🛠️ Can we fix it? No we can't! 🧭 Plus, exclusive behind-the-scenes look at Go West Conf.

Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Shay Nehmad (00:00):
This show is supported by you. Stick around

(00:02):
till the ad break to hear moreabout that. This is Cup of Go
for 07/04/2025. Happy fourth ofJuly, everyone. Keep up to date

(00:24):
with the important happenings inthe Go community in about
fifteen minutes per week.
I'm Shay Nehmad.

Jonathan Hall (00:29):
And I'm Jonathan Hall.

And thanks a lot, Jeremy, for covering last week.
Man, I just finished listeningto that episode on my bike ride
over here. It was really good.

You did a great job. Thanks, Jeremy.

Thanks for covering, man. I was in Seattle.
I was having a great timevisiting my cousin, but I am
itching. I'm itching for some Gonews. Lay it on me, gentlemen.

Alright. The first thing up, I'm excited
about this. I've been waitingfor this for so long. Versus
Code Go version 0.48 is finallyout. Why do I care about this?
I usually don't care, but thisone supports Golang cilent v2.
So no longer will Versus Codecomplain about invalid syntax in
my Golang cilent configuration.It'll work now. So I'm excited

(01:12):
about this. So we had theinterview with Eldez a few
episodes ago.
Of course, we'll have a link tothat in the show notes if you
missed it. The maintainer ofGoLang CLN. I can finally use
all those features we talkedabout in that episode. I'm
really excited.

And what do I need to do to get it?

Just install it?

To upgrade my extensions? Yeah. It's pretty
straightforward. Cool. Well, themain thing I I am looking
forward to, is, you know, allthese extensions working on my
Versus Code cursor, fork of theweek.
It's actually become a problem,like, managing all the
extensions and settings inbetween all these different

(01:48):
instances, but still animprovement. So, Olivia Mengui,
one of the listeners of theshow, and I'm probably
butchering that name, sorry, myman, just published a new,
security vulnerability on theGolang issue tracker. And
surprise, surprise is about thepath, sanitation and, expansion
and all that good stuff, but itis, like, subtle and pretty

(02:10):
interesting. So you and youshould care about this if you
try to, like, exec commandsusing, the look path function.
So if you're if you might berunning external programs and,
you know, if you especially in asecurity sensitive context,
right, if it's a script you'rejust running, you probably don't
care.

(02:30):
We should probably be aware ofthis issue and audit your code
to find it if you're using the,look path function. Now what
does the look path function do?So you have OS, right? OS acts
like a look path, which is meantto locate an executable. That
makes sense, right?

Yep. So it's kinda like the witch command in
in bash or something.

Yep. What do you expect to happen if you pass an
empty string?

I would expect it to either return an error or
probably an error since we're Ormaybe nothing, right? Maybe
Yeah. If it was bash, wouldexpect nothing. But since it's a
programming language, I wouldexpect an error to say that this
isn't found or something.

So Olivia found that if you shove an executable
into the path environmentvariable, it will return that
executable, which is like crazybehavior, honestly, like super
weird. And you can imagine this,like with the the flow, which I
think is most reasonable, it's asubtle security issue because
you need to control the pathenvironment variable to make it

(03:30):
happen. But if you're running ona server which reloads
environment variables every nowand then, which a lot of them
do, especially like inKubernetes environments, I
assume, like the the way I'mseeing this being exploited is
you install some Go library inyour in your project, right? You
use some function, and thatfunction just messes up with
path. It's like a supply chainthing where you don't see it in

(03:51):
the code, but it's like it itmesses up with your path.
And then, you know, once andforever you do look exec because
you're you're like exec lookpath to try to find an
executable and it's usingexternal strings. You get an
empty string and it runs thatexecutable. I'll push like my, I
don't know, my malware into thebin, and then you run look exec,

(04:14):
you know, someone sends you amessage and you run look exec to
find that binary on your serveror something before running it,
and accidentally you pull that,you know, that my malicious
executable. Super cool. Youknow, you would expect like if
the command name is empty, itshould fail.
But if you just mess around witha path and you push a malicious

(04:36):
program path into it, like anexecutable, it just gives you
that.

That's weird. And it's like and I can completely
understand how that bug got putin there because it's not the
kind of case you would normallythink about, right?

Yeah. I mean, I don't know. Whenever you get a
string, you should probably testfor empty case, dot case, very
long string, Unicode. Like, youshould have a bag of tricks.

I can easily see the person writing this code
thinking, of course, my path isa list of paths and not
executables. So if I append theempty string to it, it'll still
do the right thing. Yes. Could Icould see that that that
reasoning.

So this is a very interesting security
vulnerability by Olivia, and Ihope to see it get resolved soon
other than a pretty good bugreport because this is
complicated, and I wouldn't haveunderstood it if the bug report
was written like worse. Oliviaalready has a proposal to fix,
is just to rule out empty anddot values immediately without

(05:35):
like even worrying about it.Just like, just do it. Don't
allow the the path to be likeempty or dot or dot dot or
whatever. Yeah, makes sense.
Which to me makes sense. Likethis is clearly not what the
function was meant to do, right?So it's okay to special case

(05:56):
that out. But whenever I seethese, I'm like worried, you
know, oh, maybe in some case I'mmissing, right? What about
dollar?
I don't know, whatever, pathsare complicated. But yeah, very
cool vulnerability. The link isin the show notes if you want
to. If your code is like, oh, Ihave that vulnerability, maybe
publicize that in the thread.That'll be a good idea.

(06:17):
Yep. Cool. And thanks a lot,Olivier, for sending it this our
way. We appreciate yourlistening and thanks a lot.

I wanna talk about a proposal. Oh. We don't
do a lot of that lately. We'rewe're in the middle of a freeze
to go. 1.25 is about to comeout, so there's not a whole lot
of activity in the proposalspace, but there's one I wanna
talk about.
I think it's interesting. Do youremember the GoFix subcommand?

I honestly don't. I don't think I've ever used it.

I probably haven't. And if you have, it's
probably been so long you wouldhave forgotten anyway. But go
fix is a command that willupdate your Go source code to
adopt new idioms as as the Golanguage evolves. A simple
example we could probably worthmentioning before the context
package was was added, we hadthe

(07:06):
And if you ever work on reallyold code bases, you might see
that mentioned a few places.
So go fix would update thatimport path from the old to the
new when it was added in go 1.7,if I'm not mistaken. So this is
this is old school stuff. Butthe go fix command would do
these sorts of things for us,which is kind of handy. There's
a handful. There's a bit like, Idon't know, a half dozen or so,
maybe 10 things that it can fixfor you.

(07:29):
The thing is that most of thesethings are fairly obsolete or
old, like I just mentioned fromGo 1.7 and other old versions of
Go. It hasn't gotten a lot oflove lately. So the proposal is
to make the Go fix subcommand donothing. Literally remove all
functionality. Why would youwant to remove all functionality

(07:51):
from a command like this?
Zero bugs. Zero bugs. Yeah. Nocode, no bugs. The longer term
goal here is to remove these oldthings that aren't necessarily
needed anymore.
In a couple of cases, they mightstill be needed, but they could
be handled by other tools. Butleave GoFix to handle new
functionality. So you may recallwe spoke several weeks ago about

(08:15):
the ability to add new markup inyour Go source to say that this
thing now should be this otherthing, and it could do some
automatic renaming. So that'sthat's related to this is that
this Go fix command could beused to do those sorts of
changes for us as well. Soanyway, I think it's an
interesting proposal just kindof on the face of it to remove
all functionality from asubcommand, but not remove the

(08:36):
command.
I think, is kind of aninteresting thing worth worth
looking at. The reasons, ofcourse, do make sense when you
when you take the time tounderstand it all.

I can, like, imagine someone in, like, five
years being like, why why whatis this command

doing? Like, you know? Yeah. We we remove the
functionality that forget to addnew stuff, and it's just sitting
there empty for five years.

Yeah. Not the worst thing you you can forget about.
I wanted to mention a very goodblog post. Like blog Last week,
with Jeremy filling in for me.You guys tackled, Anton's old
new content, right, theinteractive show notes and the
JSON v two thing.
And and you mentioned you have,like, a ton of knowledge about

(09:19):
JSON parsing and and all thatstuff. You even wrote a book,
blah blah blah. I feel like thisis the blog post version of your
knowledge in a sense.

Oh, okay.

It's from the Trail of Bits blog, and Vesco Franco,
I hope I'm saying thatcorrectly, wrote a whole write
up about JSON, JSON v two, XMLand YAML, about like surprising
behaviors and what do you dowith them and how do you
mitigate them, etcetera,etcetera. With when I say
surprising behaviors, I meanthings that are related to like

(09:51):
serializing and deserializingCVEs, etcetera. With cases like
duplicate keys. Right? Like,what does JSON do when you try
to parse duplicate keys?
Do you know the answer, like,top of mind?

In JSON v one, you mean?

Versus JSON v two.

So JSON v two is configurable, I believe. In JSON
v one, I think it just honorsthe last one, but I'm not a 100%
sure.

It is. That's the case, which is kind of weird.
And the cases, you know, thesesorts of cases are kind of hard
to understand because usuallyyou need to have, like a setup,
a server and some parsers andsome things going on to actually
explain why this is a problem.Right? And the reason I
recommend this blog post isbecause Vasco went through the

(10:42):
hard work of actually detailing,you know, with charts and
examples, how this will getactually used.
So if you're talking about theparser differences, the trailing
garbage data, like all thesesorts of things, unknown keys,
It shows like the JSON, XML, andYAML versions of it. And, you

(11:04):
know, what do you do with theleading garbage data or trailing
garbage data? And how does thathow could that be used? Right?
How do you misuse omit empty byaccident?
Or what do you do with caseinsensitive key matching? Which
is very surprising. That was thepart I didn't know is that
because you can have duplicatefields and the parser is a case

(11:27):
insensitive, you could have thea field with two duplicate keys.
One of them is wrong with likeUnicode characters, uppercase,
lowercase. You know, you passthe correct key casing with one
value and the incorrect keycasing later with a different
value.
The proxy service, which iswritten in Go, you know, parses

(11:49):
the second value, but the actualservice behind it might not be
written in Go or it might have adifferent version of the parser.
So it might take the first one.So you could in the first one,
put something benign like userand in the second one, put
something horrible like admin,right? The Go and the Python
implementations will seedifferent things. So if you're

(12:09):
like, it depends on where yourdecision is, like, where's the
proxy for auth and where's theactual server, you could like
make them actually confused.
And if that sounds a bitconfusing, the charts in the
blog post make it very easy tounderstand. So please do do
that. Just go read the blogpost, it's super great. And if
you wanna skip the entire likeunderstanding of it and just

(12:32):
tell me what to do, you canscroll to the last part, which
just says mitigations and a listof recommendations like prevent
parsing of unknown keys, preventparsing of duplicate keys,
prevent case insensitivity. Thisone's especially important.
And if you use XML, liketrailing data and leading like

(12:52):
garbage data, the front andback, prevent them as well. So
and the main takeaway is watchout for v two, because in V2,
many of these have saferdefaults, which is the sort of
things I wouldn't think about,but I mean, that's a great
reason to start upgrading andmaybe even start with the
experiment right now. Last weekyou mentioned all the

(13:13):
performance enhancements, butlike all these security
considerations are

super important. Exactly. Yep. Cool. I'll check
it out.
I'll read the whole thing.

It's pretty long. It's like a it's not a phone
thing. You know what I mean?It's like a coffee cup break in
the work 15 sort of thing, whichour episode might be for you,
and it's coming up on fifteenminutes. So let's jump to the,
lightning round.

Alright. Let's do it.

Lightning round.

So first off at the lightning round, we have a
blog post from Brander,brander.org. That seems to be
his Internet name. Don't knowhis birth name, but he doesn't
seem to want to tell us. SoBrander, it is. Go don't name
packages common nouns.
Have you ever had that problemwhere you're trying to use a
variable and then this is also apackage name? That happens to me

(14:07):
all the time with like URL, forexample. I want to do URL colon
equals URL dot parse and I can'tdo it. Or server is a good
example too.

And then I end up doing like, like, just take out
all the all the All the vowels.Vowels. Yeah. All the not the
vowels, the other ones, theconsonants. Take out only the
consonants.

Yeah. Yeah. So anyway, the whole point of this
blog post basically is don'tname your packages with common
nouns. And he offers it's it'snot quite that simple. He offers
some suggestions on what to doinstead.
His main suggestion is addwords. So if you have a rate
limit, call your package ratelimit instead of rate. He uses

(14:48):
the example of an actual packagethat's called rate. He doesn't
like it. It should be calledratelimit.golang.org/x/time/rate.
He thinks it should be calledrate limit.

Do you agree?

I think I do.

But can't you solve it by importing it differently
in your thing?

You can. So in principle, I agree. Whether I
agree this specific example, I'mnot sure. I'd have to look more
closely at what the packagecontains. I don't I know I've
used it before, but I don't knowif it's quite right to call it a
rate limit because I think itdoes more than rate limiting.
But in principle, I agree. Andthere are several neat
characteristics about his hisproposal. You may recall that

(15:28):
standard advice for Go variablenames is to use camel case,
right? So if you have a variablecalled rate limit, the L will be
capital. But the same advicesays that package names should
be all lowercase.
So you won't even have aconflict in that case. Just by
simply adding two words, yourpackage names, you never have a
conflict if you follow thestandard advice when you're
naming your variables. So that'skind of neat little trick there

(15:50):
for people who follow thatadvice.

I tend to if my Go package names have two letters,
I'll put like a dash. I'll likekebab case them. I hate it when
you don't put a space betweentwo words, but you can't put a
space in a package name. So I Iuse

Is it underscore?

Dash. And I don't think dash is cool for variable
names. So that's

why I don't think you can use a dash in it. Think
you have use under Oh,

maybe. Oh, I don't know. We need to check.

You could then in the path name, but I don't think
for the import name. I think theimport name, have to use
underscores.

That's true. That's true. But I'm mostly interested
in the advice for the internalpackages, because I'm I I hate,
but it's so it makes so muchsense. So at the bottom of the
blog post, he mentions forinternal packages, just like
start with the prefix of likeyour company or your project. So
I don't know.
I work at ops and security, soall my internal packages should

(16:46):
be like, oh, client, oh, DB, oh,limit, oh, lock. And then it
will never like because thatdoesn't make sense. That's not a
word, right? O test. But then, II don't know.
I hate it, but it like makes somuch sense.

So I struggle with this Having

a package called server and then I can't

call my variables server. So I struggle with this
with things like error and log,where I want to augment the
standard library veryfrequently. Log is a great
example. I want to add someconstants for common field
names. I want to add somehelpers and stuff like that.
And I go back and forth betweenwhether I should create a
package called log that aliaseseverything in the center
libraries log package. And thenI have my linter say always use

(17:27):
our custom version. Or if Ishould do something like PLOG
here or whatever. I honestly, Idon't know. I go back and forth.
There's pros and cons to bothboth ways. I'd be curious to
hear what our our listenersthink on our Slack channel.

I would hate it, like, for the first week, and
then I'm sure I would be veryhappy with it, like, in the long
term. So we're not adhering toour normal lightning talk,
lightning round thing, which is,here's a cool link, review it.
We just talked about it indetail, but it's just like such
a obvious thing. I wonder if youcould even put a linter on it.

(18:02):
It'd be like, package is commonnoun.
a reasonable rule, but it mightbe a little bit hard to enforce,
but it's definitely a goodguideline in my opinion. It's
like very pragmatic and a goodguideline.

Yeah. Yeah.

My lightning round thing is also gonna be a bit
controversial. We have to talkabout it for a while, is another
like super base, Firebasealternative. But luckily it's
just a toy project. It's calledPennybase, poorest men's backend
as a service, like Pocketbaseand Superbase and Firebase. I

(18:35):
think we talked about Pocketbasespecifically in the past.
It's a 100% written in Go,advertised in Reddit with like
zero dependencies. And, youknow, it's just like a web app
and instead of using Firebase orSuperbase, they just built like
a toy one and fully in Go, whichis really cool. The thing I

(18:56):
wanted to highlight is thefirst, comment in Reddit, which
is too late, already using it inproduction. No big comment goes
You

heard it from the official source. It's production
ready now.

Used across thousands of production things.
Alright. That does it for the,Lightning Round. We have a short
ad break, but stick aroundbecause we're talking to Mariah
and Derek about the Go WestConference. Very cool interview.

(19:30):
Alright. We wanna skip the adbreak because we wanna get to
the interview. So this show issupported by you. You can visit
Patreon and give us some moneyto keep running the show. You
understand how we use it forhosting and editing.
You can also buy some swag.We're looking to increase our
swag offering, so if there'sanything you'd wanna buy, when
you listen to the interview,you'll know why, where I

(19:51):
suggested some cool new swagideas. Let us know. Like we use
a printer so we could probablyset that up if they have the
option. Share the episodebecause we don't pay for
advertising.
So just let people know aboutit. In your Twitters and your
whatevers, also rate it on theapps, whatever app you listen,
whether it's Spotify or ApplePodcasts or wherever. And we

(20:13):
wanna shout out our Patreonsubscribers. Thanks a lot for
helping support the show. Thisis a hobby, it's expensive
hobby, but we really appreciateyou helping us cover all the
costs.
That's it. That's a minute tothe interview. Here we go.

Shai, I've been listening to some music lately
and I can't decide which isbetter, the Pet Shop Boys or the
Village People. Who do youprefer?

I guess Village People, if I had to

choose Village People? Yeah. Yeah. I wish we
had somebody here who couldbreak the tie because I was
thinking Pet Shop Boys. We needsomebody to break the tie,
especially the song Go Westbecause that's just the the best
song that either group has everdone.

So we need Go West experts is what you're Yes.

That's what we need. Oh, hi, Moriah. Hi, Derek.

Hi, Derek and Moriah.

Miriah Peterson (21:01):
Well, hello.

So which is your favorite rendition of Go West?

Derrick Laird (21:04):
Probably the Pet Shop Boys.

Yeah. Alright. We got two for the Pet Shop Boys.
How about you, Moriah? Are yougonna make this a tie or are you
gonna are you gonna weigh in onthe right side of the fist?

No. I'll play Pet Shop Boys. It's the
unofficial comfort zone. Therewe go.

Unofficial. Alright. Once again in the
minority, no problem. I'll stickhere with my Vime bindings.
Mariah Derek, why don't youpresent yourself, to the to the
listeners other than, being, youknow, music aficionados
apparently?

Yeah. I'm one of the cofounders of the Go West
Conference, Mariah Peterson,long time Go user, content
creator, and obviouslyconference organizer. And

Yeah. I'm Derrick I'm one of the, more silent
partners, in organizing Go West,kind of introverted side, but

You provide the money. Right?

At least they try to help with that anyway.

I I feel like every or when you organize these sorts
of things, end up with likewhat's the director's name? Like
Ocean's 11 heist crew sort ofthing where everybody gets their
own window in the edit and onegets the money, one gets the
pizzas, one gets the but it'sgood to have like the different
roles. So what is for if someonedidn't know? Although I think

(22:19):
Jonathan, we we must havementioned it on the show. I I
remember we mentioned it lastyear.

We've mentioned it last year. I think we even
had the Pet Shop Boys theme songin

one So what is the Go West Conference?

Derek.

Oh, you want me to do that one?

This is like your job. You do this every year
at the conference.

Yeah. So we wanted to create a a conference
that's more accessible to a lotof people. Because, you know, a
lot of people can't reallyafford to go spend, you know,
$5.06, $700 to attend aconference. Right? So we wanted
something that was affordableand local to our area to try and

(23:00):
draw in more of the talent wehave here and help expand
people's knowledge in our area.
So that's kind of one of beenour main goal is just to have a
small affordable localconference for Hargrove
community.

How local is it? Like, how how far away do people
come in?

We we have people surprisingly come in from, you
know, quite a ways. The majorityof our attendance does come from
the Utah area, but we do have wehave had people come from
Denver, Nevada, I thinkCalifornia, and maybe Florida or
Texas. I think we had a fewpeople come from.

Oh, we did. New York well, Matt Sanabria spoke
last year. He flew in from New

York. Okay.

So we get a couple people that fly in, but I
would definitely say 70% driveto the conference. They live
locally.

Mhmm.

And it's in Yuta. Is it in, like, Salt Lake City
or or someplace else? It saysit's in Lehi Lehi? Yeah. Am

I presenting the Good job.

Lehi. Thank you.

Yeah. So we're there. Yeah. We're we're in
Lehi. It's about twenty minutessouth of Salt Lake, maybe less.

Oh, I'm trying to find it on, like, Google Maps.
But when you say twenty minutes,I I realize that it's, like,
probably an American twentyminutes, which could be, like,
really far just because of theway your highways work. No. Just
not getting used to.

Lehi is like a a local tech center. Right? So
it's got the Adobe, office outhere. We've got an ancestry.com
office. Like, there's lots oftiny and so most of the software
engineers tend to work in thearea.
So we can get a lot of peoplewho it's their commute,
essentially. They don't have totravel any further than they do
for work.

Cool. I'm I'm, like, trying to see how far it
is from San Jose. Not that far.Like, I can fly over in Nevada
and get there in probably, like,an hour and a half.

Yep. Yeah. With, kinda like a Utah's own Silicon
Valley. It actually has thenickname Silicon Slopes. That's
what we call it.

Alright. So let's say I do, like, wanna I am on
the lookout for coolconferences. What's, what's in
plan for this one? So it'sOctober 24. We know when it's
happening.
We know where it's happening.Why should I come?

So this conference I know you two are
big meetup fans. You literallytalk about meetups every single
podcast.

Just about.

And like the goal of this conference is
essentially to have a day longmeetup. And that's literally
everybody's like, this is thebest conference ever, at which I
totally agree with. I think it'sthe best conference ever.
Because it just feels like a daylong meetup. You come, you hang
out with people, you may haveworked with them in the past,
you meet new people.
It's super low key communityvibes. It it we definitely try

(25:44):
to keep it a little bit morepolished than a meetup as far
as, like, the presentations andstuff go. But the highlight 100%
is the community interaction.And it is we have such a deep
surprisingly deep. I every timeI go to an event in Utah, I'm
just like, how on earth do wehave these deep wealth of
technology here?

(26:04):
Because we shouldn't. We havesuch a surprisingly deep wealth
of community knowledge, and theyyou just get to come and
interact with them and talk toeverybody and just have fun.
Like, it's just a party thewhole time.

And specifically, I mean, the community aspect
sounds great. I assume, like, ifI'm looking for a job or if I'm
looking to network and, like,get to know more people in the,
like, UDAGO scene, it's probablya good place to go. Right?

Yeah. It's a great place. We we actually have
people people know, what jobsthey actually have or are hiring
for. So we try and give peoplesome time to plug those during
it. And I think I've actuallyseen a couple people land, some
interviews and jobs, at theconference.

Damn. That's great.

I mean and we have people sponsored just for
the intent of recruiting. Likeso it's it's 100%. There's a lot
of people that use Go, and Goengineers are they they, you
know, bounce around all thecompanies in the area. So it's
definitely been used that waymore than once.

How many people typically attend?

Oh, good question. So we started this
conference during COVID. So wewe've been a victim of low
numbers for a while. Last year,we hit our high, which was one
thirty five. And of that onethirty five, I would say ninety
percent was from Utah.
So I was like, what the heck isthis? Where did all these go

(27:31):
people come from? And so yeah,we're that was, like I said, one
thirty five all all local. Andwe we had a couple people like,
we just be like, oh, I'm herefrom Denver. I'm like, you are?
Cool. You run the Denver meetup?Oh, that's awesome. So we would
love to have definitely peoplefrom, like, the the surrounding
states, local area. Like I said,if it's within a one two hour

(27:54):
flight, like, that's definitelyalso kind of who we're
targeting.
Again, keep it low cost oftravel, low cost of stay, low
cost of attendance, but superhigh content.

So, okay, there's cool people, cool community,
local devs, whatever, jobs, whocares? We have an exclusive you
promised us an exclusive first,you know, in median res view of
what are gonna be this year'stalk. So so give us that that
juice. Who's who's talking thisyear and about what?

Exactly. Believe it or not, two of the
speakers are sitting here onthis podcast. I'm giving a talk
on an AI system in Go andJonathan's giving a talk about
being a contributor to Go.

Woah, I am? I'll act surprised for the for the
audience.

I hope you are. You're

I'm planning to.

Okay. Cool. We have talk called Fundamentals of
Memory Management. That's comingfrom where I have a speaker
coming in from Japan for that.

Wow.

We have one about avoiding million dollar
mistakes with nil pointer toreferences, real time data
streams with Go, Go channelsdemystified, and the basics of
the Go AST package. One of thethings we do with our conference
very specifically is we like tohave a mix of both local

(29:21):
speakers. Like I said, we have asuper deep wealth of local
speakers and, again, like theworld class Go talent to kind of
balance that. Look at ourawesome Go community we have
here of people that can help youand you can grow and learn Go
and do like super hard stuff.And then come meet the people
that do it everywhere else.
So we've got about a fifty fiftysplit this year of half local

(29:44):
speakers and half people thatare coming in to share their
wealth of experience with Go.

That's really cool. Are there any open slots or is
it all like full up?

We have open slots for Lightning Talks. And
Lightning Talks, we have anentire hour scheduled for
Lightning Talks, five minutes.And they are everybody's that
that is one of those thingswhere it is the favorite part of
the conference because moreoften than not, people show up
to the conference, they're like,wait, I can give a lightning
talk? And they just throwsomething together during the
conference and it's amazing. Ijust love when the community

(30:17):
does stuff like that.

Like the lightning talks are sign on the spot or
can people like submitted the

So so they you have to be there to give it.

Of

course. And we release the sign up beforehand.
It's just nobody pays attentionuntil the day of the conference.

Wow. I'm wondering if I'll actually be able to fly
out and meet Jonathan there.Maybe we can do a a lightning
round lightning talk, lightninground and record it.

That'd be amazing.

Well, let's let's keep that idea on the on the
back of our minds because I needto see if I can fly out to you
though. But maybe Jonathan coulddo it for for me, it's a cool
idea for sure. I have anotherquestion about like the format
of the talks. So is theconference more conversational?
Like people give a presentation,people can chime in in the

(31:08):
middle or whatever, is it morelike talks, people talk, it's
recorded, you know, questions atthe end sort of thing?
Because I've been to both likevibes. And if you're a 100 plus
people, I think like theconversational part gets
sometimes a bit harder, butpeople like always wanna ask
questions because that's whythey came to the conference and

(31:30):
they, you know, you know what Imean? So I'm trying to to like
gauge the vibe. Is this the sortof conference where I'm mostly
gonna be listening or I'm mostlygonna be like asking questions
and engaging with people?

Yeah. I I think some of our earlier years, we
had kind of the more informalpeople could ad hoc ask
questions during the talks. Butwe've started trying to record
them so they're more accessibleto people. So we gotta try and
stick with them some time boundsand just have a q and a section
at the end that we sometimesadd, sometimes don't add to the
recording.

We prioritize the recording with questions.
But because it is so small, it'sreally easy to find the speakers
after and just chat with them.So

I've always been the the sort of person who will
like go to the lecturer after atalk and I could talk to them
like for fifteen minutes, notrealize

that guy.

Yeah. You know what? You know what? You could
be like as cynical as you want.For me, it's been a net
positive.
Like going to the lectureafterwards and talking to them,
getting their phone number,whatever. Yeah. It might be a
bit cringe, it might be a bitannoying, but I've learned more
doing that and I've like gotintroduced to some cool people.

(32:41):
And as long as you're respectfulof the other person's time.

To be honest, I actually love that. As a
speaker, I love it when peoplecome up and ask questions. So I
don't want anybody listening tothink that, like, oh, I'm not
gonna go talk to Jonathanafterwards now.

It definitely validates your talk a little
bit. Just be like, oh, youactually did pay attention.
Exactly.

I was just gonna say it's a great opportunity for
people to network doing that.Like, that's kinda how I've
gotten to know a lot of greatpeople in the Go community is,
like, going to, like, happyhours or different things and,
like, going and talking to thedifferent people, which we do
also have a little after partyafter the conference where
people hang out, have drinks,and talk about different things,
which is probably one of myfavorite parts of the

(33:18):
conference.

So I'd like to peek behind the curtain a little
bit here and talk about somebehind the scenes stuff, if you
don't mind sharing some of that.Yeah, absolutely. What what is
the biggest challenge in puttingon this conference for you?

I think a lot of it is just trying to make sure
we all have the time set asideto review the talks, find
sponsors, try and make sure wehave, like, good content, trying
to source talks if needed, andthen trying to get all of our co
organizers and people thatvolunteer and help us get all of
us together and on the same pageso we're all working on the same

(33:53):
thing. That's one of the bigones. We do try to have, like, a
monthly meeting where we gettogether, go over all the stuff
we need to do for the month, ortry and prepare for the day of
the event. Ryan, do have anyextra you wanna add?

You have yeah. If you had a follow-up. I would
say, yes. I agree. Anybody who'srun a meetup will probably
figure find that a lot of thesethings are very similar.
You gotta find the venue. Yougotta find the speakers. You
gotta get the food. You gottait's just at a slightly larger
scale. So we do have to I wouldsay this conference is different

(34:30):
than most.
We run on a very light budgetbecause the building is actually
donated to us. So we don't haveto pay for a venue, which like
or AV or anything like that. Soit saves us a ton of overhead
and makes it really nice. Butother than that, I would
definitely agree with Derekbecause this is 100% volunteer
run. We don't have anybody whogets paid to do this.

(34:52):
Making sure that we are alltimeline on the same page has
always been the biggestchallenge. This is our sixth
conference, so we have we'rekind of in a groove a little
bit, Derek and I, of what wehave to do, And we can do most
of it asynchronous, butsometimes it's just yeah. We
still have to make sure that itgets done in a certain time. And

(35:15):
but once it literally once ithits the day of the conference,
it just feels like this weight'slifted off, and it's just a
train that's keep going andnobody can stop it.

How far in advance do you start
preparation? So so, I mean,obviously, we're getting close.
We're still a few months away,but, like, this conference ends,
do you have a break for a while,or do you start immediately
planning for for next year? Orhave you already started for
next year?

No. We usually we start, like, around maybe
January, February, start, like,thinking about it and get going
on things. And then we justkinda do a little bit every
month or so up until the event.And after the event, we just
take a nice couple monthvacation and forget about it.

I mean, we do we have it in October. So, like,
the next two months are holidaymonths.

Sure.

So we just kinda take the holidays off and
we start the new year kind ofrolling. I don't think you could
do this for larger scaleconferences. I know, like, once
you get thousands of people,they they take more months of
planning and just just forlogistical reasons. But as long
as we're small, we get thebenefit of only requiring,

(36:23):
volunteer time and it takesabout, I'd say nine months,
nine, ten months.

Okay. My experience, when I ran the first
Go meetup in, in San Francisco,which we have a live episode
from there. I was like certainit's gonna take all of my time.
It's gonna be super complicatedor whatever, but it turns out
if, like you said, someone iswilling to give you the venue,
in that case, you know, Elasticwere nice enough to give us that

(36:48):
venue. You can just tell people,hey, we're gonna be talking
about Go at this place at thishour.
And magically, some people willshow up. And with a conference
that's like fully loaded withsuper interesting content and in
a tech hub in in a YUDA, itseems like a no brainer that
people will just wanna like joinand and network and all that

(37:11):
stuff.

Well, people start asking us when we're
always every year. So when areyou gonna start selling GOES
tickets? So that's that's alwaysthe good sign to know that
people wanna come back.

So when are you gonna start selling GOES
tickets?

Soon. That's a great question.

We're hoping to have those out this week.

Yeah. Our our goal was this week.

Alright. Our goal was this week. That sounds very
is

this week. It's going to happen. It will happen.

Our goal our goal is this week. It's it's
Thursday. And tomorrow's aholiday. It's like, you know,
holidays always throweverybody's schedules off
because you've got stuff withthe kids and parades and
fireworks and

Yeah. Someone this is my first July 4 in The in The
States And coming from Israel,like last night someone started
lighting fireworks in the streetand my first response was like,
oh, like my whole body tensedup.

Was like,

but no, they were like, lighting all these, very
dangerous looking and soundingfireworks just in the middle of
our very calm, suburban street.I was like, yes, this is what
Americans do. This is fine. Ineed to adjust to this new
situation.

This is what Americans do.

I I appreciate it. So yeah. It might be this week.
That's all I'll say to thelisteners. What are you most
expecting?
Like, Derek, I think youmentioned it already, like, just
the that there are differentaspects of of conferences and
that you and Mariah like filldifferent roles. Right? I'm

(38:50):
wondering what are you most notlike the the opposite of
dreading. What are you mostexpecting about the conference
or what's like your favoritepart?

The after party where I get to relax and hang
out with everybody and enjoy it.Cool. Yeah. Mean, my side is
actually pretty easy. So, like,I deal with, like, updating the
website, getting the ticketsales, just through a blank all
of a sudden.

You bring the truck that gets the food and you
I

I kinda just run around day of the conference
just kinda making sure all thestuff's out for people to, like,
have snacks, drinks, deals likecheck ins. So

so just seeing everything running smoothly and
Yeah. People being able to enjoythemselves.

Oh, Derek's favorite part is definitely the
after party and it's not for thealcohol. It's just like the this
is over, Now we get to hang outand just literally talk about
software. Like, it's such a nerdmoment to just hang out and talk
about software without anypressure whatsoever. And how

(39:52):
late like, he and Derek staysthe whole time. So he's been
there about three, four hourswith people just hanging out.

Yeah. We're usually there from like 05:30
ish till like nine or so.

That's like the before party.

No. The before party is with donuts and coffee.

Oh. I

don't know how early, people get like wake up
in Yuta. What's the is it likebreak of dawn, we start the
talks? No. I hope not.

We're 10AM.

Yep. And Mariah, what what's the part you're
expecting the most?

Oh, this year we are printing printing. We
have been wanting for years todo custom gopher plushies, and
we finally did it this year. Weare going to be giving them out
as speaker prizes and thenselling them for next year's
conference costs. So I am soexcited to have gopher plushies.

(40:49):
You can't see my office becausemy camera's broken, but I've
only got what?
10 already? Like, I

just love Are these Bob Ross themed ones? Like
your logo or or what do have

going on? They're not Bob Ross. They are
camper gophers. Our originallogo was camper gophers. So
we've got a little backpacker.

Awesome. You're telling me you already have the
plushies and you're you'reholding out on me?

I told you August, Derek. They're gonna be
driving to my house in August.

Well, plushies are certainly a thing to be excited
about.

You'll need you'll need to hook up hook us
up with your suppliers so we canget some gopher plushies for

first Oh, Brewster plushies? Yeah. Oh, you know
what? My daughter would lovethose.

So far, the pictures I've seen, they have
been adorable. So you see themin person, see if you like them
and I'll send them your way.

Awesome. Cool. Cool. Cool. So I'm really
curious.
You guys have been doing this,you said, I think six years.
Right?

Yeah. This is our sixth conference. Started
our first one was 2020.

If other folks are listening to this and are
inspired to try to do somethingsimilar, what advice can you
offer for somebody who wants tostart their own? I mean, it
could just be a meetup, but, youknow, I'm thinking more more
like a a regional conference.

Well, this is really easy. This is my favorite
story. Literally, Derek and Iwere at a meetup one day and it
was probably what, one, twomonths after GopherCon. And he
came up to me. He's like, I'vebeen noticing people have
started doing regionalconferences.
Should we do it? And I'm like,heck, yes. And, like, I think we
started planning it the nextday. And we're looking at venues

(42:22):
and looking at raising money andtrying to do costs, and we had
an event planner, and then COVIDhappened and canceled
everything. But it was a goodthing because we were really
able to tone things down andkind of cut out things and
decide what's simple.
I think the most important thingI will always say is find a good
team of people to be around you.Right now, we have a team of

(42:42):
four people, and that balancesthe workout really well so that
no one person feels superoverwhelmed. It also helps with
deciding talks becauseotherwise, you get way too
biased to a single single topicfield. The other thing I would
say that is particularly hardwith conferences is getting the

(43:05):
word out. It's really hard tojust get people aware of it.
And I have found that you haveto be totally comfortable with
just like sliding into DMs onTwitter. I have DMed everybody
and their dog to try and getpeople to go to the CFPs or sell

(43:26):
tickets. I go to meet uporganizers and I'm like, hey, if
I give you guys a 25% discountcode, will you announce your
conference at your meet up? Andso I I would say with
conferences, personally, I findthat the hardest part, like the
the biggest thing to overcomeand the logistics are kind of
easy. But I think the way youget started is you just find a

(43:47):
group of people that also wantto do the same thing.
And it honestly, it feels like afreight train. So if you have
everybody and you wanna do itand you pick a date, it happens
no matter what. Eric, this wasyour idea. It's your conference.
You have to have an anecdote forus.

I I got nothing. You really covered it all right
there.

So it sounds like your advice, Derek, is to tell
your idea to Moriah.

That that's really how it happened. I was
like, she runs the meetups rightnow and I just had this little
idea of starting a conference.Like, I'm gonna go pitch this to
her. And she's like, yeah, thatsounds great. And I was like,
uh-oh, what did I get myselfinto?
Now I actually have to do thisthing. You know, I'm I assume
mostly probably like mostdevelopers, I'm quiet and
introverted and every yeargetting up to talk at the

(44:32):
conference is like, oh, boy,here we go.

Mhmm. Yeah. You continue doing it, so it must
not be that bad.

Yeah. It is. It's one of those things where like,
I wanna do this, get myself outof my comfort zone and try new
things, which is partially why Iagreed to even come on the
podcast is where I was like,hey, you're doing this. I was
like, oh, I am? Okay.

Did not public speaking. He hates public
speaking. It's the best.

I think she just does it to watch me suffer in
silence.

The well, I hope you're feeling adequately
uncomfortable just to make youput yourself out there even more
and step even more out of yourcomfort zone. Derek Mara, where
can people find you? What areyou working on that you want
people to know other than GoWest? Obviously, you've heard

(45:23):
about Go West for the last,like, whatever minutes we've
been talking about it, but thelink is in the show notes, and
the tickets will be out thisweek. They will

be. It's also gowestconf.com, just to be
gowestconf.com. If you're if youcan't check the show notes,
gowestconf.com is easy toremember.

Yeah. If you're, like, listening to us while
paragliding right now, don'ttake out your phone. You just
remember gowestconf.com. Butother than that link, where can
people find you?

I don't have anything all that interesting. I
have a Twitter. You can followme on Twitter, d laird
underscore dev.

I'll go do that right now. And I know that,
Jonathan won't because hedoesn't, use, x anymore.

I x ed the x.

Oh, yeah. I used the wrong the old name, the old
form.

No. No. You used the correct name. Everybody
thinks that's the name.

Oh, there's still tweets. Right? Like you
send tweets on it. So it's likeanyway, that's the thing I'm
trying to figure out. Theeasiest way to reach Derek is on
the Forge Slack.
So Forge Utah is a nonprofit. Westarted four meetups and also at
about the same time we startedthis conference. It's basically
we do I'm a cofounder of thattoo. And we do local tech

(46:35):
events. That website'sforgeutah.tech.
We do have a lot of non Utahpeople in our Slack, but that's
we also run the conference Slackout of there with the GoestComp
channel. That's the best way toget a hold of Derek, honestly,
is on Slack. We love forge. It'sbeen super fun to just have a
whole bunch of just like itdefinitely the go meetup was our

(46:57):
biggest meetup for a long time.And now they are the AI meetups
that I run that are just killingit.
What else do we have? Mariahdoes. So and then I do my soy
peak tech stuff, which is blogsand I do Twitch streams. We've
talked about that before,Jonathan, on the podcast. How I
do go Twitch streams on and it'ssuper fun and people are like,

(47:20):
wait, you don't do video gameson Twitch?
I'm like, nope. No video gameson Twitch. Just software. Just
Go and AI. And then, yeah, I'malso on all the socials and I
post about Go and Go West and AIstuff all the time and it's
super fun.
Yeah. I don't that that's 100%how you can find us.

Awesome. And all the links are obviously in the
show notes.

I hope so.

Well, I think that leads us to what's our
final question. We'll ask ittwice since there's two of you
today. When you were learning Goor starting out with Go, who was
your biggest influence? We'll gowith Derek first.

The whole reason I got into Go is I was a huge
Linux Unix fan And I was lookinginto, like, kind of the history
of Unix stuff and saw thingswith Ken Thompson. And I was
like, man, I wonder what he'sdubbed to these days. So I was
kinda looking and it's like,he's working on this new
language Go. I was like, oh,I'll see what Go is all about.

(48:16):
And because at the time, I onlydid front end and a little bit
of PHP back end.
And I saw went and tried this Golanguage and I was like,
something where that justclicked with my brain to where,
like, I felt like I could ascode as quick as, like, the
ideas came to me in my head andcould understand the language
quickly. So he was probably thethe main reason I even got into

(48:36):
Go is because of him for lookingat more where I was already
writing Go and was inspired todo more is actually Brian
Kettleson and Eric St. Martin. Iwas listening to them do the Go
Time podcast. And this is wherethe story with Moriah comes into
play where I had a long commute,I listened to the podcast every

(48:57):
day and let's heard them talkabout regional conferences being
spun up.
And they were asked, like, doyou do you feel like people are
treading on your territory doingsmaller conferences and things
like that? Because they ran andI can still do run GopherCon.
And they're like, no, that'sgreat. We think everyone should
have a regional conference. I

was like,

that's a great idea. We should have one here in
Utah. So that's when I went andpitched it to Moriah that we
spin one up.

Cool. How about you, Moriah? Who was your
biggest influence while learningGo?

That would be Frances Campoy. I would say I
went to my first GopherCon, hegave a talk on Go and AI, and I
found him immediately after. Ifollowed Shay's advice and
immediately went and found thespeaker and made sure he could
not leave the podium until wehad chatted. And I that's when

(49:49):
he was doing Just For Funk. Iwatched all of those videos.
I started doing speaking andstuff because he did it. I got
him to come out to fly out to weflew him out to a meetup in
Utah, and then he came again tomeetup in Utah. And then I would
run into him at conferenceswhere I was speaking at. It was
just really fun there for awhile. And, like, he was so

(50:13):
excited about the language and Igot so excited about the
language and I haven't stoppedbeing excited about it since.

Cool. Yeah. I've watched some of his, Just for
funk videos as well. Sounfortunately, he stopped doing
those, I guess, but, can'texpect somebody to do a pet
project like that forever.

Yeah. I think they were some of the best
quality videos for a while, inmy opinion.

Mhmm. Cool. Cool. Cool.

Well, thanks a lot, Mara and Derek, for coming on
the show. Call to action is, ofcourse, go get, Goest, tickets
if you're in the Utah area. I'lldefinitely check like how much
the flight costs because I'mvery, very interested in coming
to see Jonathan's talk. Beentrying to contribute to Go, but
all my proposals got rejected.Maybe if I listen to Jonathan's

(51:04):
talk, finally, I'll be able toland one in.

There you go. Maybe.

But for all the other great talks, the
community, the after party, theplushies, and all the rest of
the goodies, goestconf.com.

Great. Thanks, guys.

And again, thanks a lot guys for coming on.

Yeah. Thank you for having us.

See you in a few months, Rocco and and Lehi.

Yeah. Looking forward to

Program exit open. Goodbye.

All Episodes

Episode Transcript

Popular Podcasts

Stuff You Should Know

The Joe Rogan Experience

Dateline NBC

.css-15opob5{left:0;position:absolute;top:0.8rem;} All Episodes

.css-14f5ked{margin:0;word-break:break-word;display:-webkit-box;-webkit-box-orient:vertical;box-orient:vertical;-webkit-line-clamp:2;overflow:hidden;}🛠️ Can we fix it? No we can't! 🧭 Plus, exclusive behind-the-scenes look at Go West Conf.

Episode Transcript

Popular Podcasts

.css-r6mb8g{margin:0;word-break:break-word;display:-webkit-box;-webkit-box-orient:vertical;box-orient:vertical;-webkit-line-clamp:1;overflow:hidden;}Stuff You Should Know

The Joe Rogan Experience

Dateline NBC

All Episodes

🛠️ Can we fix it? No we can't! 🧭 Plus, exclusive behind-the-scenes look at Go West Conf.

Stuff You Should Know