All Episodes

June 7, 2025 â€ĸ 30 mins
Mark as Played
Transcript

Episode Transcript

Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Jonathan Hall (00:00):
This show was supported by you, our listener.

(00:01):
Stick around to live for thenews to hear more about that.
This is Cup and Go for06/06/2025 or 06/07/2025. We're
recording on the sixth. Keep upto

Shay Nehmad (00:20):
date with the important happenings in

Jonathan Hall (00:21):
the Go community in about fifteen minutes per
week. I'm Jonathan Hall. And I'mShyne Hachman. Hey, Shayne.

Shay Nehmad (00:26):
You hesitated there for a Were you about to say I'm
Shay Nehhmad?

Jonathan Hall (00:30):
I was about to.

Shay Nehmad (00:31):
I saw it. How you doing, man?

Jonathan Hall (00:34):
I'm alright. Getting ready to travel. I won't
be here next week for the showbecause I'll be in Brighton in
The UK.

Shay Nehmad (00:39):
Oh my god. So Yeah. If you wanna replace Jonathan on
next week's recording slot, cometalk to us at the Copago
channel. If you already did itin the past, wait for a We wanna
try to get more friends of theshow on the show.

Jonathan Hall (00:57):
And if you're gonna be in Brighton, hit me up
and we can have a drink. OrAmsterdam. Right? Yeah. I'll be
in Amsterdam one one day twonights, one day after the after
that.

Shay Nehmad (01:07):
Cool. Cool. Cool. This week, I wanna kick things
off with the new minor release.Go one twenty four point four
and Go one twenty three pointten have been released, and they
include three security fixes.
One that I'm not gonna try toeven explain, it's from crypto x
five zero nine, whatever. Ican't I I tried to read it. I

(01:29):
couldn't understand it. Butthere are two that are in
NetHTTP and in OS, two very,like, popular, you know,
standard library libraries thatI I'm gonna try to explain. Very
cool security fixes.
The NetHTTP one is about leakingsensitive data.

Jonathan Hall (01:48):
Oh.

Shay Nehmad (01:48):
So do you know what is the authorization header on,
on HTTP request, like, we woulduse it?

Jonathan Hall (01:58):
Yeah. That's where you would, like, pass in
your auth token or whatever.Right? You say authorization
bearer and then a bunch ofrandom seemingly random digits
that represent a JWT orsomething. Mhmm.

Shay Nehmad (02:09):
What about, like, in general, you have tons of
ways to do it. You usually usethe authorization header. Right?
Yeah. You could use, JWT.
You could use basic auth, blahblah blah. Almost everybody
who's done a web app at somepoint probably had to implement
it either themselves orintegrate with a party, like,
provider. Right? Now let me askyou a slightly harder question.

Jonathan Hall (02:31):
Mhmm.

Shay Nehmad (02:32):
If you implemented this, you probably know what a
four zero one error is in HTTP.Right? Yeah. What's a 401?

Jonathan Hall (02:38):
I never remember 401 versus 403.

Shay Nehmad (02:41):
401 is unauthorized.

Jonathan Hall (02:43):
Unauthorized. Yeah. And 403 is Forbidden.
Forbidden. Yeah.
Mhmm. So unauthorized meansthat, like, you have not
provided meaningful or correctauthorization token of some
sort. You haven't authenticated.Right?

Shay Nehmad (02:58):
Yes. And now I'm gonna raise the stakes one level
higher to get to the actualproblem in this in this security
release. What is 407? Do youremember? No.
Okay. So they also forgot aboutit when they implemented NetHCP.
Basically, in the same way youhave authorization, you have a
header called proxyauthenticate. There's a weird

(03:20):
ass thing in HTTP that proxiesare like a part of the protocol
in some sense Mhmm. Instead ofbeing like just an extra layer.
So there's a lot of like littlegotchas, and this is one of
them. In NetHCP, when you havean authorization header, right,
if you do a redirect, you don'tcopy the authorization header.

(03:42):
Right?

Jonathan Hall (03:43):
Okay. Sure. Yeah.

Shay Nehmad (03:44):
Because you don't wanna like, you redirect the
request from cross origin,right, from a to b, and you
wanna make sure that you wannastrip these sensitive headers.
Why? Because if you redirect toa different site and you keep
these headers on the request, Icould just redirect you to,
like, my malicious site Mhmm. Itit by just doing some XSS or

(04:06):
whatever on a popular web siteor phishing or whatever. Mhmm.
You would log in with your realthing, and then I redirect you
to mymalicioussite.com, and Istill get the these, like,
highly sensitive headers, whichbasically include your
authorization. Like and then Ican, like, use your token.

Jonathan Hall (04:22):
Mhmm. Makes sense.

Shay Nehmad (04:24):
They did it for authorization, w w w
authenticate, cookie and cookietwo, and they just sort of
forgot. Proxy authentication orproxy authenticate. If you look
at the actual change with andand I'll put the specific
commit. We don't usually dothis, but I'll put the specific
commit in the show notes. It'slike the easiest I could read

(04:46):
the commit out loud.
You just add these two values tothe constant thing of, oh, the
case includes also proxyauthorization, proxy
authenticate, and they alsoadded, like, a one test case
just to make sure. But, yeah,proxy authenticate. It's like a
header that defines theauthentication method or

(05:09):
challenge to gain access behinda proxy server. So you put the
thing in proxy authenticate, andthen the proxy would, like,
translate the request internallyand just put it in the regular
header. And four 07 is the proxytelling you, hey.
You forgot to give me the credsinstead.

Jonathan Hall (05:25):
Right.

Shay Nehmad (05:25):
So it's like part of the fetch standard. It's part
of HP standard. It's, like,written all over the place. Just
in every place you see, thenormal authorization thing is
written, and then in, an extraparagraph, it's also, oh, don't
forget, also, proxy. So they didforget, and it was reported by,

(05:45):
I hope I'm saying thiscorrectly, Takeshi Kaneko, from
GMO Cybersecurity by Leria,something like that,
Incorporated.
Thank you for reporting thisissue. So they fixed this CV. If
you have GoCode that does, like,network stuff, server stuff, you
implemented the proxy orsomething like that Mhmm. Super

(06:07):
relevant to you and you

Jonathan Hall (06:08):
should

Shay Nehmad (06:08):
like broadly upgrade.

Jonathan Hall (06:09):
I've done a lot with proxies. I don't think I've
ever used proxy off that I notin Go anyway. I may have in a
previous lifetime.

Shay Nehmad (06:17):
It might have happened like without you
knowing it. Right?

Jonathan Hall (06:20):
Yeah. That's very possible.

Shay Nehmad (06:21):
EngineX taking care of it for taking care of it for
you or something. So that's theone.

Jonathan Hall (06:26):
Alright. What else?

Shay Nehmad (06:27):
The security fix is also super cool. And it's one of
your favorite topics, Linuxagainst Windows. Right? Long
time listener of the show, willknow that Jonathan uses Linux,
which is why it took him, like,three months to set up his home
network when he moved to his newThat

Jonathan Hall (06:45):
is not why, but okay.

Shay Nehmad (06:47):
It's in the same culture category. But there is,
there was just a behavior thatwas inconsistent between Linux
and Windows, when you try to,create a, like, a file handle.
Let me I'll describe thescenario and you'll tell me what
do you think should be thebehavior. Right? So I'm calling
open file Mhmm.

(07:08):
On with, like, create. I want tocreate a new file. Right?

Jonathan Hall (07:12):
Alright.

Shay Nehmad (07:13):
And the target path is a symlink, like a dangling
symlink.

Jonathan Hall (07:17):
So there's is a symlink that that's on the disk,
but it doesn't point to anythingand you're trying

Shay Nehmad (07:22):
to create Like a shortcut. Again, in in Windows
terms, like a shortcut, but thethe underlying thing behind the
shortcut doesn't exist.

Jonathan Hall (07:28):
Alright. And

Shay Nehmad (07:29):
now I'm trying create

Jonathan Hall (07:30):
that file even though it already exists as a
symlink. Okay.

Shay Nehmad (07:34):
What should I do? What what should happen? What
would you want to happen as,like, a developer?

Jonathan Hall (07:38):
I would either want to overwrite that file or
give an error because it alreadyexists depending on which mode
I'm using. Right?

Shay Nehmad (07:46):
So it's with ocreate and oexcel.

Jonathan Hall (07:49):
So that would I would expect that to give an
error.

Shay Nehmad (07:52):
So there's an inconsistent behavior between
these two systems. In theproposal, you can even see,
like, they included a test thatshows, like, this test will pass
on Linux and fail on Windows,which is like, you know, when
you call OS open file, you wantto see an error. So if you
create a symlink to somethingthat does not exist, it should

(08:15):
fail when you try to create thatto, like, open file and create
that file. When I looked intoit, the one interesting thing I
found is the hacking lab, like,behind it. I'm I'm not sure what
type of organization it isspecifically.
Maybe it's like an academicthing. It at least looks like
it. But hackinglab.kaist, whichis in Korea, the Advanced

(08:37):
Institute of Science andTechnology in South Korea. They
have, like, a GitHub. They havethe people.
And, the person who reportedthis specific vulnerability,

Jonathan Hall (08:46):
I hope I'm pronouncing your name

Shay Nehmad (08:48):
correctly, Joon Young Park. They're just one of
the PhD students in this group,and it looks like there's a lot
of people here, which I I Ifound it pretty cool. Like, you
can see the the people behindit, and they're, like, a bunch
of students in in South Korea.So so if you wanna follow them
or or or, like, check it out,you go to kaishacking.github.io

(09:10):
and, like, see all of theirpublications, all their CVs.
They do some really cool stuff.
Insecurity of mandatory securitysoftware for financial services
in South Korea. Just like apaper and things like that. I
thought it was pretty coolbecause they're, like, not just
doing it's not just one person.It's like an organization, a
hacking organization, which wedon't see very often. For

(09:31):
example, Junyoung Park releasedin the beginning of this year.
RgFuzz, rule guided fuzzer forWebAssembly runtimes. That's
cool. You know what I mean?Yeah. And they also have some
CVs and even, like, the thenumber of dollars they made on
Bounty on it, which I thought isa pretty strong flex.
Right? Like, look how much moneywe made bug bounty. So that's a

(09:56):
security release. The bottomline is you need to upgrade your
minor version. You should dothat anyway.
Even if you don't understand thethe underlying security fixes,
you always wanna be on thelatest version.

Jonathan Hall (10:06):
And of course, the one you didn't go into
detail on is related to x fivezero nine certificates. If
you're using that, upgrade too,even though we're not talking
about the details there.

Shay Nehmad (10:14):
Yeah. So a cool, like, security release. I liked
it. I like it when the securitystuff is this thing I can
pretend I understand. Awesome.

Jonathan Hall (10:23):
Next up. So anybody who follows Go on social
media probably already knowsthis has happened. But the Go
team, specifically RobertGrasmere, has published a post
about this error handling in Go.TLDR, we've been talking about
improving error handling foryears with dozens or hundreds,
possibly thousands of proposalsdirectly or indirectly related

(10:45):
to it and cannot get anywhereclose to consensus. So Go team
has decided for the foreseeablefuture, we will stop pursuing
syntactic language changes forerror handling.
We'll also close all open andincoming proposals that concern
themselves primarily with thesyntax for error handling
without further investigation. Ican hear half of the audience

(11:06):
cheering. I can hear the otherhalf of the audience groaning. I
don't know. Regardless of theconclusion, I feel like it's a
little bit of a nice to have areprieve from this topic.
I don't know. What do you think,Shay? I'm really

Shay Nehmad (11:27):
happy to like, anything that helps focus. Yeah.
Is a good idea. Like, if theteam can focus on on things that
the whole point of of Goproposal, Go discussion, Go
whatever is to drive action.Right?
Mhmm. These discussions are notaction. Action is code that goes
it gets committed to go and getsreleased in a version. Yep.

(11:48):
Anything else is is bureaucracy.

Jonathan Hall (11:50):
Fair enough.

Shay Nehmad (11:51):
Code or documentation or talks or
education or funds, like, theseare actions. But just talking
about, the proposal itself,while it is useful, it's only
useful in the sense that it willlead to action. I'm a 100%
convinced that talking abouterror handling in Go will not
lead to action at this point. SoI'm really glad to see them

(12:13):
closing the lid on it. I feelthe same way about the like
YAML.
Right? I proposed a while ago toput YAML in the standard
library. They gave a really,really good reason why not to,
and I was like, you know what?That's fair. But then I I I on
on something I care about evenmore, I was like, the time
formats in Go are horrible.
Let's improve those. They werelike, listen, we feel you. We

(12:35):
think you're right, but look atall these previous discussions.
We're not opening this anymoreand they just closed the issue.
So it stung for a little bit,but on the other hand, now they
can focus on, I don't know,things that that do have
consensus and will go into thelanguage.
And there are so manyinteresting things we can do.
Right? This allows focus. So I'mhappy that it allows focus. And

(12:58):
I'm putting aside my opinionabout whether I think error
handling in Go

Jonathan Hall (13:01):
is good or not. Yeah.

Shay Nehmad (13:03):
Putting my opinion back in, I think error handling
is fine. Like, I don't get whatit's fine. Sure. It's a little
verbose. Whatever.
Who cares? Look, at the momentyou get used to this code, you
read through it pretty fastanyway.

Jonathan Hall (13:15):
Yeah. I'm I'm reminded I know not everybody
listening here, of course,follows the US Supreme Court.
And And I'm not talking about aspecific case, but whenever they
often rule on something otherthan the actual case, right?
Like, I don't know if Bob shouldhave been allowed to do this
thing to Alice, but he wasn'tallowed to sue her for this
reason, that sort of thing. Andthis is kind of like that.

(13:36):
Like, nobody's saying that errorhandling is good or bad. That's
not the point. The point iswe're not talking about it
anymore because we can't makeprogress on the discussion
around it. So, yeah, there'sroom to love or to hate GIL's
error handling and still decidewe're not gonna talk about it
anymore.

Shay Nehmad (13:51):
Yeah. Now you know it's set in place. So I think
it's called, like, a legalprecedent or something like
that.

Jonathan Hall (13:58):
That's a separate con concept. Yeah.

Shay Nehmad (14:00):
Oh, okay. Never mind. Will say, I think that at
this point, people who are,like, unhappy with the error
handling to the point thatreally, really bothers them are
are gonna be less and less.Because I don't know about you,
but the more I use like Copilotand this exactly the sort of

(14:21):
boilerplate that I'm happy tosee when I'm debugging, right?
Because I can read the code lineby line and there's like no
magic.
I'm I what's the line of codeI'm reading is the line of code
that's running like on the CPUand there it's not like, oh,
there's gonna be an exception orsomething unexpected monkey
patching like in Python orwhatever. Right. But writing the

(14:41):
code is becoming less and lessof a bottleneck because the
moment I start writing afunction, cursor like already
like does the if error is notnil return error or whatever
error handling pattern I alreadyhave in that function. So
writing it is not a big And whenreading it, I'm happy that it
exists because of the like extradebugging ease that it gives me

(15:06):
and like my ability to reasonabout the system. This is my
opinion.
Not like this is just an opinionin that regard, but I think it's
one of the reasons that drivethem to to change this. Because
if, I don't know, instead ofLLMs, we had a different thing
invented that would make readingcode and reasoning about code

(15:26):
like the main thing that'simproving all the time and you
would look at code all the timeinstead of writing it. Maybe it
would have, you know, tilted thescales a different way. But with
the the physical text in thecode file becoming less and less
typed and more and moregenerated, like who cares? I
didn't care before, but now Icare even less.

Jonathan Hall (15:44):
All right. Well, enough about that. We're not
gonna talk about error handlinganymore ever on this show since
it's been closed. We probablywill talk about it on the show,
but

Shay Nehmad (15:55):
Go team does not allow it.

Jonathan Hall (15:58):
So we have one more story to talk about, a blog
post before we jump into thebreak and the lightning round.
This blog post comes from Ottawain Delaware. It is called You
Probably Don't Need a DIFramework. And I have to say I
was very happy to read this, notbecause of the content per se or
the opinion it expresses, butbecause it explained to me what

(16:19):
a DI framework does in Go. I'vebeen wondering this for a long
time because I've never usedone.
And I do agree with theconclusion that aside now, do
agree with the conclusion thatyou don't need one. I've never
used one, therefore I don't andI do dependency injection all
the time. So I'm not surprisedto hear someone else say that
you don't need one. What wereyour thoughts when you read
this, Shay?

Shay Nehmad (16:38):
My thoughts on it is it's very pragmatic. I like
it a lot. Coming from both lowerlevel and higher level
languages, like my experiencebefore starting Go was either
like c plus plus, like Python,and c sharp. Mhmm. Dependency
injection was a big thing.
Like, everybody taught me, oh,object oriented, dependency

(16:59):
injection, solid framework, blahblah blah. But then when I
actually did my well, thecivilian projects I didn't go at
Recco, we just did we justpassed things Yeah. In
Constructors. And I was reallyhappy with that. So I based my
design based on like GoKit,right, which is mostly very like

(17:24):
lightweight, not a lot of, like,framework framework, capital f
framework, few opinions.
And one of the opinions is like,okay. So you need, a service and
a controller and a blah blahblah endpoints, and we're gonna
generate those for you. Butyou're just gonna have a big,
like, main where you call new ona whole bunch of things, and

(17:44):
there's gonna be, like, twoseparate concepts. And I really
like that when your code is,this file is called Bootstrap
and it calls new on all thethings based on configuration,
like initialize the logger orwhatever. And the rest of the
files are your business logic.
And they just assumeeverything's already
initialized.

Jonathan Hall (18:00):
Mhmm.

Shay Nehmad (18:00):
It's great for tests. It worked really well for
me. I'm really happy to see,like, someone who's working at,
like, a real company. Red oneis, like, at Walt, which is a
huge, like, it's like DoorDash.I used to use it all the time as
well, saying basically, yeah,Shay, you were right.
Your lived experience does trackin other companies as well.
Yeah. If you let your DIframework figure it out for you,

(18:22):
you're gonna have a bad time.And calling new and a whole
bunch of things just is easierthan having it happen in runtime
using the, DI framework. I thinkthe the biggest problem is that
the, DI framework also came fromGoogle.
Right? So the wire, DIframework, which is the biggest

(18:43):
one, is also from Google. So ithas an air of, like, being
official or being, like, thesupported way to do things,
which is just not true. So I'mreally happy to see those blog
posts. I think it's it's it'sright on the money.

Jonathan Hall (18:57):
So I do think it's worth pointing out the
problem that DI frameworks aresensibly meant to solve, right?
And that is that you sometimesend up with these constructors
that take five or 10 or 20 or100 different arguments for all
the different dependencies theyhave. Right. And that can look
ugly. And by using a dependencyinjector framework, maybe pass

(19:17):
one thing in that kind ofmagically handles all that for
you.
So it can look nicer, but Ithink that it's the infamous
example of hiding complexitythat Go tries not to do.

Shay Nehmad (19:29):
It just adds more confusion than what it's worth.
Don't think it is of zero value.It's nice. I just think that the
cost it introduces is muchhigher than the value. Sure.
Even if you have a ton ofmodules. And by the way, like,
if you have a thing, like a newcall that that has a million

(19:50):
dependencies. Right?

Jonathan Hall (19:51):
Mhmm.

Shay Nehmad (19:52):
Let's say not a million. Let's say re
reasonably. Right? It's the Idon't know. Your main whatever
module.
Right? And it depends on thedatabase module, and the
database module depends on theconfiguration module, and the
configuration module depends onthe logger module. Mhmm. Right?
And it also depends on the, Idon't know, widget service, and

(20:12):
the widget service depends alsoon the configuration module,
blah blah blah, etcetera,etcetera.

Jonathan Hall (20:16):
Mhmm.

Shay Nehmad (20:17):
And you're like, oh my god. I'm calling I'm passing
in the logger thing a milliontimes. Wouldn't you prefer to
see it and be like, oh, maybeit's better for me to just make
the logger, like, global staticand and not have all these
dependencies. If you don't ifyou have a DI framework, it's
not like that Yeah.Architectural nonsense doesn't
exist.
It just happens at runtime.Mhmm. I would rather just see

(20:40):
it, like, with my two eyes andand see, oh, this is the
complexity I'd introduced. MaybeI should do something about it.
I'm using NestJS right now,which is all about dependency
injection.
It's JavaScript, unfortunately.Well, TypeScript. But, like, you
never call a constructor ofanything. You just define, like,
in decorators this, depends onthat, imports this, and it,

(21:01):
like, calls the decorators foryou. And both me and my CDR are
just, like, haphazardly tryingto add random imports here and
there, trying to make the, like,runtime resolver work.
And then, you know, I I I don'tmean to, like, crap on SJS. It's
fine. But you you need to buythe DevTools, like, SaaS

(21:22):
application. It's $5 a month.And then it reports to you, hey,
you have these unnecessary, Idon't know, provider exports
that you can remove.
So it's like, wouldn't I justrather write the constructor? I
don't know.

Jonathan Hall (21:37):
Yeah. Constructors are the are the one
exception I have to the thegeneral rule of like no more
than four arguments to afunction or whatever number you
choose. Right? I don't followthat religiously when it comes
to constructors because I wantto see just like you're saying,
I want to see the complexitythat my constructor is taking
on. And sometimes I refactorthat.

(21:57):
I feel like my constructor istaking too many things, that's a
sign that maybe I need to dosome refactoring, move some
densities around, turn it intotwo different things or
whatever.

Shay Nehmad (22:05):
Yeah, the graph is too dense. Yeah. I I will say my
rule is the same, but that allconstructors must be either in
bootstrap.go or be of somethingthat is actually in the in
business value is dynamic, likeloading a real plugin, like
loading a new DLL into Notepadplus plus or something. But I I
really don't wanna call new on,like, a real module. I'm not

(22:29):
talking about, like, a a just adata transfer object.
The real, like, class thingoutside of, like, the the graph
creation part of the code. Soyou have graph creation part of
the code where functions cantake as many parameters as they
want because this basicallyrepresents the wiring of your
application versus the businesslogic where that represents just

(22:50):
every single node and you wantevery single node to be very
understandable and small, take afew like, functions should be
short, be tested, blah blahblah.

Jonathan Hall (22:58):
Yep. Absolutely.

Shay Nehmad (22:59):
So I I love I love this blog post. Great stuff,
Radwan.

Jonathan Hall (23:03):
I'm curious if anybody listening disagrees. If
if you love your DI framework,let us know why, which one
you're using and what problemsolves for you and why you love
it. We'd love to hear about thaton our Slack channel, which I
think is a great segue into ourlittle break where we talk about
our Slack channel. So if youdon't know, we have a Slack

(23:26):
channel. It's on the GopherSlack or Cup A Go.
Kebabcase, come join theconversation there along with, I
think we have close to 600people now, five fifty three.
You can also find us on the web,cupago.dev. You can find links
to all of our things there, ourswag store, all the past
episodes, links to our personalprofiles so you can see what we

(23:49):
look like. Yeah. What else,Shayne?

Shay Nehmad (23:51):
It's a cool channel. It's kind of a fun
place. I accidentally incited anAI related discussion, so maybe
wait a day, and then it'llbecome like AI free zone again.

Jonathan Hall (24:03):
Well, you're in San Francisco where apparently
they believe in AI a 110%.

Shay Nehmad (24:07):
So I mean, I I took a driverless car to my to my
meetup, so I I it's hard toargue with it, you know. There's
something in the something inthe water. I do wanna shout out,
like you said at the beginningof the show, the show is
supported by the listeners viaPatreon. So two things. One,
Patreon reminded me to remindyou, don't use the iOS app

(24:28):
because it takes like a cut.
So just use the web versioninstead. We wanted to say a lot
of thanks to our new listenersthat joined Patreon. Landy
Bible, new supporters, I shouldsay. Landy Bible, Michal
Christensen, and Simon Law,which I met actually physically

(24:49):
in the meetup. Like, I know howthis person looks.
Thanks, Landy, Mikkel, andSimon. We really appreciate your
support.

Jonathan Hall (24:56):
We don't pay to advertise, so if you could share
this show with your friends,colleagues, fellow students,
leave a review, leave a rating,that is all that we need to get
this show known about. Ourlistenership is growing. We had
a record breaking month lastmonth as far as number of We
love that. Keep up the goodwork. Keep keep sharing the

(25:17):
show.

Shay Nehmad (25:19):
And one final reminder, if you want to replace
Jonathan next week and host theshow with me, talk to me on the
Slack. I don't wanna do theepisode alone, basically, is it?
Alright. Let's do a quicklightning round.

Jonathan Hall (25:32):
Let's do a lightning round.

Shay Nehmad (25:36):
Lightning round.

Jonathan Hall (25:39):
on the lightning round, the Stack Overflow
developer survey this year isopen.

Shay Nehmad (25:43):
Stack Overflow? I thought it's dead.

Jonathan Hall (25:45):
Yeah, but I think it might be. That's a shame
actually.

Shay Nehmad (25:48):
I have

Jonathan Hall (25:48):
to say I did this survey and you can imagine it's
all about AI and how do you useAI and how would you like Stack
Overflow to be improved with AI?And I have to say, I think half
of these questions are writtenby AI because they don't make
sense and there's grammaticalerrors and like logical errors
and all sorts of ridiculousnonsense. I have to say, I

(26:09):
wasn't really impressed with thesurvey this year. But I thought
I'd

Shay Nehmad (26:12):
tell you I'll tell you another thing, and I'm
putting this in in our channelright now, like our internal
host channel. I just openedStack Overflow, and it got like,
oops, something bad happened,error. You know what? I'll skip
it this year, I think.

Jonathan Hall (26:26):
Anyway, when the results are out, we will, of
course, go digging through theresults to see anything relevant
to go, and we'll talk about thatin a in a few weeks or months
whenever that's around.

Shay Nehmad (26:35):
If there's something relevant.

Jonathan Hall (26:37):
If there's something relevant.

Shay Nehmad (26:38):
It might have faded into irrelevance, this site,
unfortunately. My LightningRound thing is a cool cool idea.
I haven't tried using it yet. Idon't think I will, but I really
like it. It's called Gitbug.
Where do you you are like acontractor. Right? You do work
with clients for them, whatever.Where do you like tracking bugs

(27:00):
the most? I assume it's notJira, even though you had to do
Definitely

Jonathan Hall (27:03):
not Jira. Linear maybe? I usually prefer whatever
is tied to the source controlwe're using. So it's usually
GitHub issues or GitLab issues.

Shay Nehmad (27:13):
So you might like Git bug, which is storing the
bugs in, like, inside Git in inthe dot Git directory. So you
manage issues, users, andcomments, like, directly from
within the repo. So it'sversioned, it's, like, clutter
free, it's distributed. Right?So it's, like, on everybody's
machine.
It's kind of fast because it'son your machine and it even

(27:37):
synchronizes with GitHub usingbridges. You know Interesting.
You could start using it whileyour team is using GitHub. This
is all like theoretically.Right?
I I haven't tried it yet. I dowanna try it using it like and
combine it with linear and seehow it works. But it's sort a
new project. I found it. It wastrending on on GitHub.
That sounds like something you'dlike to be involved in. Check it

(27:58):
out. I I I think it's ratherexciting. Like a new way to
track bugs. That's cool.

Jonathan Hall (28:03):
Interesting. Yeah. I'll have to check it out.
I'm curious how it would handle,like, conflicts and stuff,

Shay Nehmad (28:08):
but And videos. Like, half of the bugs I I put
for the front end, I wanna sayteam guy at work Mhmm. Is an
advantage of working in a smallstartup. Include like a small
video of me like, hey, this ishow it messes up. Yeah.
It is interesting. I I like theI like the concept. Might try
it.

Jonathan Hall (28:28):
Cool. Last today on the lightning round, friend
of the show and previous cohost,so I guess he's not eligible
this time. Jamie Tanner has donea blog post about looking back
for last year about API cogen.We had him on the show as an

(28:48):
interviewee also talking aboutOpenAPI Codegen.

Shay Nehmad (28:51):
Sure, yeah. So as you mentioned, I am one of the
maintainers of a Go command linetool and library called OAPI
Codegen. OAPI Codegen transformsOpenAPI specifications.

Jonathan Hall (29:07):
If you are a user or potential user of OAPI
Codegen, this might be relevantto you. It sort of gives us,
like I said, a summary of thechanges over the last year,
which were versions released.And of course, looking forward
into the future, they're lookingfor some sponsors. Jamie would
love to spend some dedicatedtime on this to implement new

(29:27):
features that are not thereright now.

Shay Nehmad (29:29):
Yeah. Specifically OpenAPI 3.1, like supporting the
new version of OpenAPI.Generally, I think this blog
post, this like post on theGitHub announcements and his
blog post on his site. Just givethe air of this is like a
serious thing, like seriousproduction thing, which is very

(29:50):
cool.

Jonathan Hall (29:51):
So that's it. Check it out. We will be back
together in two weeks time nextweek. I hope you have fun
without me.

Shay Nehmad (29:57):
Alright. Program exited. Program exited. Goodbye.
Advertise With Us

Popular Podcasts

Stuff You Should Know
Dateline NBC

Dateline NBC

Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com

On Purpose with Jay Shetty

On Purpose with Jay Shetty

I’m Jay Shetty host of On Purpose the worlds #1 Mental Health podcast and I’m so grateful you found us. I started this podcast 5 years ago to invite you into conversations and workshops that are designed to help make you happier, healthier and more healed. I believe that when you (yes you) feel seen, heard and understood you’re able to deal with relationship struggles, work challenges and life’s ups and downs with more ease and grace. I interview experts, celebrities, thought leaders and athletes so that we can grow our mindset, build better habits and uncover a side of them we’ve never seen before. New episodes every Monday and Friday. Your support means the world to me and I don’t take it for granted — click the follow button and leave a review to help us spread the love with On Purpose. I can’t wait for you to listen to your first or 500th episode!

Music, radio and podcasts, all free. Listen online or download the iHeart App.

Connect

Š 2025 iHeartMedia, Inc.