MIND the gap, the buffer, and the GC; interview with Guy Gofman

Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Jonathan Hall (00:00):
The show is supported by you. Keep that in
mind until after the show whenwe talk about that.

Shay Nehmad (00:04):
That's foreshadowing.

This is Cup o' Go for 11/14/2025. Keep up to date
with important happenings in theGo community in about fifteen
minutes per week and sometimesinterview as we have this time.
Keep that in mind.

Oh, that's foreshadowing

I'm Jonathan Hall, by the way.

And I'm your co host, Shay Nehmad. Hey, Someone
sent me our, like, fourthepisode.

Okay.

Yeah, on LinkedIn, he was like, oh, I'm listening
to the whole thing, from thebeginning. And I I like clicked
on the link and I was like, oh,that'll be a fun, like trip down
memory lane. And I remember thatwe used to say, I'm your co
host, Jonathan Hall, and I'myour co host, Shine Akman. Since

(00:57):
then, we've dropped the titles.So before we jump into this
week's news, would like to askyou, what is your title in the
Cup of Go, you know,conglomerate?

I think I'm just a cup of gopher.

Cup of gopher? Yeah. I would like to be a chief
of staff, CTO, CEO, vicepresident, president, emperor,
the god king.

Oh, I will grant you all of those titles as long
as you put it in your LinkedInprofile. Actually,

my LinkedIn profile is a little bit full already
because I put a ton of hiddenUnicode characters in it to
prompt inject the scrapers. ButI might. I might. I have just a
boring, like, oh, foundingengineer at company x. I could
do, like, god king at atCapagun.

I used to be the one of the leading members of
the Air Capital Linux usersgroup, aka a kludge. That was in
Wichita. And one of the guys, hecalled himself dictator for
life.

Don't know

if Not even benevolent. Yeah. Not he didn't
even claim to be benevolent. Hewas just dictator for life. I I
suppose that means he still is.
If you're listening, Clint, letus know.

Hi, Clint. Of kludge. Okay. So now that the
title discussion is aside, wecan do salaries, later. Yeah.
Let's do some GO news.

Let's talk about security.

Yeah, let's, let's. We have actually a pretty
security heavy episode. I wannaleave with the fact that we have
an interview with a guy from,Mind, which was lot of fun.

You say a guy from Mine?

No, just Guy.

That's just Guy. It's a guy called Okay, got it.

Guy Goffman from, Mind. But we actually have a
security release that's, goingto come out on Wednesday,
November 19. So it's like afixed pre announcement to the
crypto package. And looking upthe CVEs, I was, like, kinda
concerned. There's a nullpointer dereference in Calypso

(02:58):
with the same number of CV,which is already published, but
I can't understand how it'srelated to Go because it's like
internal c code in Linux.
So I don't know if it's just aCV number mixed up on the
security pre announcement or ifit's actually related. I'll try

(03:19):
to make a note to get back toit, but it's a vulnerability, in
the Calypso library withinLinux, specifically a null
pointer dereference one. Ithought it would be a good
opportunity to bring ourlisteners into some drama from
other languages because, youknow, and other like ecosystems.

(03:40):
Have you heard about this recentlike Linux things?

No, I haven't. I mean, use Linux, but I don't
follow the news that closely.

Have you used the sudo command in Linux?

Oh, yeah.

For many, many, many years, I assume.

Yes.

So you'd probably be surprised to know they're
rewriting it. They're rewritingit in Rust.

Oh, okay.

And there's a whole movement of, like, rewriting a
lot of the Linux kernel in Rustto make it memory safe, exactly
to avoid vulnerabilities likethe one I think the pre
announcement accidentally mixedup in the numbers, like a null
pointer dereference in theCalypso library within Linux,
which is like a networking IPv6thing. Yeah. Okay. These things

(04:26):
won't happen if you use a memorysafe, like, completely memory
safe language, like, Rust,right?

I guess that's the idea, right?

So Yeah. That's the whole point, basically.

Yeah. Exactly.

So everybody's happy and there's no drama as
you can

Of course not. There's never drama about which

So language to there's a rewrite of sudo called
sudo rs, which has been deployedto the recent Ubuntu
distributions and it hasvulnerabilities. Not like memory
vulnerabilities, not like nullpointed reference, just like
security vulnerabilities, likeall normal ones. And people are

(05:04):
up in arms because, you know,the original software has been
written in C and it's superbattle tested. You know, it's
been out there for years andyears, and now people are
running in rust and very angry.But on the other hand, if you
don't do this stuff, you get CVslike this.

Right.

Go is obviously not a contender for these, like,
very low level operating systemthings. Right? Nobody would
write a desktop software in Go.Nobody in the right mind.

Why why foreshadowing again?

But, yeah, I I thought it was interesting.
Usually, these securitybuildings are more like you
search for the CVE, you can'tfind it. But now I found it, so
I don't understand what's goingon. And I'll we'll we'll I'm
I'll make a note to follow-upnext week. Yeah.
And understand what happened.

Next week, we'll we'll let you know if they made
a mistake or if if we made

a mistake. It's actually related somehow to this
problem? Possibly. I don't know.Anyway, on, November 19, if you
use the crypto, x crypto, xcrypto SSH or x crypto SSH agent
libraries, you should probablyupgrade.

Probably should. In other news, something you
might wanna update far, far intothe future, there's been a new
proposal that is currentlyunlikely accept stage. I don't
think this would probably makeit into 1.26, though it
technically might because thefreeze doesn't happen for two
more weeks. But I imagine thisis more likely to be in 1.27.
The proposal is to remove cyclerestriction for type parameters.

(06:27):
You know how Go doesn't likecircular dependencies and things
like that? Yeah. It also doesn'tallow a circular type
parameters. So you can't createa generic type T that either
directly or indirectly throughother types refers to itself.

That makes sense to me because how would you resolve
it?

Well, have figured out how to resolve it
and they wanted to remove thatrestriction. Oh. That you could
have circular type definitionsfor type parameters. So that's,
yeah, I don't know the mathsbehind solving that problem,

but it seems

like it could be, forthcoming.

What's the use case for, like, it's always hard for
me to come up with a use casefor generics anyway. But with
one generic parameter or twogeneric parameters, can still
visualize it, you know. But doyou have any specific use case
where you would use recursive,like, I don't know if it's

(07:23):
recursive, but like cyclic typeparameters? What's the Who's
asking for this basically iswhat I'm asking.

Yeah, I don't know what the specific use case
is, but if I wanted to do this,I would probably consider like a
tree walking or like an AST typeof thing as a likely candidate
for that. Or you have nodes thatcan reference different node
types that reference themselvesand, you know, something like
that.

So like linked list and all these sorts of things,
you want to define them, if youwant to define an operator on
them, so like an element in thelist has a less than function.
You want to define an interface,but then you could do like
element, e, element e sort ofthing.

Could be. But actually

t, element t.

There are some examples actually here in the
issue. So one is, this isobviously a toy example, but an
addable interface that takes atype parameter that returns a
value that needs to be able toadd to itself. I think it's hard
to visualize that, but if youreally want to go look at the
the issue, it makes more sensewhen you're looking at it than I
know how to explain verbally.

Yeah. The the spec the final update on this from,
Robert Griesmer is like, oh,Gopher bot closed it a bit too
early, but it's it definitelyseems like it's going to get
implemented, like, going to beaccepted soon. Yeah. And
honestly, like, who would beagainst it?

Yeah. I mean, if it's if it's reasonable to do
it, then I think you shouldallow it. The only reason not to
is if it's if it like createsinfinite loops or whatever in
the resolving algorithm, right?

I mean, yes, I don't love the fact that a lot
of people in the language arefussing with like edge cases of
generics instead of improvingmore concrete things. Like, I
don't love that that's where theattention is going because I
haven't used them yet. That'scrazy. But I think I've defined,
like, two generic things withGo. Like, I'm just not finding

(09:21):
myself using this stuff for myday to day.
So and it's been a while. Like,it's not like they released it
yesterday and I'm notimmediately replacing. It's
okay. I'm not saying it's notokay for them to not to, like,
use this stuff, but, to work onthis stuff. But I wonder how
much of the mindshare shouldactually go to generics and,
like, finalizing that or can wesay, ah, it's fine, whatever,

(09:43):
let's focus on other things.
I've never seen that in theproposal process. Just like,
yeah, this looks okay, but wejust don't wanna do it because
it's not important.

I suspect that happens because there's lots of
open proposals, I know thisbecause I've created a few, that
are neither closed nor gettingattention. So they're just
sitting there. I think thatthat's what happens when it's
the kind of thing that theythink is not important.

And I think, you know, it's sensories and when
you have a bunch of languagedevelopers that they would love
to nerd out about developinglanguages. And to be fair, Go is
doing a lot of like good,useful, concrete things all the
time.

I just wish they would add enums.

Yeah, I saw you complain about that today, this
week.

Let's move on.

Let's move on. Proposal rejected, add enums,
please. Yes. I'm just kidding.We have another accepted
proposal

about Another proposal I'd like to talk about.
We might have mentioned thisbefore. I can't recall. This
one's accepted. It's alreadybeen fixed or resolved.
So I imagine this is coming in01/1926 in February. It's just
to add the peak method on bytestop buffer. This isn't about
being a peeping Tom. Well, maybeit is. I don't know.
I guess it depends on what's inyour buffer, right?

What's in your buffer? The

idea of peak is that you can see what the next
byte is in the buffer withoutincrementing to the next byte.
Useful for certain types ofparsing where you need to know
like is the next character, doesrepresent the beginning of a new
object or is it a continuationof this string or whatever,
depending on what kind ofparsing you're doing. So this is

(11:20):
something I would actually use,not frequently, but there are
times when I've had to do thispeaking and peaking without peak
is difficult. It's possible, butit's difficult.

So That seems super reasonable. I also like I can
imagine it's useful for a lot ofthe stuff that Google is doing
because they use protobuf andyou have the type information,
like the fields and whatever uptop, right at the beginning of
the, it's like a few magic byteswhen you serialize a Yeah.
Protobuf. File indicate, youknow what I mean? Like, file

(11:51):
magic bytes are usually at thebeginning.
Yep. If you wanna see ifsomething is valid JSON, a good
way is to open it and see, likeif it's gonna be an object or an
array, if that's the two thingsyou're expecting. Speaking of
that thing and just looking tosee if it starts with curly
braces or brands, just seemslike super useful. Yep. Why is
it difficult to do it without itthough?

(12:13):
Can they just like read thebuffer?

So you can read the buffer, but then your buffer
has been read and you can't likeit, in particular, if you need
to pass that back or maybe,let's say that the operation is
you're trying to read a stringfrom JSON and you're and you get
this this reader and you'relike, if the next thing on the
buffer is a string, I'm gonnaread it. If it's not, I'm gonna

(12:34):
I'm gonna do nothing. You can'tdo literally nothing at all.
It's not possible. You have todo something.

Oh, and then you like sort of invalidated the
reader and you have Exactly. Toreset Got it. Got it. All right.
Is there any work left if it'saccepted and there's already a
change list or is it like alldone?

I think it's done, it's closed. Gopher Bot
said it was completed two weeksago.

Well, Gopher Bot we saw from the previous, he's a
little trigger happy. Cool.Well, I hope we'll see this in
the draft release notes, But I'mI'm just waiting for Anton to
really see some of that.Checking the block. All right.
One last thing I wanna bring upis actually two things. I want
to bring up one very stupid wayto compare languages and one

(13:20):
very smart way to comparelanguages. The stupid way is the
t I o b e index. I saw thisactually on Twitter. Someone was
like, what?
Go is, is only number whateverit is on this index and it's
going down, it's verysurprising. And I was surprised
because obviously I'm biased,but I don't know if you feel it
as well, but I feel like Go ishaving a pretty good moment. The

(13:42):
TypeScript compilers in Go, alot of AI related code, people
realize it's just like chainingnetwork calls together and are
reverting from Python frameworksto Go frameworks. I feel like I
was having a pretty good moment.It's not like in decline.

Okay, so I wouldn't feel bad about Go being
in on number 11 until I realizedthat Pearl is at number nine.
I'm like, what in the world isthis measuring?

And Delphi? I've never literally never saw, I
never saw a line of Delphi

and the Visual Basic isn't number seven? My
goodness, what is this?

So I was surprised and then I understood the
definition and then thedefinition of this index. Even
though they claim it's like, oh,Python, you know, you can use
this as an indicator ofpopularity and choose whether
you should program yourprogramming skills are up to
date, make a strategic decision.You said it's a good index for

(14:37):
non programmers because itactually just searches for
language programming. So likepeople who search for Delphi
programming or Pro programmingor Go programming. And you had
an in by the way, SQL, like whosays SQL programming?

Not programmers, I can tell you that.

Yeah, I don't know. And by the way, you see like on
number 16 or whatever, you seeScratch and MATLAB, so if and R.
So I feel like this gives apretty good indication of what
this actually means. You yousaid this is like something like
programming languages, but notfor programmers or something

(15:17):
like that?

Yeah. I I think this is more or less measuring
the popularity or maybe theinterest in programming
languages by non programmers.Because who else searches for
Python programming 23% of thetime? It's gotta be data
scientists and and, you know,data analysts and stuff like
that, people who aren't reallyvibegrammers.

Vibe coders. Or or like university students, you
know, or high school students orlike Scratch, I think it's being
taught in like middle schooleven. So it's like middle
schoolers going through theirlibrary's computer and being
like Scratch programming. Idon't know. Anyway, this was
kind of weird.

(15:55):
And in contrast, I wanna give apretty good resource for
actually comparing languages,which is a short blog post,
called Rust versus Go Memory,which is just a pretty short,
blog post about memorymanagements in Rust versus Go.
If you've heard about thedifferences between Rust and Go,
you wanna understand them a bitmore deeply, but you don't want

(16:18):
like a super long blog post.This is like a good way to spend
seven to ten minutes and justlike understand very quickly
what's the stack, what's theheap, what's the trade offs, why
use this, why use that. And youknow, if you need to decide if
you want to do Rust or Go, whichis a thing that I show, I see on

(16:38):
the Reddit, the Go Reddit likeonce a week. Should I do Go or
Rust?
Should I do Rust or Go? Whatshould I invest in? It's a big
decision, I get it. But mayberead this and make an informed
decision just based on thetechnical merits of both
languages and your taste versus,you know, random opinions of
people on the internet orreally, really un, non elegant

(17:01):
indexes. I'm sorry I saidstupid.
Like, they they put it out. It'sokay. It's just not exactly
showing what it's supposed toshow, what it's claiming to to
to show. And the blog post,obviously, it's in the, show
notes, so feel free to go checkit out. So that's what I think
about all this comparinglanguages thing.
One other thing to consider iswhere you run them. Right? Like,

(17:23):
obviously, Go is a sort of abackend V language and there's
no other place you would use it,right, John? Actually.

Actually. I need to say it in a more
condescending way. Well,actually, Shai.

Actually.

So I worked with a client a few years ago before
I moved to The US who used Go onMac and Windows machines, maybe
even Linux desktops too. So theyinstalled a sort of a daemon, a
service, whatever. However, allit really did was download the
main app, which was written inthe native, you know, for the

(17:59):
native operating system. But itinteresting. And the reason of
course this came up is becausewe're going to be talking with a
guy from Mind who's doing someof the same sort of stuff.
They're building services thatrun on Windows and Mac desktops,
which is kind of fascinating.It's an interesting sort of
niche case for using Go.

Yeah, so we're gonna have a short break and
then go straight into the AWS,stick around. Thank you all for
supporting this show. This is ahobby, we do it for fun and to
learn, about various, thingssuch as stupid indexes and

(18:39):
peaking and rest of the sillynonsense. But it's kind of an
expensive hobby, takes out ofour time and we pay for hosting
and editing fees. So the bestway to support the show is to
join our Patreon.
Kick in a few bucks a month viaPatreon. If you wanna find the
Swag Store, previous episodes,our Slack channel, our email,

(19:00):
all the links, can findeverything at cupogo.dev. And
other than that, to support theshow, can just share it with
other people or leave a reviewon Spotify, Apple Podcasts,
wherever you listen to yourpodcast, or write about it like
in your blog or newsletter orinternal Slack of your company
or, I don't know, WhatsAppgroup, Telegram group, Signal

(19:23):
group. I don't know what other,groups people are into. Discord,
Discord Do you remember that?
Barely. Oh my god. Any AOL, ifanybody's still using it, you've
got mail. And I'll just sharethe show to, you know, to other
people you think wouldappreciate it. We want to talk
we have a little bit of aprogramming note before we go

(19:43):
not programming.
Well, you know what I mean? Likeprogramming, like the program,
not programming like thelanguage.

Now I know how we're gonna confuse that TOB
index.

Yeah. Yeah. So next week, it's a normal episode.
Week after that, it's,Thanksgiving. It's my first,
Thanksgiving in The US.
I'm very excited. I'm flying outto Chicago. That's the plan, at
least. Unless you all decide todo more shutdowns.

That'll never happen.

So we're gonna take a break. We're gonna take a
Thanksgiving break, give you acouple go less a week. So
prepare, make sure to prep,download some episodes in
advance, synthesize our voicesusing AI and generate an episode
live because we're not gonnarecord one. Anything else for
the break or can we jump to theinterview?

Let's jump to the interview.

All right. Jonathan, how you feeling? How
is the fabric on your shirtfeeling against your body right
now?

This is getting personal.

Your headphones on your head, you feel them?

I do, yeah.

That's good. I've been trying to practice
mindfulness recently. If only Ihad something who someone on the
show who knew a little bit aboutlike mine. Oh, guy.

Guy Gorman (21:03):
Oh, hello. That was tough and top intro of the year.
Hey, guys.

I don't know if that's the worst we've had or or
not, but

It's it's definitely we've the three.

Guy Gorman (21:16):
Down the yeah.

Alright. What are we talking about today since
since we took all this time toget Guy here?

Hello, Guy.

Guy Gorman (21:25):
Hello. Nice to meet you guys.

We're Guy Goffman. Guy, how about you introduce
yourself?

Guy Gorman (21:31):
Hey. So I'm Guy, Guy Goffman from Tel Aviv. I'm an
engineering team lead at MINDSecurity. Started working with
Go when I joined this company afew years back. Before that, my
experience was mostly C,assembly, Python, usually for
low level programming purposes.
So, anything from bare metal toLinux and reverse engineering.

(21:55):
So quite a switch. Yeah. And nowI'm a gofer like you guys.

Welcome. Well, if it's a 180, degrees switch from
reverse engineering just tonormal engineering, it's exactly
it's reverse reverseengineering.

Guy Gorman (22:11):
Suddenly you actually write some write code
that does something useful forthe world.

Yeah. Now just open it up in IDA. Yeah. You like
Man, I love AIDA. Have you everopened AIDA, Jonathan?

Have you asked me that before?

I didn't think Yeah.

And I and I think I didn't know what it was then
either.

It's the best. I love that software, man.
Whenever I see some my wife isdoing some, like malware
analysis right now, so I'll goin at home and she'll like, can
you make dinner? I'll like, lookover her shoulder on the
monitor, it's eye to open, it'slike, maybe I can do the malware
analysis and you'll go cookeggs. This looks like so much
fun.
Anyway, sorry, distraction. Guy,welcome to the show and welcome

(22:50):
to being a gopher. We actuallymet. I I did something for Mind.
It was called something elsethen.
I don't know if the previousname is like a secret.

Guy Gorman (23:00):
No. We were called Tanin Security, which sounds
pretty bad in Hebrew because inEnglish, it's like the tannins
of the wine or something likethat.

Yeah. Yeah.

Guy Gorman (23:08):
In Hebrew, Tanin is a crocodile. I had to explain to
people, yeah, come work with me.I work for Tanin, not the
crocodile, the thing in thewine. Yeah. Rebranding was
required before we got out ofsales.

I'm the The only thing I'm worried about when you
name security companies now is Itry to take the word and add
security later because you'relike, oh, Crocs security, it's
like, okay, I secure the shoes,the little plastic shoes with
the holes. So we wanna talkabout how you use Go in mind,

(23:43):
Mind security. But I think mostof our listeners don't really
know what Mind is because youall are pretty young startups
still.

Not only do most of our listeners probably not
know, but half of our hostsdon't even know.

Yeah. Close to 50% of the hosts of Kabago don't
know my idea.

Guy Gorman (24:01):
How do you know that? Did you open the Go survey
or something?

Yeah. There's a lot of question at the end.
Security?

Guy Gorman (24:09):
Yeah, so for sure. Good question. So, Mind, we're
building a DLP, a modern DLPsolution. For those who are less
familiar with what DLP is, it'sa data loss prevention. Say
you're an organisation, whetherit's small or a big enterprise,
you have plenty of data you wantto secure, whether it's

(24:29):
sensitive customer data,financial stuff, your own, I
don't know, a private recipethat you want to keep secret,
else your competition is goingcatch up.
And that data is all over theplace, right? It's in the cloud
like Google Drive, OneDrive.It's on the endpoint. So your

(24:49):
individual workers, youremployees have it on their
computer, in whatever folders.It can be on a classic, like on
premise file shares, if you'remaybe a more legacy
organisation, an email.
So, the data is everywhere andwe want to help you prevent it
from leaking. That's what DLP isall about. Specifically at Mind,

(25:13):
we want to bring back actualsecurity value to this specific
genre of security productsbecause DLP is an old concept.
There's plenty. It has plenty ofhistory and it's usually seen as
more of a checkbox to getcompliance.
Yeah, I have DLP. So we want toactually help you prevent leaks,

(25:35):
help you find where your data isgoing. Yeah, that's what we do.

Cool. So like a cybersecurity product that helps
companies protect theirsensitive data.

Guy Gorman (25:46):
Yeah. And I didn't even say AI once in this intro,
even though we do use it forclassification. We have like
tailor made classification percompany. Maybe you want to
protect the way you produceyour, I don't know, electrical
machinery. We use AI for that.

And you all are also protecting Gen AI usage,
I've seen.

Guy Gorman (26:12):
Yeah, we are. I mean, it's all the buzz, right?
I mean, it's what your companyis also doing.

Sounds like good business. I'll just say that.
Yeah,

Guy Gorman (26:20):
it might be a bit of a bubble. I'm not an analyst
enough to say that, but we seeprotecting GenAI products as a
feature of our general strategyto protect data. It can leak to
GenAI, of course. It can alsoleak to your private email. It
can leak to a private GoogleDrive.
It's the same for us.

Cool. Cool. How long have you been with mine?
Since the beginning, actually,if we met

Guy Gorman (26:45):
Beginning, I'm one of the founding guys. Second or
third, depends who you ask. So,yeah, I've been here for three
years. Built it from scratchwith the others, learned Go on
the way, on the job and Reactand all that stuff. That's
actually

an interesting If you're one of the founding
members of the team, you saidyou learned Go in Mine. So it's
not like you came with Goexperience and you said, oh,
that's what we should use. So Iguess the team was already
pretty opinionated on using Gofrom the get go.

Guy Gorman (27:20):
Yeah, it's a good question. I think our VP of R
and D, one of the founders, Hod,he came from another
cybersecurity startup where theyused Go to great effect. And he
liked it. I think he also likesthe strongly typed stuff and
performance languages. So Idon't I wasn't actually part of

(27:41):
the conversation on whether weshould use Go, but I learned it
on the job.
And we did have some code inPython at the beginning that we
converted to Go, like religiousceremony. Now we're mostly a Go
shop.

So I'm curious now in retrospect, would you
have chosen Go or are you happywith that choice? Do you think a
different decision would havebeen better?

Guy Gorman (28:01):
So I'll give a personal answer, but I do like
Go a lot because I came frommostly C. Like if I had to write
code, it was mostly C code. Andthere are some similarities.
Like the things I like from Care present in Go, like having
to check the return code or theerror after every function call,

(28:23):
not much keywords or ways to dothings, but it is
straightforward language. So I'mhappy with Go.
I think it suits us well. And wehave to be performant because we
have a lot of incoming data fromall those places I mentioned,
from the cloud, from on premisefile shares. So, Go works well
for us. I'm happy we chose it.

You're a part of the big block of the survey, of
GovSurvey. That's like, yeah, Gois good. I like it. Which is I
think like at least the surveyshows it's most people.

Guy Gorman (28:55):
Yeah. I mean, I can compare it to Python mostly
because we did have Python forthe data pipeline in mind at the
beginning. Like someone had towrite a script to fetch some
initial data from our firstcustomers. And we changed that
to Go. I think that was a gooddecision.
Nothing against Python. Mean,used it quite often before, but

(29:15):
having one language foreverything is a pretty big pro.
I mean, we had same class samelibraries common across our back
end and data pipeline. That's abig up. And I feel maybe it's
just because I don't use Pythonwell enough.
Maybe I'm more from a backgroundwhere I use Python for testing
and scripting. But I feel withGo, I write better production

(29:37):
code. There are with Python, Imake it work, but then
monitoring it, fixing stuff,that's the hard part for me.

I I agree with that completely. Like, I've been
writing Python for productionstuff since 2013 pretty much,
and switching between likePython and other languages,
mostly Go. And it just happens,especially when the team grows a
bit, it's just very easy to makebad decisions in Python,

(30:05):
starting from, you know, youdefine your your structs. Oh,
well, you have to importpydantic and you have to, like,
know a whole thing and enforce awhole style. And it's very easy
to just do dot as dict and,okay, now I I don't enforce
anything anymore.
Monitoring, logging, it's, like,always a pain. You have to pick
a library and it's very easy toundo that library. And, oh, I

(30:27):
set the logging level at thewrong place and suddenly all my
output includes every singleHTTP request and response, blah,
blah, blah. It's hard to do theright thing. It's harder to do
the right thing.
And it's harder to maintain.Everything's magic. It's like
text running in an interpreter.What the hell?

Guy Gorman (30:44):
Yeah, I do like that Go is opinionated and I don't
have to argue with my teammembers about spacing and
formatting and brackets.

Oh, All

Guy Gorman (30:51):
that stuff. It sounds like trivial things, but
my previous job, that's half ofour conversations, you know,
half politics and half where toput the space.

Well, our conversations, we Jonathan still
found something to bike shed on.It's Naked Returns. So it's like
that awkward part of everyinterview where we ask, what do
you think about Naked Returns inGo?

Guy Gorman (31:16):
I just don't like adding, sudden rules to the
language after we have a certainstyle. Then you have to go and
modernize it, you know, gomodernize everything. But I
don't mind really. I never feltthis definition.

So how are you using Go primarily? And maybe
you don't know the answer tothis, but like, why was it
chosen? Was it for technicalreasons or was it because
somebody just liked it? I don'tknow. You know what, start over.
I don't like that questionbecause I mixed two questions
up. Let's stick with the onethat Shai mentioned. So how are

(31:49):
you using Go at Mind? Are youdoing anything interesting with
it? Or is it

Classic backend like stuff.

Classic backend REST APIs.

Guy Gorman (31:59):
Of course, every company got to have their
classic backend crowd, talk tothe DB and let me know what
happened. Yeah. Our backendisn't written in Go. But we also
have, I think, more interestinguse cases in the company where
we do use Go, where it's lessobvious. Actually, my part of
the company, we do the endpointDLP.

(32:22):
So, just a little background. Wewant to prevent sensitive data
from employees' computers fromleaking out, whether it's to
USB, printer, airdrop, browserand native apps. So for that, we
have a browser extension, whichis written in TypeScript. That's
okay, though, because we havethe native agent, which is

(32:43):
written in Go for Mac andWindows. I think we had to make
a big decision there whether wepivot to Rust or something more
OS y.
We went with Go for a fewreasons. One One is we already
had the backend and the datapipeline written in Go. So, we
could reuse the classifier,which is a big part of our

(33:05):
product, determining whetherdata is sensitive or not. And we
could reuse the policy enginethat given a sensitive file
determines whether that's anissue if it's being uploaded
somewhere. So, we went fromnothing to a basic agent that
can protect your computer inlike really a couple of weeks.

(33:26):
I don't think we could have donethat with a different language.

Yeah. Usually people don't associate Go with
like on device, except Andy,like who's doing the fine stuff.
I don't think people usuallyassociate to go with, oh, that's
a language I would use tobasically build desktop apps.
That's what the the agent is.But, I'm surprised to hear you,

(33:51):
like, I obviously understand thebenefit of, yeah, all the team
is using one language, so thetooling and the stuff is better,
but I'm surprised to hear youtalking about reuse.
So you're basically saying thecloud things and the backend
things are in Go. So I and yousaid you had a script for data
pipeline that used to be writtenin Python also written in Go, so

(34:14):
fetching stuff from customers.But what I'm surprised to hear
that you're running workloadslike classification or policy
engines on device. Oh. Or is oris that not actually what's
going on?

Guy Gorman (34:25):
It is actually what's going on. So Oh, cool.
I'll say I said a lot ofpositive things. I also have
negative things about Go when itcomes to Endpoint, of course,
especially once you go deeperinto the OS.

Are we allowed to talk about negative things about
Go on this broadcast?

I think it's journalistic Of are. Course
journalistic integrity. You knowwhat

I mean?

Intellectual Yeah. Integrity. Forget journalism.
So,

Guy Gorman (34:53):
yeah, we we do the classification stuff on device
to be quick. I mean, we want tohave an answer as soon as
possible to make decisionswithout hurting the end user. I
mean, one of the biggest painsof DLP products that they
sometimes prevent employees fromworking if they break the
machine. You know, we can easilycause programs to crash or

(35:17):
performance to slow down andpeople will complain and the
customer will demand the moneyback. So we try to do whatever
we can on device within thebounds of reason.
I mean, we can't run an AI modelyet, at least on device. So we
have some tricks where the backend does the heavy lifting and
we communicate with it to getquick answers. But a lot of it

(35:42):
is on device.

Awesome. Wait, you said you had negative things to
say about Go. Yeah. Let us know.We might change podcasts.
Might switch themes.

A couple of Rust coming up next week. Yeah. Stick

Guy Gorman (35:55):
I don't actually know Rust. I only know C in this
category of languages. So don'tworry. Yeah, a few of the issues
we encountered with Gopher, theendpoint is once you try to use
things like Windows API or Macendpoint security framework and

(36:16):
low level stuff. You may want tolisten to security events that
the machine emits so that youcan make decisions quickly.
Go doesn't really have much ofan ecosystem, sort of like the
AI thing where people say, I usePython instead of Go for AI
because there's so much of anecosystem there. It's the same
with the low level stuff. Say wewere looking for maybe a library

(36:40):
that's already handled thingslike ETW, the Windows events.
But the best thing we found waslast commit three years ago, 40
stars. You you have to write alot of things from the ground
up.
That's one of the things weencountered. Another example I
have is you really struggle notto use C Go. I mean, to keep the

(37:06):
benefit of Go, which is crosscompilation being easy, just one
flag when you're building, youhave to avoid CGO. And, the Mac
framework I mentioned, theendpoint security framework,
that's how Mac, Apple wants youto interact with Mac when you're
building a security product. Andthere's no, there are no native
bindings for that in Go.
So you have to use CGO or writea separate plugin, which is what

(37:29):
we're doing in a differentlanguage that communicates with
the main Go agent.

Mhmm. I wonder, like, these are shortcomings,
not of like technical decisionsin Go, but more of the fact that
the Go community around peoplewriting like, you know, desktop
software or cybersecurity agentsis either very cagey about its

(37:56):
contribution or it's just notthat large. Now y'all are 30
person startups, I don't expectyou to like steward a huge open
source effort within that. Andalso I think it's just a
competitive disadvantage for youto invest any resources into
making, writing, agents for Maceasier or whatever. But can you

(38:17):
imagine, like, at what size ofof company or team or capital
would you be like, okay.
I'll contribute this back to theGo ecosystem? Because this is
something that's missing in theecosystem, not technically in
the language. You can't do itbecause, you know, oh, because
of the way we the panic isimplemented. It's more like
there aren't enough librariesand there isn't enough support,

(38:39):
right?

Guy Gorman (38:40):
Yes and no. So I got two questions from you there.
One is, are you going tocontribute to open source things
to make the ecosystem better?And one is, are there any actual
technological gaps in Go, notjust the ecosystem that are
preventing

I that's right. But I'm not trying to I'm not trying
to put you on the spot. Like,first question is the leading
Yeah. Yeah.

Guy Gorman (39:01):
Yeah. We didn't really give much thought to
contributing to open sourcelibraries for the low level
stuff. And not because of anycompetitive thing. It's just new
to us. So we don't have itnailed down yet internally that
well.
I think once we get our tractionand have a lot of experience on

(39:25):
how to work with Windows or howto work with Mac with Go, then
we might step it up and helpothers do it, if that makes any
sense. And about the technicalgaps, actually, there are some
major things that weencountered, especially around
Windows. So, one of the majorthings is the garbage collector
of Go is working against you.It's a feature, I mean. Right?

(39:49):
But, if you're letting Windowsallocate memory for you, for
example, you're calling, hey,Windows, open some buffer, give
me some information from thekernel, then Windows is doing
the allocation, and Go isn'treally aware of the memory that
it's supposed to be protecting.So it might and we've seen this
happen. It might clean up ourbuffers before they're actually

(40:13):
used, giving us panics. Or, forexample, if I pass a slice to a
Windows API call, Go I mean,Windows fills the buffer up, but
the slice is still at capacityand length zero because Windows
isn't aware of those internalthings that Go has. And then Go
might reallocate the memory orswitch it around.
So we have to go use things likea pinner in Go, which tell you

(40:38):
have to explicitly tell thegarbage collector, hey, this
memory is in use. I got this.Which isn't that obvious.

That's weird. But, you know, we had a George Adams
from Microsoft, on the show, inAugust, episode one twenty one.
You we could you could probablyreach out to him and be like
because they have a specificMicrosoft build of Go. I think
it's mostly for back end, youknow, crypto, gov, compliance.

(41:10):
But maybe they maybe they canset up some, you know what I
mean, make Windows cooperatebetter with it.
Maybe it's a bit too low leveland I'm, like, misunderstanding
it. But I'm sure, like, the GOATteam at Microsoft is the people
you'd want to talk to about.

Guy Gorman (41:23):
Yeah. That's a good idea actually. I mean, we have
some heavy lifters for Windowsin our team, like really GOAT
guys that I trust to know whenmemory is safe or not. But yeah,
actually Microsoft might be thebest place to go for Windows.
Yeah, the memory stuff is oneissue.
Also a lot of Windows API callsrequire you to stay on the same

(41:46):
OS thread. You open an object,you read and send messages and
then you close it. It all mustbe on the same thread. Go
doesn't really care aboutthreads in that way. Goroutines
can move about.
So you have to either lockthreads and then you might
affect some other workloadyou're running. It's a it's
tricky. It's easy to get wrong.That's what I'm saying.

Mhmm. Yeah. It's a it sounds a bit awkward. The
Microsoft like, I remember thethe Win32 API stuff was almost
impossible to integrate with. Ithink I actually gave up when I
tried to do it and, like,switched to C plus plus when I
just tried tried to writesomething with a Docker two Win
API.
Was like, whatever.

Guy Gorman (42:26):
Yeah, there's

But that was that was many years ago, so if that's
still the experience, it'sinteresting.

Guy Gorman (42:32):
There is a library, like an official one, axe
syswindows, that has a lot ofthe wrappers for syscalls.

So you

Guy Gorman (42:40):
can just call it as a function, but many things
aren't there. You just have tocreate your own wrappers and
make mistakes usually. Because,for example, you're used in Go
to receive an error and thencheck it. Right? But we're using
those WinAPI functions.
You have an integer that youhave to check and then you can

(43:02):
use the error. Sometimes theerror is not non nil, but it's
just the operation finishedsuccessfully, which is quite
confusing.

The Right. The X Jonathan, I always forget this.
The X libraries, are theyofficial? Or are they official
ish? What what's the what's theverdict on that?

I guess it depends on how you define
official. They're not part ofthe standard library, so they're
not held to the samecompatibility guarantees and
stuff like that. Some of thestandard library depends on the
X libraries, though, especiallythese WinSyscall type things,
which is interesting. But whatthat effectively means is that
they have a different releasecadence. They can be released

(43:44):
more frequently than thestandard library and that the
API isn't guaranteed to bestable from Go one point zero
forward.
So they can interest breakingchanges so long as it doesn't
break standard library calls onold versions of Go. So there's a
weird relationship there.

It sounds a bit funky. One question I'm
interested in is, and this issort of by the way leading to
something you probably want totalk about anyway. You're hiring
for low level engineers andengineers in general for my,
which is awesome. Have you beenable to find like low level
engineers who wants to workwith, Go?

Guy Gorman (44:24):
Oh, that's a great question. Yeah. We're hiring I
don't like to say we're hiringonly low level engineers. I can
if I get

No, I mean, your team is.

Guy Gorman (44:33):
Yeah. My team also, if I get a talented software
engineer that never had anythingto do with low level stuff, I
think I can work with him. Halfmy team were in the back. Like
we were one team at thebeginning of the company, and
then we split up to endpoint andthe rest. So many of my guys
don't have the background, butit still works if they're all

(44:55):
good guys and they're good withcomputers, you know, so they can
understand that.
Yeah. We It's a good questionabout whether they want like
they're real heavy, heavylifters that know operating
systems, whether they want towork with us or work with Go
more specifically. The best guyor one of the best guys I've
ever seen for Windows, he'sworking with us. He was really

(45:17):
frustrated at first with thelanguage. He wanted to switch to
RAF or something else.
But it ended up working finebecause the kernel stuff or
DLLs, We do write in CPP. We'renot Puritans. Yeah. If we do
something really low level andthat's the most efficient way to

(45:38):
do it, then let's write it inwhatever language is most
appropriate. And our agent thatis written in Go will serve sort
of as a web service.
Right. Right. So on local hostor via inter process
communication, those nativeparts can talk with the main Go
agent that access the brain. SoI don't think that's a using Go

(46:01):
is something that scares awaylow level engineers.

Cool. Just to highlight this, mind is hiring.
I I visited your offices. I feelvery comfortable shouting y'all
on. And I also know Hod and Ohadand whatever, in Itay.
Yeah. Really, really goodpeople. So if you're in Tel
Aviv, they're hiring engineersof all sorts, I guess I should
say, and and a technical writer,for product management. And in

(46:29):
The US, social media managersand technical account managers
and directors of sales and allthe usual GTM functions.
Although I'll be super surprisedif a director of sales
engineering engineering islistening to us complaining
about calling Win32 APIs withinGo processes.

(46:53):
Although if there was ever adirector of sales engineering
that you would hire, it would bethat one, right?

Guy Gorman (47:00):
Yeah, we're hiring. So, mind. Iocareers. Looking for
fun people to work with. Yeah.
Cool.

Cool. Cool.

Guy Gorman (47:09):
Just to shout ourselves out, the top person in
the hall of fame for Shy's gitcapture the flag is still one of
our guys. Undefeated. Yeah.

Mine are undefeated. I actually showed
someone the I did a walkthroughof the entire thing, like, kind
of quickly for someone and Ididn't beat Ohatstein. It's

Guy Gorman (47:34):
good to meet him. I don't know what he was taking,
man.

I hear some inside references happening
here. Can you explain what we'retalking about?

Yes. I have a little CTF capture the flag
challenge that I used to I usedto do it more often. I should
get back into it. I don't know.People are less interested in
like mastering tools now becauseof AI, but it like teaches you
git commands and whatever.
And a lot of people have solvedit, but only one person has
solved it so fast that I waslike, I literally felt like

(48:05):
apologetic that he's not, like,not getting his money's worth.
And that person is, one of thefounding people over at mine,
First name, Odd.

Got it.

I think it was like twenty four minutes, something
crazy like that. Jonathan, youshould try that CTF sometimes. I
know you're bit

Well, you need to put a link in the show notes so
anybody can try it.

Oh, I definitely will. That's a good idea. That's
a good idea. It's fun. I shouldupdate it at some point.
It doesn't include, like, newcommands because I don't use
them because I just, like, learnthe get off my lawn type of
mindset. No. I'll never use gitswitch. I'll just I know git
checkout and that's it. Anyway,cool.
I highly recommend if you'relooking for a job right now

(48:46):
talking to Mike. They're a goodcouple.

Alright. I have I think I have probably one last
question for you here. So Ithink most of our listeners are
accustomed to writing back endsoftware. They probably deploy
to Kubernetes, to Docker, toLambda, something like that. How
do you manage all that on youron these desktop machines?
Are you are you installingKubernetes? That must be what
you're doing, right?

Guy Gorman (49:09):
Not yet. Not yet. I think it came up at one point.

Quick anecdote. I used to work with a guy who
installed Kubernetes on point ofsale systems. I think it was for
Sonic restaurants around TheUnited States. And that's how
they managed everything. It waslike these little tiny DOS
systems all ran Kuberneteslocally anyway.

Oh no.

So it can't be done.

Well, probably helped them a lot because I've
tried Sonic since I moved to TheUS and the fries are absolute
fine.

Have you had their cherry limeade?

I I haven't I haven't frequented all the fast
food restaurants yet because Idon't eat outside almost ever,
but the few I have, like, thedifference is is crazy. I guess
that the real difference intaste is the local Kubernetes.
Guess that's what KFC are doing.So that's

Guy Gorman (49:59):
a good question. No, we don't use Kubernetes. Usually
the flow is that the customeruses their MDM, their mobile
device management, the wayusually big enterprises have
software that helps them managetheir endpoints. So we give them
an installer and that's it. Theyjust run it, like decide which

(50:21):
users they want to have the mineprotection.
Once the agent is installed,registers itself as an operating
system service. So, Windowsservices or LaunchDaemon on Mac.
And then the operating systemtakes care of rebooting us, of
starting us on when When themachine turns on. Yeah. Our

(50:43):
philosophy is to try to use theoperating system to help us with
orchestration as much as we can.
For example, the updater thattakes care of updating the Mind
Agent is registered as ascheduled task on Windows that
runs once per hour.

Got it.

Good. And doesn't that mean that customers can,
like, go into their login itemsand just, like, uncheck mine?

Guy Gorman (51:09):
It could mean that. But I just recently

I just recently did that. Like, went into my Macs,
you know, thing and turned offall the software. Like, I don't
I like linear, I like Notion, Ilike Grain, I like Gnolan, I
like all these. But I don't needthem when I boot up the machine.
When I boot up the machine, wantto Well, I need to boot up as
fast as possible.

Guy Gorman (51:28):
Yeah. Anti tampering is a whole subject of writing
code for an endpoint. Like youdon't want the user to
manipulate your agent, to deleteit or to make it to do weird
things. So, usually that's up tothe customer. They can define
what programs are enforced.
Same for our browser extension.It's also force installed for

(51:51):
users. Me personally, as anemployee, I might not like it
because, you know, why are youspying on me? But we try to be
as to respect privacy and allthat and be harmless unless
really a security event ishappening. So no reason to
delete us and no way.

Awesome. So we, you know, to round out the interview
here, we usually have what wecall a stopper question, which
is like the same question we askall our guests and then it's
interesting to, compare, whichis, I think first year it was
what you like about Go and whatyou don't like about Go. We

(52:30):
ended up with a full featurelist of entire, all the Go
features on both columns. Andthen we changed it up for the
second year, like when youstarted learning Go, but you
actually answered that already.This year, it's, who's the
person who influenced like yourGo journey the most?
So yeah, lay it on us, who,because you are a pretty recent

(52:50):
gopher, so I'm interested tohear. We had people on the show.
Yeah, I've started in 2001. Idid inception. I incepted the Go
team.
So I was very, really happy tosee it. You know what I mean?
But you're a pretty recentgopher, only during the last
couple of years. So whoinfluenced your journey so far?

Guy Gorman (53:09):
Yeah. So I've only been using Go for about three
years. Obviously since this isall within the same company, the
people who influenced me themost are from So my boss, I
guess, the VP of R and D atMind, Hod, He was a big
influence, you know, aside fromcode reviews and the obvious
stuff. He also directed me tolike the Dave Chaney's blog,

(53:30):
which is I really like it. Andit's influenced the way I write
Go.
And to lectures by MichelHashimoto, where he talks about
testing and how they do it atHashiCorp. So I got to credit
HOD for shaping and directing meto be more than just a code
monkey. Another guy

That's going on.

Guy Gorman (53:50):
Yeah. Another guy I would like to mention is Itay,
Itay Schwarz. He's a CTO atMind, which usually isn't a
technical guy, but he really is.And thanks to him, all my
variable names are one letterbecause that's how he told me Go
should look like. Oh, He reallyinfluenced me.
No, just kidding. He did make meless of a guy and more of a

(54:16):
gopher.

It.

Guy Gorman (54:17):
Good to him.

I just got a I can't imagine the entire code
base on Pyrene with single,letter variables, but then I
realized they all probably havemore than 26 fairy. They

just have really small scopes.

Yeah. Just reuse x, x equal.

Guy Gorman (54:36):
I remember he came, like, to my to where I work and
he said, why did you call thatvariable connector? C is enough.
I'm like, are you sure that'senough?

I love that. I love that. I'm just making up a straw
man in my head, a programmer wholearns Chinese just to keep all
their variable names singlecharacters, doesn't know Chinese
at all, just knows the characternames. Although I get I I hate
Unicode and source code anyway.Anyway.

But ASCII is all Unicode, Shy. What do you mean?

Oh, that's right.

ASCII is Unicode. ASCII is a subset of Unicode, so
I don't know what you're writingin.

Just white space.

Alright. Well, how can how can listeners find
mine? How can they find youryour job board if they're in the
area and wanna reach out?

Yeah. Or if they wanna buy mine, if that sounds
like, oh, I hate my old DLPsolution, blah blah blah. Want
something new.

Guy Gorman (55:33):
Yeah. So they can go to mynd. Iocareers buy the
product. Yeah. Tell tell them,guy sent you.
We're gonna get 20% more salary.Don't worry.

Mhmm. So

that's a strong domain, mind.io. It's a good
one. Alright. Thanks a Guy, forcoming on the show. Thanks for,
reaching out.
This is like all of you, man. Ireally appreciate it.

Guy Gorman (56:01):
It was fun, guys. Yeah. Enjoyed talking with you.

And thanks to you all for listening. We'll talk to
you next week. Program exited.Program exited. Goodbye.

All Episodes

Episode Transcript

Popular Podcasts

Las Culturistas with Matt Rogers and Bowen Yang

Crime Junkie

Stuff You Should Know

.css-15opob5{left:0;position:absolute;top:0.8rem;} All Episodes

.css-14f5ked{margin:0;word-break:break-word;display:-webkit-box;-webkit-box-orient:vertical;box-orient:vertical;-webkit-line-clamp:2;overflow:hidden;}MIND the gap, the buffer, and the GC; interview with Guy Gofman

Episode Transcript

Popular Podcasts

.css-r6mb8g{margin:0;word-break:break-word;display:-webkit-box;-webkit-box-orient:vertical;box-orient:vertical;-webkit-line-clamp:1;overflow:hidden;}Las Culturistas with Matt Rogers and Bowen Yang

Crime Junkie

Stuff You Should Know

All Episodes

MIND the gap, the buffer, and the GC; interview with Guy Gofman

Las Culturistas with Matt Rogers and Bowen Yang