28 with Opus 4.1,
(14:16):
and no system prompts and gaveit the following prompt.
Typos included. I implementedMLDSA in the Go Center library
and it all works except thatverification always rejects the
signatures. I know thesignatures are right because
they match the test vector. Youcan run the tests with bingo
test blah blah blah. You canfind the code in blah blah blah.
Look for potential reasons thesignatures don't verify.
(14:36):
UltraThink, I spot checked, andw one is different. I don't know
what that means, but it doesn'tmatter. To my surprise and this
is him speaking again. To mysurprise, I pinged it a few
minutes later.
It pinged me a few minutes laterwith a complete fix. Cloud Code
found the problem and fixed it.I think that's pretty amazing
because Cloud Code is mostlygood at adding bugs to my code,
it seems like.
Shay Nehmad (14:57):
I mean, if this is not proof that I hear a lot of
talk about, oh, it's gonnareplace, it's gonna, whatever.
But I think this is reallystrong proof that it can
augment. Like, Filippo,according to the blog, you know,
clearly a senior Go developer,we had him on the show,
whatever. He was tired and thenlet let the AI take over and the
(15:20):
AI was able to, like, within thecontext of him, like, giving all
the context and having all thecode, having all the tooling and
all the understanding andexactly, like, showing you how
to run the test and giving allthe context, whatever, managed
to basically generate, like, anhour's worth of work for him.
When he was too tired to do it.
Like, we wouldn't get thisvalue. Super surprising. But
(15:43):
then, obviously, he threw thefix away because the other the
actual fix was was better. Yeah.But it it saved all the
debugging.
Jonathan Hall (15:52):
But it found the solution. It found the problem
and, you know, it was still veryvaluable.
Shay Nehmad (15:56):
Very, very cool. It is important to know that, you
know, he discloses that he has afree key for Claude, Max, but
they didn't, like, pay him to doa sponsored segment or anything.
They just gave him the free,coupon. What do you think about
this?
Jonathan Hall (16:15):
So I've been using Claude a lot lately. It's
still very much an experiment.
Shay Nehmad (16:20):
Like Cloud Code?
Jonathan Hall (16:21):
Yeah. Cloud Code. And I don't know. I I have very
mixed results. Sometimes it'sgreat.
Sometimes it's terrible. I stilldon't know if it's a net
positive a net productivitygain. Certainly, there are times
when it definitely is,especially for like refactoring
where it's sort of roterepetition.
Shay Nehmad (16:40):
I have a guy on my team who's using Cloud Code and
he's using it, you know, he'sintegrated it with the various
MCPs, he has like customcommands, you'll sit at the
office and you'll hear likeCloud Code needs your attention.
Like his computer will yell athim. But I don't get it, I'm
still with Cursor, I'm workingwith like multiple sub agents,
but I need the IDE, I need tolike navigate between files and
(17:03):
look at the code, I can't justdo English. I don't know.
Jonathan Hall (17:06):
I don't know. I use Cloud Code Integrated with
my IDE, so I don't I don't knowwhat the difference is, but
there probably is one.
Shay Nehmad (17:12):
I I I still don't get it, but maybe I'll maybe
it's just, it's true thatdifferent tools for different
people. I use pretty much thesame MCPs and the same
capabilities. I do love the blogpost though, I think it's really
good. And also, you can look,the funny thing is you can look
at Filipa coding all this stuff.He has a link to his Twitch.
(17:35):
You can just watch, like, eighthour record four hour recordings
of him coding it live on Twitch,which I think is super cool as
well. Yeah. Part of thetransparency, I guess.
Jonathan Hall (17:48):
Yeah. So let's let's do a quick break, and then
we'll be back with another newsegment, I guess.
Shay Nehmad (17:54):
Alright. Let's go.
Jonathan Hall (18:02):
This week, we have a few new Patreons to
mention. I don't know if we'vementioned some of these before,
but it's okay if we have. It'sfine. Shiva Best. Thank you.
David Woodward Woodard. Sorry.There's only one one w in
Woodard. Ria Dennis? Ken Smith,Adam Arash.
I think that's an alias, not areal name, but based on the way
it's spelled. And JenniferJohnson, thank you all for
(18:25):
supporting the show.
Shay Nehmad (18:26):
We really, really appreciate it. There's two
subscription tiers in Patreonyou can use, the Cup O Gopher
and Cup O Gopher Mini. This isthe best way to support the
show, you know, this is a funhobby, but it's also a little
bit expensive, and this justhelps us, recoup some of our
costs. And by the way, don'twanna be, like, too pedantic,
(18:47):
but there are two d's inWoodard. One is w and one
Jonathan Hall (18:51):
Not two w's. Did I say d's?
Shay Nehmad (18:53):
Yes.
Jonathan Hall (18:53):
I thought I I had said Wood word, but Wood Nerd,
and I meant to
Shay Nehmad (18:58):
say there's not not two w's.
Jonathan Hall (18:59):
Thank you
Shay Nehmad (18:59):
so much.
Jonathan Hall (19:01):
It's four d's if you count the first name.
Shay Nehmad (19:03):
That's true. Anyway, that's the best way to
support the show. But if youwant to support the show in
other ways, find past episodes,buy new swag, find all the
links, transcripts, whatever,you can go to cupogo.dev, that
is cupogo.dev, or join our Slackchannel at cupogo in the go for
Slack. That's like kabobcasewith hyphens. And you can also
(19:25):
email us at news at cupogo.
Dev. How else can listeners whoare listening right now help the
show out?
Jonathan Hall (19:31):
You could leave a review. You could share the show
with your friends, yourcolleagues, your coworkers, your
student other students you arestudying with, a rating on
iTunes? I'm not in the Appleecosystem, know that's not the
name anymore.
Shay Nehmad (19:44):
Apple Podcasts, it's Apple Podcasts. There you
go. Okay. Or Spotify.
Jonathan Hall (19:48):
Or Spotify or all of those places. Yeah, spread
the word, basically, is kind ofwhat it comes down to.
Shay Nehmad (19:54):
By the way, we always say co students because
in my mind students arelistening and they could tell
the show like to their fellowstudents
Jonathan Hall (20:03):
at class. But
Shay Nehmad (20:04):
it could be your students if we have a professor,
like a Kopsai professorlistening
Jonathan Hall (20:09):
to
Shay Nehmad (20:09):
the show. Yeah. You you can make it required
listening and put it in the testat the end of the semester. We'd
be super happy if that's thecase.
Jonathan Hall (20:17):
Interesting.
Shay Nehmad (20:17):
And just mentioning in case you left, missed it in
the last few shows, I mentionedthe swag. We have a lot of new
swag. I'm just still wearing myCup Go hoodie, which I really
like, but if you visit the storelink, store.cupogo.dev, you'll
find the new sticker, which isthe Range Over Brewster
(20:38):
recursive Cup of Go sticker. Thenew cap, the new baseball cap,
it's embroidered, so it's like,looks really high quality, and
it is really high quality. I II've worn it on a few hikes
already.
It does protect you from thesun, as advertised. And some GO
socks you can wear on your onyour legs or your feet, which I
(20:58):
haven't tried yet. I don't knowif they're good, because I have
enough socks, so I didn't Ididn't order another pair. But
if any brave listeners wants toorder them and let us know if
they work well.
Jonathan Hall (21:09):
And send us a picture of you sporting the
socks, that would be great.
Shay Nehmad (21:12):
Yeah, for sure. Yeah, so that's everything. And
we just wanna say thanks forlistening. The show's been going
great lately, a lot oflistenership. I visited the
Transistor stats again.
It made me feel really good. Idon't know if you visited that
page recently.
Jonathan Hall (21:27):
Not lately.
Shay Nehmad (21:29):
I visited our, like, stats. Yeah. I haven't
done so in a while. Our all timedownloads have passed a 150,000
downloaded episodes.
Jonathan Hall (21:38):
Holy cow.
Shay Nehmad (21:39):
That's a lot. I don't know if it actually means
anything because, you know,downloads podcast statistics are
are always kind of funky. But,yeah, it looks like people enjoy
listening to the show,basically.
Jonathan Hall (21:52):
I I think what's might be more impressive is that
the average, downloads perepisode is now over 1,000.
Shay Nehmad (21:58):
That's really cool. That's really, really cool.
Jonathan Hall (22:00):
A little bit intimidating that
Shay Nehmad (22:02):
people are listening Thousand people. Well,
I'll I'll get excited when itpasses like a round number, like
a 24. Oh,
Jonathan Hall (22:11):
okay. Got
Shay Nehmad (22:11):
it. And thanks everybody for listening and
telling other people about theshow. And, you know, I always
like looking at the countries aswell, at the, like where we have
0.14, listenership in Chile orin Armenia or in Cyprus, 0.1.
Jonathan Hall (22:31):
I I wanna do a quick shout out to Moriah, who,
of course, is one of the coorganizers of the Go West
conference. She and I werechatting after the conference
when I was there a couple weeksago, and she just did a a she
said thank you to me personallyfor doing Cup of Go and that it
was expressed that it was, inher opinion, one of the
highlights of the Go community.So thanks, Moriah, for the
(22:52):
encouragement. And as far as Iknow, Shy and I will keep doing
it for a while. I don't thinkeither of us have plans to quit.
Shay Nehmad (22:57):
Alright. So in in great news, great timing, we're
moving on to the news. I'mquitting the show. No, I'm just
kidding.
Jonathan Hall (23:06):
It's about time. I've been looking for a new co
host
Shay Nehmad (23:08):
for a while. I can't with all this security
talk anymore. I It is importantto know that Utah is, like, I
think in the top 50% of stateslistening in The US. Alaska is
near the bottom. South Dakota.
(23:29):
South Dakota, you have some weneed to find gophers in South
Dakota. We have 0.02listenership there. But hey,
number one is my current homestate, California. Woo hoo.
Jonathan Hall (23:39):
We're the number one person.
Shay Nehmad (23:39):
Once again, California is the state in the
in America. All the all theAmerican listeners are like, New
York New York is at, numberthree. Maybe we should get the
new the new mayor to, like,sponsor a cup ago. We just
missed it. Like, we should havedone we should start doing
political some campaigndonations.
Alright. That's it for the adbreak.
Jonathan Hall (24:00):
We have
Shay Nehmad (24:00):
one more thing to talk about, so stick around.
Jonathan Hall (24:06):
So let's talk about GoPodcast and GoPodman or
or whatever this is.
Shay Nehmad (24:10):
Yes. You don't listen to other tech podcasts.
Right? Not so We we talked aboutthis a few times.
Jonathan Hall (24:16):
Yeah. Yeah. I sadly, I I wouldn't even listen
to my own podcast. It's not myit's not my genre.
Shay Nehmad (24:23):
I I think sometimes I ask you if you listen to
episodes where you're, like,sick or whatever or you're
traveling and I have someoneelse cohost instead
Jonathan Hall (24:30):
of I usually don't. I I spotless. Very
spotless. Yeah.
Shay Nehmad (24:34):
I do. I I I like listening to other podcasts in
general. Now that I moved to TheUS, I listen to a lot of, like,
Israeli podcasts, actually a lotmore than I used to, just to,
like, sort of stay in touch. Butrecently I, found out about Go
Podcast, which is Go, spacepodcast, open paren, clone close
paren. So, like, starting a Goroutine.
Jonathan Hall (24:56):
So you can listen to it in the background,
basically.
Shay Nehmad (24:58):
Yeah. You you can listen to it as a By the way,
shout out I don't know, like,what's the etiquette of in a
podcast shouting out anotherpodcast. I like it. I recommend
you listen to it. And, you know,it's another place to
Jonathan Hall (25:11):
be I think we're supposed to be mortal enemies.
Like, listen to our podcastinstead.
Shay Nehmad (25:15):
Yeah. I don't know. It's pretty good though. It's
pretty good. So you shouldprobably listen to it.
It's a Dominique St Pierre, justdoing like episodes about Go.
There's also a channel in the Gofor Slack, the way, Go Go
podcast, I wonder if any of ourlisteners accidentally went
there or the other way around.But yeah, it's a pretty good
(25:35):
show. It's either, like, shorterepisodes where Dominique shares
something or slightly longerepisodes with an interview. And
in episode 64, he talked aboutPodman, the ruthless alternative
to Docker.
And Dominique, he said youwanted some audio snippets you
could put in the show for, like,a bit of a more dynamic
(25:57):
approach. Feel free to take allthe audio you're you're hearing
right now and put it in theshow. We love Go Pod I love Go
Podcast. I think it's a reallygood podcast.
Jonathan Hall (26:06):
If you wanna upload this whole episode to
your channel, that's fine.
Shay Nehmad (26:11):
I don't know about that. That's exactly what
Filippo was worrying about withsupply chain attacks. People
will just load this latest andgreatest podcast episode,
they'll get a totally differentepisode. That's a good idea.
Fishing via podcasting.
Jonathan Hall (26:29):
There we go.
Shay Nehmad (26:29):
Podfishing, the the latest craze. So I wanted to ask
you about Docker.
Jonathan Hall (26:35):
Do you use while ago, Typosquad go the the Go
podcast channel on the Go forPlug.
Shay Nehmad (26:41):
Do you use Docker?
Jonathan Hall (26:42):
I use Docker quite a bit. Yes.
Shay Nehmad (26:44):
Have you ever considered any Docker
alternatives?
Jonathan Hall (26:47):
Yes. I used one many years ago. I don't remember
what it was called, but it wasjust for building Docker images.
It wasn't for the runtime. Itwas just for building Docker
images.
And that was because it wasfaster, but it had a lot of
limitations that made it notuseful in most scenarios. And I
don't know what the state istoday, but
Shay Nehmad (27:03):
So the episode in question, episode 64 of Go
Podcast talks about Podman,which is a ruthless alternative
to Docker, which led me down alittle rabbit hole. In my
company we use Docker right now.The way we use Docker is we run
Postgres locally. So, I think asuper bog standard way, you
know, you run Postgres locallyfor your local application,
(27:28):
right? What could you want?
You could want better startuptime, because when you're
starting up your Mac and thenbooting up Docker Desktop, it
takes like fifteen seconds toload. And I have the latest and
greatest M4 Pro blah blah blah,it's not a resource issue. You
could want less of a resourcefootprint, so you can run a lot
of these at the same time,right, without a lot of
(27:49):
overhead. And you'd basicallywant this to work with all the
Docker commands you're alreadyused to, because everything
already works like that andeverybody is experienced with
that. Dominic mentions Podman,I've never tried it, but it led
me down this rabbit hole offinding OrbStack, which I
remembered someone told meabout.
I was like, oh, I should reallytry it. And then I was like,
(28:11):
what I usually when you findwhen you are, like, considering
a new technology or a new tool,what's the first thing you're
searching for?
Jonathan Hall (28:19):
I like, literally, what do I search for
in the search bar?
Shay Nehmad (28:23):
Yeah. Like, what what do you what do you wanna
find before you
Jonathan Hall (28:25):
I try usually type the name of the technology
versus and see what autocompletepops up to give me a list of of
alternatives.
Shay Nehmad (28:32):
So that's crazy because that's exactly what I
did. And I found Orbstack,Podman, Docker and Colima.
Jonathan Hall (28:39):
Okay.
Shay Nehmad (28:39):
And then the second thing I do is I type the name of
the technology I wanna checkright now, space Reddit. Then I
start looking for it in Reddit.But I don't think that works
anymore, man. I think, like,companies have wised up to that.
They, like, pay people to do itand they have a lot of AI
writing, like, good reviewsthere.
So, I don't know, I need atrusted source. So, I looked at,
like, Orbstack, apparently it'spaid, so I don't think I have
(29:03):
enough pain with Docker Desktopto to justify paying, like, $8 a
month for Orbstack or whatever.
Jonathan Hall (29:09):
So, what's the what's the pain that you had
considered Podman in the firstplace?
Shay Nehmad (29:14):
I just want it to run faster. It's just, like,
kinda slow, and takes up a lotof power and resources
Jonathan Hall (29:22):
Is that, for my like, run is running as slow? Is
that because you're on an M4 andthere's that translation layer
or something, or
Shay Nehmad (29:28):
It's building Dockers, I wanna build my own
because because we're runningour containers in Azure
Container App, so we have tocontainerize them. Yep. And it's
going a bit slow. I think it'srelated to the m one thing, to,
like, the, Apple Silicon thing,but not only. Yeah.
(29:49):
Uh-huh. But also just, like,startup time. I wanna start for
Postgres. I want it to startjust Yeah. Like, in in zero
milliseconds.
And if I installed the C binaryof Postgres on my machine and I
would start it, it had it wouldhave zero, like, downtime before
being ready to acceptconnections. But time, I went
with Docker, you have to pull itand okay. So I have the image
(30:11):
already pulled. And then Istarted and then it's like,
Docker Compose is starting. Andoh, you forgot to turn on Docker
desktop.
I opened Docker desktop, oh, youneed to update. It's like, takes
three minutes to update. Boom.I'm my I'm already on something
else. I, like, lost my focus.
And the other thing is that Iuse test containers.
Jonathan Hall (30:26):
I do too.
Shay Nehmad (30:27):
So, the startup time of the container actually
impacts my end to end test runtime. But in that case, I talked
to you about this in the past, Iwant I just don't wanna use a
container at all. I wanted touse, like, an in memory Postgres
implementation. Sure. But Ihaven't gotten around to that
yet, and I never will.
Jonathan Hall (30:42):
I will often use persistent containers that stick
around for ten minutes or even aday, and then I can get rid of
that startup time at the expenseof it's running in the
background all the time. Andmaybe that matters if you don't
have a lot of memory orsomething.
Shay Nehmad (30:55):
I just want, like, 15 of them, but because I run
the tests, as many cores as Ihave minus one. So for me, it's
like 15, but but that's a goodidea as well. But it's just so
fussy with, with Docker. Iwanted to see if there's
something better. It's a tool Iuse all the time.
It's not a big pain, but thisepisode from Go Podcast brought
(31:16):
it to my intention. You're justusing, like, rock and playing
Docker, right?
Jonathan Hall (31:20):
I use playing Docker. I have I've I hear
people complain about Dockerdesktop. I've literally never
used Docker desktop and can'timagine why I would ever want
to, like, I don't know whatproblem it solves, so
Shay Nehmad (31:28):
It's a good chance to mention you're on Linux,
right?
Jonathan Hall (31:32):
Does that make a difference So,
Shay Nehmad (31:32):
solves problems of, people not using Linux. No other
way to run the Docker containeron the Mac. You have to install
the desktop version.
Jonathan Hall (31:41):
Well, that's ridiculous.
Shay Nehmad (31:43):
But that's, again, also another pain, like, every
developer that comes to the tothe company has to install this,
like, GUI desktop application,and when you open it, it, like,
suggests you log in to theDocker container registry, we're
using, like, your users, so youstart paying.
Jonathan Hall (31:59):
Can't you just run a VM or something and run
your Docker stuff in a Linux VM?
Shay Nehmad (32:04):
I mean, you want it to run as close to your software
as possible, I feel. Like, don'twant it behind another VM and
another blah blah, just to avoidthe pain of installing this app.
But I'm looking into Colima, Imight even try it today, which
is container run runtimes formacOS, which is open source. So,
I think I might try this,version next. And all this
(32:26):
experimentation is thanks tothis podcast.
So, maybe you should startlistening to tech podcasts, man.
Jonathan Hall (32:32):
But maybe I should, but it sounds like
you're solving a bunch ofproblems I don't have because I
use Linux.
Shay Nehmad (32:40):
Skill issue. You heard it here first.
Jonathan Hall (32:42):
It's a
Shay Nehmad (32:42):
skill issue. If you're listening Hey, listeners,
if you're listening to techpodcasts, you're just not
skilled enough. That's whatJonathan Hall is saying.
Jonathan Hall (32:49):
That's right, that's right.
Shay Nehmad (32:50):
Alright. I think that does it for the show. Maybe
we'll do a lightning round nexttime.
Jonathan Hall (32:56):
Let's do it next time.
Shay Nehmad (32:57):
Thanks a lot for listening, everybody. Program
exited. Program exited. Goodbye.
This show is supported by you. Stick around
(00:02):
till the outbreak to hear moreabout that. This is Capu Go for
11/07/2025. Keep up to date withthe important happenings in the
Go community in about fifteenminutes per week. I'm Shay
(00:23):
Nehmad.
And I'm Jonathan Hall. And I'mcompensating for feeling a
little sick. Yes. No worry. Inthree minutes, the energy is
gonna come back to, you know,back to the meme.
I am excited for this, new patchrelease because it's not
(00:44):
strictly a security release thistime. Woah. Yeah, let me tell
you about it. So, it's actuallybugs from the security release.
No, and some other bugs, likethis is not normally what we see
in patch releases, but there's alot of, I call it bugs, but it's
not like, it's like edge casesthat were eventually found,
(01:05):
feels to me, in the compiler andthe linker and in the net
library.
So I picked three that I liked.
Jonathan Hall (01:11):
Would you say these are subtle bugs? Yeah.
Yeah. Because one of them is inthe crypto subtle package.
Shay Nehmad (01:19):
The ones that are in the subtle, I just the ones
that are in crypto, I just glazeover. I have no, no way to parse
them even. But I wanted to sortof quiz you to see if you would
have been able to evenunderstand that these are bug.
Jonathan Hall (01:34):
Try me.
Shay Nehmad (01:35):
So, let me, this is gonna make for great audio, by
the Let me read you this HTTPaddress and you let me know if
you think it's correct.
Jonathan Hall (01:46):
I'll tell you right now, it's not correct. Can
tell you right now.
Shay Nehmad (01:51):
Alright, alright. You're putting your bed right
now even before I start readingit? I am, yes. Alright, let's
check. Httpscolon/slash.
That's that's fine, right?That's all.
Jonathan Hall (02:02):
Yeah, that
Shay Nehmad (02:02):
seemed good. Open square brackets.
Jonathan Hall (02:05):
Okay.
Shay Nehmad (02:06):
Colon colon.
Jonathan Hall (02:07):
Okay.
Shay Nehmad (02:08):
FFFF colon. Uh-huh. One nine two dot zero dot two
dot one, close square brackets.
Jonathan Hall (02:16):
Sounds like it's an IPv6 that a
Shay Nehmad (02:18):
valid address or no?
Jonathan Hall (02:19):
It sounds like an IPv6 address, but I don't know.
My IPv6 But it ends with,
Shay Nehmad (02:24):
with, IPv4 address. So it it starts with a thing
that looks like, you know, thecolon colon ffff.
Jonathan Hall (02:31):
Uh-huh.
Shay Nehmad (02:32):
After the last colon, it's an IPv4 address, one
eighty two dot zero the one.
Jonathan Hall (02:36):
I'll tell you, if if I were to counter that, I
would assume it was a spammer ora a scammer and I would just
skip it, whether it waslegitimate, like, syntactically
correct or not. That's about asfar as I would get with thinking
it through.
Shay Nehmad (02:49):
So, the Go runtime agrees with you. Okay. Which is
why in a recent fix to avulnerability, which I even
think we discussed on the show,like in passing, Uh-huh. That
the parse function permitsvalues that aren't IPv6 Uh-huh.
In the host component in thesquare brackets.
Someone added this this exacttest case to the URL test parse
(03:11):
function and said, like, false,this should return false, this
shouldn't work. And then,Hartwork, which is Sebastien
Pipping doing open source workin the Free Software Foundation,
Europe from Berlin, was justlike, hey, this is not actually
true because you can put IPv4addresses inside IPv6 addresses
(03:32):
and that is legitimate. Look atRFC three thousand nine eighty
six. You know me, the moment weopen RFCs I'm happy, I'm a happy
camper. So, yeah, this isactually a valid address and a
recent security fix they made itlike, oh, this shouldn't work.
But it actually should work.Yeah, very, very surprising
behavior for sure. I would beable to read these addresses, I
(03:52):
hope I'll never have toimplement this parser. Luckily I
don't have to because Sebastianalready implemented URI parser,
which is a strict RFC compliantURI parser, written in like C.
So, he knows what he's talkingabout, I hope at least.
Cool. On the end, by the way, ifyou thought, like, this IPv6
(04:13):
syntax is pretty complicated,here's another, like, riddle for
you.
Jonathan Hall (04:17):
Okay.
Shay Nehmad (04:18):
That they resolved that they resolved in, in this,
release. Do you know the any,keyword?
Jonathan Hall (04:26):
Yeah. The All right. Like the empty interface,
right? Yeah. Yeah, yeah.
Shay Nehmad (04:30):
So, any, that accepts an empty function equals
equals any ex empty function.
Jonathan Hall (04:38):
Say it again.
Shay Nehmad (04:38):
What what should it return? You're, comparing
Comparing two empty. Tointerface values, basically.
Jonathan Hall (04:44):
I don't have any idea what that should return. I
don't think comparing interfacevalues is necessarily supported
or I I don't know what thatdoes.
Shay Nehmad (04:53):
So it should panic. The documentation says, oh, if
you compare it to interfacevalues with identical dynamic
types, you should have a runtimepanic. Okay. And we just forgot
to implement it. So someone waslike, hey, I found this.
Like, the code is it's so funny,you see the issue, it's like,
what do you see happen? The codeis working without problem, what
(05:14):
do you expect to see? It shouldpanic. It's like a completely
the opposite way, but this issomething that, like, regressed
in 1.25 because 1.24 it doespanic. It was just a bug in the
compiler and someone, someonebisect it to find the specific
(05:35):
commit, which is by the way atrick I love using whenever I
use git bisect.
Feel super smart. It turned outto be an optimization. So they
added an optimization, you know,in in some super internal, like,
reflect dot, Go in the internalcompiler. And Alan Donovan
(05:57):
summarized it very nicely in theGitHub. He's like, no good
optimization goes unpunished.
Jonathan Hall (06:04):
I'm a little surprised that they didn't have
a test covering that already.That seems like something like,
I don't know, when I'mimplementing the spec, I would
be like, yeah, let's make surethat this really simple obvious
case works, but okay.
Shay Nehmad (06:14):
So I don't know what would, you know, cause
someone to write such code. Thisis like nonsense You would never
write it in production. It'sjust like an edge case you have
to cover.
Jonathan Hall (06:24):
Maybe Claude was writing it.
Shay Nehmad (06:26):
Oh, that's that's a good segue. I don't think Claude
should do software.
Jonathan Hall (06:33):
Foreshadowing.
Shay Nehmad (06:34):
So anyway, there's a new release with these super
esoteric bug fixes, and I likeour recommendation to, you
should upgrade because it hassecurity fixes. If these bug hit
your code, man, what are youwriting? Jesus. But still
probably good to upgrade. Andthis was back ported, so it's on
1.24 as well.
That's it about the new release.
Jonathan Hall (06:55):
Nice. So I I guess we'll try to I'm gonna
return this as a useful segue.Next, I wanna talk about
standards of code. Codestandards, I guess.
Shay Nehmad (07:05):
Oh.
Jonathan Hall (07:06):
Yeah. So long, long time ago, you know, in
Galaxy Far Away, we had FilippoValsorta on the show, and he
talked about his open sourcework. He does a lot of crypto
work for the Go centered libraryand some other work, and he he
makes his money doing that,right? So he has recently
released his standard of carethat he and his his group
Shay Nehmad (07:26):
of Manifesto.
Jonathan Hall (07:27):
Open source folks adhere to. Yeah. He has a
manifesto. It's called theGeomys. Is that how you
pronounce this?
G e o m y s, Geomys Standard ofCare. And it just sort of
outlines for all to see how theygo about maintaining high
quality code. And there's somethings in here that might be a
little bit surprising to somefolks. One of the first things
(07:49):
that jumps out at me was theydon't use Dependabot, which I
think a lot of people use. It'skind of the standard tool to
make sure you're always running,you know, the latest and
greatest software.
You're a security guy, Shay. Ibet you can think of reasons not
to use Dependabot, but I'mcurious if you know the same
reasons he doesn't use it. Whatdo you think?
Shay Nehmad (08:07):
First of all, increased churn part, like
Dependabot is shoving PRs atyour face and it's, like,
automated so you trustDependabot is, for now, I'm I'm
not, like, bashing GitHub.Right? This is true for Snyk.
This is true for all the otherapplication security companies.
You get these PRs, at some pointyou just start approving them.
(08:28):
It just doesn't make sense toreview every single release. And
also, I like the approach of itincreases the risk of supply
chain. Like, if you have amodule that you vetted, you went
into the code, you went intoGitHub, you double checked the
hashes, whatever, and then someautomated tools offers you to
upgrade, you're like, this whatif this new version has a
(08:53):
vulnerability that hasn't beendiscovered yet? Like, what
shouldn't I let it cook for awhile and upgrade only when I
need to? There is the flip sideof that.
Oh, they mentioned anotherthing, which I don't care about
because I don't work in opensource right now. But if I
worked in open source, I would.It's very easy to impersonate
Dependabot. You can just createa user and name it Dependabot or
(09:15):
any other similar, like,application security tool, six
months opening proper PRslooking like an automated tool.
Uh-huh.
Or even legitimately, likebuilding these application
security tools is not that hard,to be honest. Yeah. So just like
building a tool that opens thisPR for real for six months,
(09:36):
gaining like reputation as areal tool and then starting to
inject, like, bad dependency.
Jonathan Hall (09:42):
Oh, wow.
Shay Nehmad (09:42):
These are all legitimate concerns. I mostly
care about the, the first twobecause I work in Closos right
now. Mhmm. But it's not likethey're not doing anything at
all on the on the readme. It'snot readme.
Oh, it is a readme. On thestandard of care project,
they're saying like, oh, we run,go vuln check. We they check
like a high signal to noise,notification to find actual
(10:07):
vulnerable dependencies. Yep.And they also run their CI with
the latest version.
So if they need to upgrade, theyit's it's easy. It's not a big
deal.
Jonathan Hall (10:16):
Well, and and more more than just if they need
to upgrade, but, like, if if oneof the consumers of the library
is using the latest version,they're not they know they're
not gonna be broken, right? Sothat's
Shay Nehmad (10:25):
also I think that's actually a a more sophisticated
and smarter approach todependency management than most,
people use. Most people, Iassume, don't actually care
about this stuff and just dowhatever policy they have to
adhere to. So if their companyor whatever they work on don't
have a dependency managementpolicy, they just won't upgrade
ever unless they want the newfeature. I and like most of the
(10:48):
areas where I'm developing, likeenterprise, software y, you have
like SOC two or whatever, youknow, compliance framework that
like forces you to upgrade. Butthen it's like more of a
checkbox thing, you know what Imean?
Like, it's, oh, yeah, I have todo a safety check every now and
then, but I I won't actuallythink about it, because that's
not my focus. It is important toknow that the Geomiss project
(11:10):
usually, the open source workthey do is, like, scope is the
crypto libraries and the Gostandard library and cert
related stuff and YubiKeyrelated stuff, like, things that
people truly rely on, from asecurity perspective. So, I
(11:30):
think the standard should behigher. Like, it's great that
they're raising the standard. Idon't think everybody should
have this focus on, oh, mysupply chain should be the best.
For most people it doesn'tmatter as much, but I'm really
happy to see this part in thereading.
Jonathan Hall (11:45):
I think this is a good document for anybody who
has security concerns abouttheir code to look at, not to
implement as is, but to getideas for things they might be
overlooking with regard tosecurity in in their their code.
There's many other things here.I'm not gonna go into as much
detail on all of them, but theytalk about long lived
credentials and how they try toavoid those, how they do
(12:05):
security in in CI pipelines, howand when they grant third party
access to, you know, like GitHubtokens and stuff like that that
can modify the code, monitoring,logging, and and even even
licensing. So, I think it wouldbe rare that anybody would wanna
copy this exactly, but I thinkit's a great resource if you
(12:26):
work, whether it's an opensource project or even for your
internal code. There's probablysomething you could learn from
this and you might want to pickand choose two or three things
from this to implement on yourown projects.
Shay Nehmad (12:36):
And not to Like, I'm I'm in security. I learned
about a new tool here from this,this document. I learned about
ZisSmore. I haven't tried it yetbut, I I added it to my, like,
ever increasing to do list ofthings to check out. Yeah.
I've heard Which it is a good,opportunity to talk about why we
(12:57):
think Filippo is doing reallybad work on crypto. So we would
all this all this stuff was justlike, oh, so much attention, so
much work, so much like humanattention into crafting
incredible software. Then youadd it to the trail to the
backlog of things to talk aboutin the show. Oh, Filippo is vibe
coding all of our all of ourcrypto code. Yes.
(13:20):
I'm just I'm just click baiting.I'm just click baiting.
Jonathan Hall (13:23):
You are very click baiting. I don't think
vibe coding is the rightdescription, but let's let's
talk about this. So Filippo, hehe wrote this himself, so he's
telling us we're not we're notreading between the lines here.
Shay Nehmad (13:33):
Yeah. We we didn't we didn't like spy on him and
find and like by the way,Filippo, the new couch looks
great from the tree outsidewhere I'm sitting in with my
binoculars. Looks great. Switchthe pillows though. Anyway, what
has he been doing with Claude?
Jonathan Hall (13:51):
Yeah, so last week he wrote this blog post
called Claude Code Can Debug LowLevel Cryptography. And he goes
into some work he was doing on anew implementation of MLDSA. I
don't have any idea what thatis, except that it's a post
quantum signature algorithm. Buthe's working on that and there
was a hairy bug and he had adifficult time with it. And so
he started using Cloud Codeversion 2.0.28 with Opus 4.1,
(14:16):
and no system prompts and gaveit the following prompt.
Typos included. I implementedMLDSA in the Go Center library
and it all works except thatverification always rejects the
signatures. I know thesignatures are right because
they match the test vector. Youcan run the tests with bingo
test blah blah blah. You canfind the code in blah blah blah.
Look for potential reasons thesignatures don't verify.
(14:36):
UltraThink, I spot checked, andw one is different. I don't know
what that means, but it doesn'tmatter. To my surprise and this
is him speaking again. To mysurprise, I pinged it a few
minutes later.
It pinged me a few minutes laterwith a complete fix. Cloud Code
found the problem and fixed it.I think that's pretty amazing
because Cloud Code is mostlygood at adding bugs to my code,
it seems like.
Shay Nehmad (14:57):
I mean, if this is not proof that I hear a lot of
talk about, oh, it's gonnareplace, it's gonna, whatever.
But I think this is reallystrong proof that it can
augment. Like, Filippo,according to the blog, you know,
clearly a senior Go developer,we had him on the show,
whatever. He was tired and thenlet let the AI take over and the
(15:20):
AI was able to, like, within thecontext of him, like, giving all
the context and having all thecode, having all the tooling and
all the understanding andexactly, like, showing you how
to run the test and giving allthe context, whatever, managed
to basically generate, like, anhour's worth of work for him.
When he was too tired to do it.
Like, we wouldn't get thisvalue. Super surprising. But
(15:43):
then, obviously, he threw thefix away because the other the
actual fix was was better. Yeah.But it it saved all the
debugging.
Jonathan Hall (15:52):
But it found the solution. It found the problem
and, you know, it was still veryvaluable.
Shay Nehmad (15:56):
Very, very cool. It is important to know that, you
know, he discloses that he has afree key for Claude, Max, but
they didn't, like, pay him to doa sponsored segment or anything.
They just gave him the free,coupon. What do you think about
this?
Jonathan Hall (16:15):
So I've been using Claude a lot lately. It's
still very much an experiment.
Shay Nehmad (16:20):
Like Cloud Code?
Jonathan Hall (16:21):
Yeah. Cloud Code. And I don't know. I I have very
mixed results. Sometimes it'sgreat.
Sometimes it's terrible. I stilldon't know if it's a net
positive a net productivitygain. Certainly, there are times
when it definitely is,especially for like refactoring
where it's sort of roterepetition.
Shay Nehmad (16:40):
I have a guy on my team who's using Cloud Code and
he's using it, you know, he'sintegrated it with the various
MCPs, he has like customcommands, you'll sit at the
office and you'll hear likeCloud Code needs your attention.
Like his computer will yell athim. But I don't get it, I'm
still with Cursor, I'm workingwith like multiple sub agents,
but I need the IDE, I need tolike navigate between files and
(17:03):
look at the code, I can't justdo English. I don't know.
Jonathan Hall (17:06):
I don't know. I use Cloud Code Integrated with
my IDE, so I don't I don't knowwhat the difference is, but
there probably is one.
Shay Nehmad (17:12):
I I I still don't get it, but maybe I'll maybe
it's just, it's true thatdifferent tools for different
people. I use pretty much thesame MCPs and the same
capabilities. I do love the blogpost though, I think it's really
good. And also, you can look,the funny thing is you can look
at Filipa coding all this stuff.He has a link to his Twitch.
(17:35):
You can just watch, like, eighthour record four hour recordings
of him coding it live on Twitch,which I think is super cool as
well. Yeah. Part of thetransparency, I guess.
Jonathan Hall (17:48):
Yeah. So let's let's do a quick break, and then
we'll be back with another newsegment, I guess.
Shay Nehmad (17:54):
Alright. Let's go.
Jonathan Hall (18:02):
This week, we have a few new Patreons to
mention. I don't know if we'vementioned some of these before,
but it's okay if we have. It'sfine. Shiva Best. Thank you.
David Woodward Woodard. Sorry.There's only one one w in
Woodard. Ria Dennis? Ken Smith,Adam Arash.
I think that's an alias, not areal name, but based on the way
it's spelled. And JenniferJohnson, thank you all for
(18:25):
supporting the show.
Shay Nehmad (18:26):
We really, really appreciate it. There's two
subscription tiers in Patreonyou can use, the Cup O Gopher
and Cup O Gopher Mini. This isthe best way to support the
show, you know, this is a funhobby, but it's also a little
bit expensive, and this justhelps us, recoup some of our
costs. And by the way, don'twanna be, like, too pedantic,
(18:47):
but there are two d's inWoodard. One is w and one
Jonathan Hall (18:51):
Not two w's. Did I say d's?
Shay Nehmad (18:53):
Yes.
Jonathan Hall (18:53):
I thought I I had said Wood word, but Wood Nerd,
and I meant to
Shay Nehmad (18:58):
say there's not not two w's.
Jonathan Hall (18:59):
Thank you
Shay Nehmad (18:59):
so much.
Jonathan Hall (19:01):
It's four d's if you count the first name.
Shay Nehmad (19:03):
That's true. Anyway, that's the best way to
support the show. But if youwant to support the show in
other ways, find past episodes,buy new swag, find all the
links, transcripts, whatever,you can go to cupogo.dev, that
is cupogo.dev, or join our Slackchannel at cupogo in the go for
Slack. That's like kabobcasewith hyphens. And you can also
(19:25):
email us at news at cupogo.
Dev. How else can listeners whoare listening right now help the
show out?
Jonathan Hall (19:31):
You could leave a review. You could share the show
with your friends, yourcolleagues, your coworkers, your
student other students you arestudying with, a rating on
iTunes? I'm not in the Appleecosystem, know that's not the
name anymore.
Shay Nehmad (19:44):
Apple Podcasts, it's Apple Podcasts. There you
go. Okay. Or Spotify.
Jonathan Hall (19:48):
Or Spotify or all of those places. Yeah, spread
the word, basically, is kind ofwhat it comes down to.
Shay Nehmad (19:54):
By the way, we always say co students because
in my mind students arelistening and they could tell
the show like to their fellowstudents
Jonathan Hall (20:03):
at class. But
Shay Nehmad (20:04):
it could be your students if we have a professor,
like a Kopsai professorlistening
Jonathan Hall (20:09):
to
Shay Nehmad (20:09):
the show. Yeah. You you can make it required
listening and put it in the testat the end of the semester. We'd
be super happy if that's thecase.
Jonathan Hall (20:17):
Interesting.
Shay Nehmad (20:17):
And just mentioning in case you left, missed it in
the last few shows, I mentionedthe swag. We have a lot of new
swag. I'm just still wearing myCup Go hoodie, which I really
like, but if you visit the storelink, store.cupogo.dev, you'll
find the new sticker, which isthe Range Over Brewster
(20:38):
recursive Cup of Go sticker. Thenew cap, the new baseball cap,
it's embroidered, so it's like,looks really high quality, and
it is really high quality. I II've worn it on a few hikes
already.
It does protect you from thesun, as advertised. And some GO
socks you can wear on your onyour legs or your feet, which I
(20:58):
haven't tried yet. I don't knowif they're good, because I have
enough socks, so I didn't Ididn't order another pair. But
if any brave listeners wants toorder them and let us know if
they work well.
Jonathan Hall (21:09):
And send us a picture of you sporting the
socks, that would be great.
Shay Nehmad (21:12):
Yeah, for sure. Yeah, so that's everything. And
we just wanna say thanks forlistening. The show's been going
great lately, a lot oflistenership. I visited the
Transistor stats again.
It made me feel really good. Idon't know if you visited that
page recently.
Jonathan Hall (21:27):
Not lately.
Shay Nehmad (21:29):
I visited our, like, stats. Yeah. I haven't
done so in a while. Our all timedownloads have passed a 150,000
downloaded episodes.
Jonathan Hall (21:38):
Holy cow.
Shay Nehmad (21:39):
That's a lot. I don't know if it actually means
anything because, you know,downloads podcast statistics are
are always kind of funky. But,yeah, it looks like people enjoy
listening to the show,basically.
Jonathan Hall (21:52):
I I think what's might be more impressive is that
the average, downloads perepisode is now over 1,000.
Shay Nehmad (21:58):
That's really cool. That's really, really cool.
Jonathan Hall (22:00):
A little bit intimidating that
Shay Nehmad (22:02):
people are listening Thousand people. Well,
I'll I'll get excited when itpasses like a round number, like
a 24. Oh,
Jonathan Hall (22:11):
okay. Got
Shay Nehmad (22:11):
it. And thanks everybody for listening and
telling other people about theshow. And, you know, I always
like looking at the countries aswell, at the, like where we have
0.14, listenership in Chile orin Armenia or in Cyprus, 0.1.
Jonathan Hall (22:31):
I I wanna do a quick shout out to Moriah, who,
of course, is one of the coorganizers of the Go West
conference. She and I werechatting after the conference
when I was there a couple weeksago, and she just did a a she
said thank you to me personallyfor doing Cup of Go and that it
was expressed that it was, inher opinion, one of the
highlights of the Go community.So thanks, Moriah, for the
(22:52):
encouragement. And as far as Iknow, Shy and I will keep doing
it for a while. I don't thinkeither of us have plans to quit.
Shay Nehmad (22:57):
Alright. So in in great news, great timing, we're
moving on to the news. I'mquitting the show. No, I'm just
kidding.
Jonathan Hall (23:06):
It's about time. I've been looking for a new co
host
Shay Nehmad (23:08):
for a while. I can't with all this security
talk anymore. I It is importantto know that Utah is, like, I
think in the top 50% of stateslistening in The US. Alaska is
near the bottom. South Dakota.
(23:29):
South Dakota, you have some weneed to find gophers in South
Dakota. We have 0.02listenership there. But hey,
number one is my current homestate, California. Woo hoo.
Jonathan Hall (23:39):
We're the number one person.
Shay Nehmad (23:39):
Once again, California is the state in the
in America. All the all theAmerican listeners are like, New
York New York is at, numberthree. Maybe we should get the
new the new mayor to, like,sponsor a cup ago. We just
missed it. Like, we should havedone we should start doing
political some campaigndonations.
Alright. That's it for the adbreak.
Jonathan Hall (24:00):
We have
Shay Nehmad (24:00):
one more thing to talk about, so stick around.
Jonathan Hall (24:06):
So let's talk about GoPodcast and GoPodman or
or whatever this is.
Shay Nehmad (24:10):
Yes. You don't listen to other tech podcasts.
Right? Not so We we talked aboutthis a few times.
Jonathan Hall (24:16):
Yeah. Yeah. I sadly, I I wouldn't even listen
to my own podcast. It's not myit's not my genre.
Shay Nehmad (24:23):
I I think sometimes I ask you if you listen to
episodes where you're, like,sick or whatever or you're
traveling and I have someoneelse cohost instead
Jonathan Hall (24:30):
of I usually don't. I I spotless. Very
spotless. Yeah.
Shay Nehmad (24:34):
I do. I I I like listening to other podcasts in
general. Now that I moved to TheUS, I listen to a lot of, like,
Israeli podcasts, actually a lotmore than I used to, just to,
like, sort of stay in touch. Butrecently I, found out about Go
Podcast, which is Go, spacepodcast, open paren, clone close
paren. So, like, starting a Goroutine.
Jonathan Hall (24:56):
So you can listen to it in the background,
basically.
Shay Nehmad (24:58):
Yeah. You you can listen to it as a By the way,
shout out I don't know, like,what's the etiquette of in a
podcast shouting out anotherpodcast. I like it. I recommend
you listen to it. And, you know,it's another place to
Jonathan Hall (25:11):
be I think we're supposed to be mortal enemies.
Like, listen to our podcastinstead.
Shay Nehmad (25:15):
Yeah. I don't know. It's pretty good though. It's
pretty good. So you shouldprobably listen to it.
It's a Dominique St Pierre, justdoing like episodes about Go.
There's also a channel in the Gofor Slack, the way, Go Go
podcast, I wonder if any of ourlisteners accidentally went
there or the other way around.But yeah, it's a pretty good
(25:35):
show. It's either, like, shorterepisodes where Dominique shares
something or slightly longerepisodes with an interview. And
in episode 64, he talked aboutPodman, the ruthless alternative
to Docker.
And Dominique, he said youwanted some audio snippets you
could put in the show for, like,a bit of a more dynamic
(25:57):
approach. Feel free to take allthe audio you're you're hearing
right now and put it in theshow. We love Go Pod I love Go
Podcast. I think it's a reallygood podcast.
Jonathan Hall (26:06):
If you wanna upload this whole episode to
your channel, that's fine.
Shay Nehmad (26:11):
I don't know about that. That's exactly what
Filippo was worrying about withsupply chain attacks. People
will just load this latest andgreatest podcast episode,
they'll get a totally differentepisode. That's a good idea.
Fishing via podcasting.
Jonathan Hall (26:29):
There we go.
Shay Nehmad (26:29):
Podfishing, the the latest craze. So I wanted to ask
you about Docker.
Jonathan Hall (26:35):
Do you use while ago, Typosquad go the the Go
podcast channel on the Go forPlug.
Shay Nehmad (26:41):
Do you use Docker?
Jonathan Hall (26:42):
I use Docker quite a bit. Yes.
Shay Nehmad (26:44):
Have you ever considered any Docker
alternatives?
Jonathan Hall (26:47):
Yes. I used one many years ago. I don't remember
what it was called, but it wasjust for building Docker images.
It wasn't for the runtime. Itwas just for building Docker
images.
And that was because it wasfaster, but it had a lot of
limitations that made it notuseful in most scenarios. And I
don't know what the state istoday, but
Shay Nehmad (27:03):
So the episode in question, episode 64 of Go
Podcast talks about Podman,which is a ruthless alternative
to Docker, which led me down alittle rabbit hole. In my
company we use Docker right now.The way we use Docker is we run
Postgres locally. So, I think asuper bog standard way, you
know, you run Postgres locallyfor your local application,
(27:28):
right? What could you want?
You could want better startuptime, because when you're
starting up your Mac and thenbooting up Docker Desktop, it
takes like fifteen seconds toload. And I have the latest and
greatest M4 Pro blah blah blah,it's not a resource issue. You
could want less of a resourcefootprint, so you can run a lot
of these at the same time,right, without a lot of
(27:49):
overhead. And you'd basicallywant this to work with all the
Docker commands you're alreadyused to, because everything
already works like that andeverybody is experienced with
that. Dominic mentions Podman,I've never tried it, but it led
me down this rabbit hole offinding OrbStack, which I
remembered someone told meabout.
I was like, oh, I should reallytry it. And then I was like,
(28:11):
what I usually when you findwhen you are, like, considering
a new technology or a new tool,what's the first thing you're
searching for?
Jonathan Hall (28:19):
I like, literally, what do I search for
in the search bar?
Shay Nehmad (28:23):
Yeah. Like, what what do you what do you wanna
find before you
Jonathan Hall (28:25):
I try usually type the name of the technology
versus and see what autocompletepops up to give me a list of of
alternatives.
Shay Nehmad (28:32):
So that's crazy because that's exactly what I
did. And I found Orbstack,Podman, Docker and Colima.
Jonathan Hall (28:39):
Okay.
Shay Nehmad (28:39):
And then the second thing I do is I type the name of
the technology I wanna checkright now, space Reddit. Then I
start looking for it in Reddit.But I don't think that works
anymore, man. I think, like,companies have wised up to that.
They, like, pay people to do itand they have a lot of AI
writing, like, good reviewsthere.
So, I don't know, I need atrusted source. So, I looked at,
like, Orbstack, apparently it'spaid, so I don't think I have
(29:03):
enough pain with Docker Desktopto to justify paying, like, $8 a
month for Orbstack or whatever.
Jonathan Hall (29:09):
So, what's the what's the pain that you had
considered Podman in the firstplace?
Shay Nehmad (29:14):
I just want it to run faster. It's just, like,
kinda slow, and takes up a lotof power and resources
Jonathan Hall (29:22):
Is that, for my like, run is running as slow? Is
that because you're on an M4 andthere's that translation layer
or something, or
Shay Nehmad (29:28):
It's building Dockers, I wanna build my own
because because we're runningour containers in Azure
Container App, so we have tocontainerize them. Yep. And it's
going a bit slow. I think it'srelated to the m one thing, to,
like, the, Apple Silicon thing,but not only. Yeah.
(29:49):
Uh-huh. But also just, like,startup time. I wanna start for
Postgres. I want it to startjust Yeah. Like, in in zero
milliseconds.
And if I installed the C binaryof Postgres on my machine and I
would start it, it had it wouldhave zero, like, downtime before
being ready to acceptconnections. But time, I went
with Docker, you have to pull itand okay. So I have the image
(30:11):
already pulled. And then Istarted and then it's like,
Docker Compose is starting. Andoh, you forgot to turn on Docker
desktop.
I opened Docker desktop, oh, youneed to update. It's like, takes
three minutes to update. Boom.I'm my I'm already on something
else. I, like, lost my focus.
And the other thing is that Iuse test containers.
Jonathan Hall (30:26):
I do too.
Shay Nehmad (30:27):
So, the startup time of the container actually
impacts my end to end test runtime. But in that case, I talked
to you about this in the past, Iwant I just don't wanna use a
container at all. I wanted touse, like, an in memory Postgres
implementation. Sure. But Ihaven't gotten around to that
yet, and I never will.
Jonathan Hall (30:42):
I will often use persistent containers that stick
around for ten minutes or even aday, and then I can get rid of
that startup time at the expenseof it's running in the
background all the time. Andmaybe that matters if you don't
have a lot of memory orsomething.
Shay Nehmad (30:55):
I just want, like, 15 of them, but because I run
the tests, as many cores as Ihave minus one. So for me, it's
like 15, but but that's a goodidea as well. But it's just so
fussy with, with Docker. Iwanted to see if there's
something better. It's a tool Iuse all the time.
It's not a big pain, but thisepisode from Go Podcast brought
(31:16):
it to my intention. You're justusing, like, rock and playing
Docker, right?
Jonathan Hall (31:20):
I use playing Docker. I have I've I hear
people complain about Dockerdesktop. I've literally never
used Docker desktop and can'timagine why I would ever want
to, like, I don't know whatproblem it solves, so
Shay Nehmad (31:28):
It's a good chance to mention you're on Linux,
right?
Jonathan Hall (31:32):
Does that make a difference So,
Shay Nehmad (31:32):
solves problems of, people not using Linux. No other
way to run the Docker containeron the Mac. You have to install
the desktop version.
Jonathan Hall (31:41):
Well, that's ridiculous.
Shay Nehmad (31:43):
But that's, again, also another pain, like, every
developer that comes to the tothe company has to install this,
like, GUI desktop application,and when you open it, it, like,
suggests you log in to theDocker container registry, we're
using, like, your users, so youstart paying.
Jonathan Hall (31:59):
Can't you just run a VM or something and run
your Docker stuff in a Linux VM?
Shay Nehmad (32:04):
I mean, you want it to run as close to your software
as possible, I feel. Like, don'twant it behind another VM and
another blah blah, just to avoidthe pain of installing this app.
But I'm looking into Colima, Imight even try it today, which
is container run runtimes formacOS, which is open source. So,
I think I might try this,version next. And all this
(32:26):
experimentation is thanks tothis podcast.
So, maybe you should startlistening to tech podcasts, man.
Jonathan Hall (32:32):
But maybe I should, but it sounds like
you're solving a bunch ofproblems I don't have because I
use Linux.
Shay Nehmad (32:40):
Skill issue. You heard it here first.
Jonathan Hall (32:42):
It's a
Shay Nehmad (32:42):
skill issue. If you're listening Hey, listeners,
if you're listening to techpodcasts, you're just not
skilled enough. That's whatJonathan Hall is saying.
Jonathan Hall (32:49):
That's right, that's right.
Shay Nehmad (32:50):
Alright. I think that does it for the show. Maybe
we'll do a lightning round nexttime.
Jonathan Hall (32:56):
Let's do it next time.
Shay Nehmad (32:57):
Thanks a lot for listening, everybody. Program
exited. Program exited. Goodbye.
Popular Podcasts
Las Culturistas with Matt Rogers and Bowen Yang
Ding dong! Join your culture consultants, Matt Rogers and Bowen Yang, on an unforgettable journey into the beating heart of CULTURE. Alongside sizzling special guests, they GET INTO the hottest pop-culture moments of the day and the formative cultural experiences that turned them into Culturistas. Produced by the Big Money Players Network and iHeartRadio.
Crime Junkie
Does hearing about a true crime case always leave you scouring the internet for the truth behind the story? Dive into your next mystery with Crime Junkie. Every Monday, join your host Ashley Flowers as she unravels all the details of infamous and underreported true crime cases with her best friend Brit Prawat. From cold cases to missing persons and heroes in our community who seek justice, Crime Junkie is your destination for theories and stories you won’t hear anywhere else. Whether you're a seasoned true crime enthusiast or new to the genre, you'll find yourself on the edge of your seat awaiting a new episode every Monday. If you can never get enough true crime... Congratulations, you’ve found your people. Follow to join a community of Crime Junkies! Crime Junkie is presented by audiochuck Media Company.
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.