October 11, 2025 • 30 mins
- Security releases
- 🍪 Go 1.25.2 and 1.24.8 with 10 security fixes
- 🌐 golang.org/x/net v0.45.0 with 2 security fixes
- Meetups @ Conferences
- 🇺🇸 San Fransisco, CA, USA — Oct 23 @ Forge
- 🇮🇱 Tel Aviv, Israel — Dec 10 @ Cato Networks
- 🇺🇸 GoWest @ Lehi, Utah USA — Oct 24
- 🧦 New swag in the Cup o' Go store!
- Proposals
- 👷🏿♀️ Accepted: go fix to apply fixes from modernizers and gofix analyzers
- On hold: Add experimental HTTP/3 support
- 👖 gofumpt: Should clothing naked returns be put behind `-extra`?
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Jonathan Hall (00:00):
This show is supported by you. Stick around
(00:02):
till after the news or actuallyduring the news to hear a little
bit more about that and some newswag we're trying to sell that
you might want, you definitelywant. This is Cup of Go for
Friday, 10/10/2025. Keep up todate with the important
(00:24):
happenings in the Go communityin about fifteen minutes per
week. I'm Jonathan Hall.
Shay Nehmad (00:28):
And I'm Shay Nehmad. And aren't I happy that
you're not in sales?
Jonathan Hall (00:32):
I used to be. This thing that you might want
this thing. I actually won a skitrip because I was the I was the
second best salesperson in mydepartment
Shay Nehmad (00:42):
No way.
Jonathan Hall (00:42):
Of of technical support people.
Shay Nehmad (00:45):
I also heard that you worked at Denny's today.
Jonathan Hall (00:47):
I worked at Denny's lot of
Shay Nehmad (00:48):
my two employment history. I used to bus stables.
I also had a different job.
Jonathan Hall (00:52):
Yeah. I used to mow lawns. I used to lots of
things. These days, I mostlyjust break people's computers.
Shay Nehmad (00:57):
Talking about hard work. I really appreciate all
the hard work Andy Williams hasput into the last episode.
Thanks for covering for me, man.I really appreciate it. You know
where I went, Jonathan?
Where did you go? I went toDisneyland. Woo hoo. It was
(01:22):
actually super fun. I was sureI'm just gonna like, my kid was
gonna have fun, and I was justgonna be there to, like, watch
her.
But actually, Disney's awesome.Not sponsored, obviously. But,
man, the mouse knows what he'sdoing. So while I was, in
Disneyland, apparently, all thelittle security, problems came
(01:42):
on to roost. We have tensecondurity fixes in this minor
release, folks.
Although, when reading throughthem, they all have very similar
vibes and a lot of them from thesame company, Katana Cyber. So
they're all about, like,excessive CPU consumption,
quadratic complexity. Not all ofthem, but a lot of them are,
(02:04):
like, performance relatedsecurity bugs that can cause
resource exhaustion. So I assumethat the CVs themselves don't
have very high score because theonly thing it can do is like
make your server run Yeah. Toomuch.
And, you know, it's from allover, the National Cybersecurity
Center in Finland and thiscompany called Katana Cyber,
which is so European coded, it'snot even funny. Like, they're
(02:28):
you you open their site and it'slike, what Katana Cybers brings
to the cybersecurity field isthe, a word meaning lock in
Italian and used to describe themost defensive play system in
soccer.
Jonathan Hall (02:39):
Sounds a bit European.
Shay Nehmad (02:41):
Immediately alienating all their, potential,
American customers. Anyway, Iwanted to You should upgrade
1.25.2 and 1.24.8. You shouldalways upgrade patch versions
They're anyway, like nonbreaking and they only bring
benefits normally. I did wannamention a few of them just so
(03:02):
you understand, like, the vibe.One of them is, for example,
there's no limit when you'reparsing cookies, which is I
don't know if it's true for youpersonally in life as well.
Jonathan Hall (03:13):
I have no limit to cookie intake.
Shay Nehmad (03:17):
Exactly. So even though, HTTP headers have a
limit, the number of cookies,like, size limit, the number of
cookies, did not have a limit.
Jonathan Hall (03:28):
I could I could make a server or a client that
just, like, sends countlesscookies forever and ever.
Shay Nehmad (03:34):
Yeah. I can make you allocate a large amount of
struct Uh-huh. Causing largememory consumption. And now it's
limited to 3,000, which is feelslike a lot. That does
Jonathan Hall (03:47):
sound like
Shay Nehmad (03:47):
a lot. Cookies than you should have. But I don't
know. Maybe there's a legitimateuse case. You're you're actively
trying to be tracked by everysingle ad agency in
Jonathan Hall (03:57):
the I have a think. Like, if I if I if I
drove up and parked in front oftwo restaurants, one said all
you can eat cookies and one said3,000 cookies, I don't know how
I'd choose which one to go to.
Shay Nehmad (04:06):
I well, probably based
Jonathan Hall (04:08):
on price.
Shay Nehmad (04:08):
I don't know. I I actually can't enjoy cookies as
much because I can't have dairy.So all the really good ones, the
brown butter stuff, I can'thave. But now you have a maximum
amount of cookies that theserver can parse, which can be
adjusted using the http cookiemax num go debug option, which I
(04:31):
they missed an opportunity tocall it HTTP cookie max num num.
Yeah.
Jonathan Hall (04:34):
That's what it should have been.
Shay Nehmad (04:35):
But that's is this me? So these security fixes have
all been of this type. Like
Jonathan Hall (04:41):
I'm also surprised it's not exposed as an
option, although this would havebeen more than a patch release,
but, like, an option in eitherthe server or the client
configuration. Because I could Icould see somebody wanted to set
that to, like, three for commoncases. But calling debug,
whatever, seems a little bit of,like, a roundabout way to do
that. And it also doesn't letyou control it on a per client
or per server basis. You know,if you want if you want part of
(05:03):
your application to allowmaximum three other maximum 50
or something, you can't do that.
Shay Nehmad (05:07):
Yeah. I think doesn't the HTTP have a default
server
Jonathan Hall (05:10):
Yeah.
Shay Nehmad (05:10):
That you're not, like, setting up? So I guess
it's for that one.
Jonathan Hall (05:13):
Oh, okay.
Shay Nehmad (05:13):
The net HTTP one
Jonathan Hall (05:15):
I guess it makes sense.
Shay Nehmad (05:16):
Which you don't, like, control. Other examples
include quadratic complexitywhen checking name constraints.
So some inputs scalenonlinearly, which can cause
just a really big complexity.Again, not a huge CV in terms
of, oh my god, someone is gonna,like, own your computer.
Jonathan Hall (05:34):
Mhmm.
Shay Nehmad (05:35):
But definitely a worthwhile fix. This is from
Jacob Sialik, and also a friendof the show, Joobob, which now I
I know how to pronounce yourname finally, also has a
security, patch in this one,which is really cool. It's
really fun to see, like, namesof people from the show on these
notes. From the show, meaningfrom, like, the Slack that talk
(05:57):
to me, that I don't know themfrom anywhere else but the show.
Yeah.
The the cookie thing was hisAwesome.
Jonathan Hall (06:03):
So I can blame him for
Shay Nehmad (06:04):
not getting enough Yes. Exactly. And one other that
I really, really liked, you'renot gonna believe it.
Jonathan Hall (06:11):
I already don't believe it. You're lying to me.
Shay Nehmad (06:13):
Net URL What? I p v six.
Jonathan Hall (06:16):
Oh my goodness.
Shay Nehmad (06:18):
So as everybody knows, we're really we're just
moments from running out of IPvfour addresses in the world.
Jonathan Hall (06:24):
Moments away for the last fifteen years. We
should probably upgrade to IPveight to fix all these IPv six
problems.
Shay Nehmad (06:32):
Yeah. That's exactly the kind of take that I
can really imagine an AI makingin, a Twitter argument. If
you're not if you're not on IPVeight, you're not you're an
NGMI. You're not gonna make it.Yeah.
I bet I bet you, unironically, Icould raise $5,000,000 for IPV
eight Oh, wouldn't be startup.Like, in a week. Anyway, there's
(06:54):
a whole thing about, mistakenlynot validating bracketed h IPv8
host names, when you parse them.So you need to put them in a
square bracket. Right?
And the IPv four addresses mustappear in these square brackets.
(07:15):
And then there's a whole thing.I really love this comment where
they, like, have a screenshot ofthe RFC with specific parts of
it, like, highlighted. And thenapparently, it was like, oh, it
doesn't have to be. Oh, it doeshave to be.
It's like unquoted brackets havea diff different meaning in
something that I didn't thinkabout since my computer science,
(07:36):
like, degree, the augmentedBacchus Naur form, which is like
a language, like a meta languagewhere you have, like, rule sets
and It's a thing that's strictlyused for, like, RFCs and things
like that when you need todefine anyways, I love it. If
you love, like, people sufferingover details of RFCs, this one
is the is the thing for you.
Jonathan Hall (07:57):
I think we can safely say IPv6 isn't gonna
replace your network. Right? Itit's someone else's IPv4 using
IPv6 that's gonna replace yournetwork to tie it back into the
whole AI debate.
Shay Nehmad (08:08):
Yeah. Yeah. Ten secondurity fixes in, like, the
standard library, plus we're notgonna go into it, but two
security fixes in the XNet, aswell. I think from similar
people.
Jonathan Hall (08:22):
Yes. And they're both related to, you'll never
guess it, HTML.
Shay Nehmad (08:27):
Yeah. It's all, like, parsing or whatever. And
also, it's not again, it's not,like, gonna own your computer.
It's mostly performance stuff, II feel. I I try to review all of
them.
It's like 12. If I missed onethat's actually CV 10, forgive
me. They should order them inorder of importance on the There
you go. On the security bullet.
Jonathan Hall (08:46):
Yeah. Right? Most important first.
Shay Nehmad (08:49):
By the way, one thing I highly recommend is
going to these fixes themselvesbecause I think actually reading
these, when I me when I sayfixes, I mean actually the
googlesource.com, like, changelist because these ones are a
really good way to learn about,how to identify and how to fix
these sort of things. I thinkthat, like, looking at these
(09:09):
change lists, let's take, forexample, the net mail quadratic
behavior. So when you parse themail address, they parse it,
like, one character at a timeinstead of a sub slice and then
included the benchmark in thecommit message. So you can,
like, take a look at it and seethat it actually is better. And,
you know, if you just look atthe file itself, it's it's
(09:30):
really easy to see how a tinychange can cause this, like,
security issue.
If you but if you were to lookjust at the change without the
context of which change list itis, you would never be able to
guess what this does. So I thinkit's actually a good, like,
learning opportunity to, like,look at this change and see, oh,
I define the d text len and the,you know, the the string outside
(09:55):
of the for instead of doing it,like one by one and then it's,
avoiding quadratic behavior.It's like, oh, this is how you
avoid this is the pattern, youknow what I mean, to avoid
quadratic behavior in my code.Whenever there's a four, instead
of, working on whatever's leftat every time, just add it in a
sub slice, for example. So it'sgood, like, for the pattern
(10:17):
recognition of security stuff.
Yeah.
Jonathan Hall (10:19):
That's clever.
Shay Nehmad (10:20):
Which if you if you pull that up in a code review,
man, people look like a littlelike you're a Jedi. Like, this
four thing has a quadraticcomplexity. Like, oh my god. How
did you know? It's it's justlike practicing chess.
It's pattern recognition. Nice.Anyway, tons of security fixes.
Go upgrade. And also veryinteresting one, so go read
them.
Jonathan Hall (10:38):
Also very interesting. I see here that Cup
of Go is sponsoring a meetupcoming up, on October 23. It
looks kinda scary. Oh. If you'rein San Francisco on the twenty
third, 05:30.
It says 05:30PM. That must be mytime, not local time. Right?
Shay Nehmad (10:54):
It's San Francisco.
Jonathan Hall (10:55):
Starts at 05:30PM San Francisco time. Okay. Till
07:30PM. Go listen to You CanEdit the Runtime presented by
Josh Bleecker Snyder. Did youknow you could edit the runtime?
Yeah. It sounds scary to to saynothing else.
Shay Nehmad (11:07):
Yes. It is an October Halloweeny it's my first
Halloween in The States, andpeople here are, like, super
excited about Halloween. Like,all my neighborhood is skeletons
already, so I was like, I'mgonna make it scary as
Jonathan Hall (11:20):
costume selected yet for yours for Halloween or
for the meetup?
Shay Nehmad (11:23):
I didn't think about any just stumped me. I
really
Jonathan Hall (11:27):
If you get a Brewster costume,
Shay Nehmad (11:29):
I'll I'll send
Jonathan Hall (11:30):
I don't know. That would be cool.
Shay Nehmad (11:34):
Yeah. I don't know.
Jonathan Hall (11:35):
Also scary in the same meetup, a live recording of
Cup of Go. I don't know if
Shay Nehmad (11:39):
that's scary for the listeners. Maybe. We'll see
we'll see how go how well itgoes. Yeah. So given the fact
that
Jonathan Hall (11:45):
you might have a conflict. So I'm I'm I'll try to
pop in for a few minutes, but Iwon't be there for the whole
thing. I will be at the speakersdinner for Go West, which is the
conference is happening the nextday. So if you are also a Go
West speaker, you obviouslywon't be at the San Francisco
meetup that day. And then afterthat, lightning talk, using LLMs
to write murder mysteries.
(12:06):
Also scary.
Shay Nehmad (12:07):
And finally, durable workflow orchestration
with Golang and Postgres. Sosome serious stuff, some not so
serious stuff. Overall, itshould be a lot of fun. We we
have, some, like, 30 or 40people attending already. Nice.
Some including friends of theshow or people I've already met,
and some people for whichthey're, like, their it's their
(12:29):
first event ever. So I'm, like,very excited to have everybody.
Jonathan Hall (12:33):
That's awesome.
Shay Nehmad (12:34):
Yeah. But we want more people.
Jonathan Hall (12:36):
So The more the scarier.
Shay Nehmad (12:38):
We wanna fill the room. Yeah. And, there's another
meetup, in Israel, which I'm notthere anymore, but, like, I
still, follow Micky on Twitterand whatever. So I saw it. Go
Israel December 2025 meetup.
If you don't know Micky, I'm,like, name dropping him. He's
our first interviewee
Jonathan Hall (12:57):
A whole way back on episode one.
Shay Nehmad (12:59):
From, like, two years ago or whatever. It's
gonna be over at Kato Networksoffice in Leonardo Da Vinci 2
Street in December December 10.
Jonathan Hall (13:08):
December 10, Tel Aviv. Up upcoming talks are
Shay Nehmad (13:11):
talks are
Jonathan Hall (13:11):
still TBD. TBD. Guess that means if you want to
give a talk, reach out to Mickeyand see if there's a spot. It
sounds like there probably isone.
Shay Nehmad (13:19):
Yeah. There's sounds like there are two. Yeah.
Or maybe they just haven't
Jonathan Hall (13:24):
Might just not have updated.
Shay Nehmad (13:25):
Yeah. I can't see the attendees because it's like
a meetup plus feature blah blahblah. You know what I mean? It's
like you need the premium. But Ican see, four of the attendees,
and I already see I know allfour of them.
So Wow. Looks like it's gonna bea great event. I'm not gonna be
there because I'm not in Israel,at that time, but looks like a
(13:45):
great event as well. A link inthe show notes.
Jonathan Hall (13:48):
Awesome. I think that's a good time to do a
break. We do have some more newscoming up. Some we're gonna talk
about some past news issues,some updates, but let's do a
quick break first before we getto that.
Shay Nehmad (14:06):
This show, as Jonathan mentioned at the top,
is supported by you. The bestway to support us is directly
through Patreon. This is ahobby, we do it for fun, but
it's kind of expensive, youknow, our time and editing fees
and hosting fees and whatever.So if you want, you can join our
Patreon, $8 a month or Cup ofGopher Mini for $3 a month, and
(14:28):
just help us, like, cover costsfor the show. We have some new
Patreons.
Jonathan Hall (14:32):
A big shout out to Kent Smith, Jeff Macy, and
Jennifer Johnson. Thank you forjoining us. Thank you for
supporting.
Shay Nehmad (14:38):
Yes. Thank you for joining. We really appreciate
it. Other than that, we youknow, the usual spiel. You can
find everything at cupago.dev,and we're on Slack at hashtag
cupago, kabobcase with hyphens.
If you wanna email us, it'snews@cupago.dev. Another way to
support the show is to leave areview on Spotify or Apple
Podcasts, wherever you listen toyour podcasts. Just let people
(15:00):
know about the show. We don'tpay for advertising at all, just
word-of-mouth. So if you'regoing to one of these meetups or
if you're going to a conference,go west, talk about the podcast
because we want more peoplehere.
Talking about things you canbring to the conference, we have
new swag.
Jonathan Hall (15:18):
We sure do.
Shay Nehmad (15:20):
We actually have a new logo
Jonathan Hall (15:21):
Yes.
Shay Nehmad (15:22):
Which we're like it's not gonna fully replace the
existing one. It's just like asimple version.
Jonathan Hall (15:28):
We have two new logos, to be honest.
Shay Nehmad (15:30):
Actually, that's true. You can find all of the
new things in store.capago.dev.So we have one logo that's extra
explicit, the Range RoverBrewster recursive.
Jonathan Hall (15:39):
Extra explicit. Do not let your children look at
this one.
Shay Nehmad (15:44):
R rated sticker. No. It just says cupago on the
bottom so people know what's up
Jonathan Hall (15:49):
with it.
Shay Nehmad (15:50):
And the and the cup is recursive, which is fun.
Jonathan Hall (15:53):
So Brewster's cup has Brewster holding a cup has
Brewster holding a cup. Blahblah blah.
Shay Nehmad (15:58):
Exactly. And so that's a new big sticker you can
you can place on your laptop oryour bag or whatever.
Jonathan Hall (16:06):
Or if you come to Go West, you can get a free one.
Shay Nehmad (16:09):
Oh, what what challenge do they have to pass
to get the sticker?
Jonathan Hall (16:12):
You just have to come say hi or or pick it up off
the table. I'm I'm not sure howthat's gonna work, but I'll be
speaking there, so I'll I'll behanding them out. If nothing
else, come talk to me. I alsohave new Boldly Go stickers from
our from my YouTube channel.Give you one of those for free
if you come say hi as well.
Shay Nehmad (16:25):
And we have new socks. The Go sucks. Oh, no.
Wait. Go socks socks.
And one thing I'm most excitedabout, because I recently lost
my hat and I need a new hat, isthe Cup Go hat, the
controversial Cup Go hat in twovariants, white and pink. I
(16:46):
think I'm gonna get the whiteone. I think I might get both.
The pink one actually lookssuper dapper. And we still have
all the old swag, the Cup O Gocoffee mug, the t shirt, the
sweatshirt, which is like mynumber one hoodie at work.
I just keep it at the office,super comfy. The old sticker,
and the infamous, one personbought it over the last couple
(17:08):
of years, wireless charger.Yeah. So all our new swag with
the new simplified logo. Give usyour feedback if you like it or
not.
Like, we don't know.
Jonathan Hall (17:18):
And if you want something else, you know, the
the the place where you're doingthis has all sorts of stuff, but
we don't wanna upload 10,000products that nobody's gonna
buy. If there's something you dowant, though, let us know, and,
we're happy to be happy toconsider adding it.
Shay Nehmad (17:31):
Yes. And let us know what you think of our Lou
logo. It's it's going like thesame way every tech company has
gone where it had like anintricate logo. It's like the
Cracker Barrel thing. Now wehave a simplified logo.
Jonathan Hall (17:44):
If you don't like it, we'll fire our new CEO just
to let you know, to be on, you
Shay Nehmad (17:48):
know Yeah. For sure. I don't think we should
fire him. I think we should justdo like, we should do the
Theranos thing, the FDX thing.Just throw him in jail.
In reality, we had to get thenew logo because for the hat,
has to be simple
Jonathan Hall (18:01):
Yeah.
Shay Nehmad (18:01):
For them to embroider it correctly. That's
that's the actual reason thishas happened. We also you also
have a necktie. Right?
Jonathan Hall (18:09):
Yeah, I just got a custom made necktie. This
isn't a Cup of Go specific. Iused the pattern that we talked
about on show a few episodesago, and I made The
Shay Nehmad (18:18):
new Hawaii pattern.
Jonathan Hall (18:20):
Yeah, the Hawaiian shirt pattern. It also
works for a nice necktie. I hadthis made at Zazzle, but we we
could also make go ties. That'sthat's what we're gonna call it.
If we sell a bow tie, it's gonnabe called a go tie.
We can sell bow tie or neckties,I should say. I don't think they
have bow ties on our provider.But if you would like a Brewster
necktie, we can add those to thestore too.
Shay Nehmad (18:40):
Yeah. We'll add them. Anyway, so lots of new
swag. If you've been looking foran opportunity to buy, like,
gifts for the holiday season oryou just need some new socks and
you wanna show support for theshow, you can grab all of these
off the store as well. I haven'tgotten by the way, if you want
if you're not, like, the sort ofperson that installs the RC
release the moment it comes out,I ordered the the preview,
(19:02):
prints for these, and I haven'tgotten them yet.
So, you know, if you wanna waitfor next week's episode for me
to tell you if they're good ornot, you you can you can wait
one extra week. Alright. Let'sget back to news. I'm excited to
hear about these proposals.
Jonathan Hall (19:16):
Alright. All right. First up, this proposal
has been accepted. I I don'trecall if we talked specifically
about this proposal, but wetalked about its cousin or its
brother or whatever. You mayrecall there was a proposal that
was accepted several weeks,maybe months ago, to make the go
(19:36):
fix command do nothing becauseit had a whole bunch of outdated
stuff.
Shay Nehmad (19:40):
Yeah. To replay it was, like, deprecated or
something and go vet replacesit, something like that?
Jonathan Hall (19:45):
So like the last time it was updated was to
update from XNet context tocontext, which is like Go 1.7 or
something. So it was it had somestuff in it. It's just the stuff
that's completely obsolete bynow. So they accepted the
proposal to make it do nothing.Command doesn't delete it.
It just does nothing. Nowthey're adding functionality
back into it and incorporatingthat into Go, please. So
(20:05):
specifically, one of the thingsit does is it adds the existing
modernize analyzer, which iskind of a standalone tool you
can run-in the X package. Itlooks like it's also part of go,
please, but it will run thatthrough the go fix command. So
this is stuff that alreadysimplifies certain code examples
to newer versions that aresimpler.
So that'll be part of go fix.And then the other specific
(20:28):
thing it does is, I think wetalked about this in previous
episodes also, there's arelatively new go colon fix
directive you can put to inlinewhen you add a new function that
replaces an old function.Remember that conversation? So
that will be part of GoFix aswell, which is kind of cool
because that means that GoPleasecan update code that has nothing
(20:50):
to do with the GoStudderlibrary. If you use a GoFix
directive yourself and then youupdate versions or whatever, Go
Please will or Go Fix, I shouldsay, will update that for you.
Go Fix is rapidly jumping fromthe 1980s to modern day in its
usefulness.
Shay Nehmad (21:08):
I'm worried about, like, people using it to perform
changes you wouldn't expect.That's the only thing I'm
worried about with thisproposal. Where do I define
like, how does GoFix determinewhich fixes to run? Is there
like
Jonathan Hall (21:24):
So I think you can I think you have to put the
GoFix directly above thedeprecated function? So, like, I
I couldn't put a GoFix directivein my code that would tell your
code to run my code instead.
Shay Nehmad (21:35):
Unless you I import your code as a library.
Jonathan Hall (21:38):
Even then, don't I would only be able to do it.
And I mean, I could tell my codeto call your code, but I
wouldn't be able to do thereverse. Now that that might
still be dangerous in somecases. Like, I don't know.
Shay Nehmad (21:47):
That that's the only thing I'm I'm I'm because
it's like because people tend totrust the results of these, but
then suddenly it's like, oh, Iforked the supersave popular
library and I could go fix itfrom using, like, the function.
If I did that, I already ownedthe the supply chain thing, so I
actually need GoFix two to
Jonathan Hall (22:06):
make it happen. Exactly.
Shay Nehmad (22:08):
Maybe maybe it's not actually a real worry.
Jonathan Hall (22:10):
I would I think my first concern would be people
using it not knowing whatthey're doing or swapping code
that isn't actually equivalentout of LOSS.
Shay Nehmad (22:18):
Oh, yeah. That's also that's also a potential
problem. But other than all theproblems, I think this actually
could be useful. Cool. Yeah.
One, update I see here issomething we don't usually
mention, which is a proposalthat's put on hold.
Jonathan Hall (22:35):
Yeah, so I think we talked about this a while
back, adding experimentalHTTPthree support. It's been put
on hold, it's interesting. Thereason I put this in the backlog
was to talk about the reasonit's put on hold. Basically,
don't want to expose thisfunctionality to the world yet
as they don't want to advertiseit as complete because it's
still highly experimental. Sothey want to put it behind a Go
(22:56):
experiment flag, which we're allfamiliar with.
If you've talked or listened atall about JSON v2, for example,
that's behind an experimentright now. Different things in
the past. Math ran v2 was behindan experiment flag for a while.
The problem is the experimentflag is handled by the main
compiler and Xnet HTTPthreedoesn't have access to that. So
(23:22):
the second the next option waswe could use a build tag, but
that of course makes buildingthings a little more complicated
and so on.
So for now, it's on hold, Ithink, basically until the
experimental implementation isless experimental so that they
can either go full on with it.Isn't that
Shay Nehmad (23:38):
a chicken and egg thing, though?
Jonathan Hall (23:39):
Kind of. If they
Shay Nehmad (23:40):
can't add if it's on hold, how can they make it
less experimental?
Jonathan Hall (23:44):
I don't know the answer
Shay Nehmad (23:45):
to that. You know what I mean? You gotta move
forward unless they're waitingfor a specific thing. But
anyways, I'm I'm sure that thiswill, like, move forward. And we
talked about HTTPthree and whatdoes it actually mean in the
past, so you can go look up thatepisode if you wanna understand
what this means.
Generally, I I think it's gonnabe a really good protocol, and
(24:07):
we should get on with, like,implementing it as as default
and adding it to the librarybecause people are not gonna
notice what's gonna make theirservers, like, way way better.
Jonathan Hall (24:18):
It is interesting because, like, to me, XNet is
already semi experimental, Iguess. They they also talk about
putting it under the EXPnamespace, but that makes it
harder to promote to thestandard library later on. So,
yeah, there's like there's a lotof not quite perfect solutions
to this issue.
Shay Nehmad (24:34):
It's actually it's funny, but all this process is
actually agile. Right? Oractually Yeah. You wanna put it
in the hands of some people totry it out and then improve and
then improve and, incrementallyimprove. It's just what's the
best way to do it withoutdisrupting people who are using
the current product, I guess.
Jonathan Hall (24:49):
I wonder if it would make sense for the Go
experiment flag to be translatedto a build tag so that you could
expose that in your own code.Like, I've I've kinda wanted to
they
Shay Nehmad (25:02):
talk about it in the in the proposal, and you
can't actually do that becausethe build tags are maintained in
the main repo or something likethat. So so technically, it
doesn't it doesn't suit
Jonathan Hall (25:12):
your wonder if they should change that because,
like, I could see myself wantingto write code that works with
the JSON v one or JSON v two,and I don't know how to do that
on a code level. I don't thinkyou can control that.
Shay Nehmad (25:24):
Anyways, it's just put on hold for a while, but I'm
sure it'll move forward. And thelast discussion we wanna mention
is your favorite topic, clothingnaked returns.
Jonathan Hall (25:34):
Yeah. So this issue has gotten some some some
resistance since we announced ita few weeks ago. And there's a I
guess I could call it a subproposal to put it behind an
extra flag of GoFumped. Just torecap very quickly, version 0.9
of GoFumped clothes nakedreturns. So if you're using
(25:54):
naked returns, that's you know,you have a return with no
variables at the end.
It adds the variable names foryou. That's what it does. Some
people don't like this, mostlyfor reasons I don't really agree
with, but that doesn't matterbecause some people don't like
it. And Josh Blicker Snyder,who's been on the show a few
times, makes an interestingpoint. He says, I was really
excited to see this change land.
However, I'm slowly coming tothe position that it should be
(26:17):
an extra. And the reason hegives, I've evangelized GoFund
everywhere I've worked and in abunch of open source projects
that I have contributed to. Theconversation usually goes like
this. Hey, I suggest you useGoFund. They don't like it so
much.
He sends a diff. The diff issmall. Nobody objects to it.
They agree. And then pretty soonthey thank him for implementing
GoFund.
(26:37):
Recently, he's run the newGoFund on an open source project
he's on, and it had some prettybig diffs, presumably due to
naked returns. And he's a littlebit reluctant to ask for review
of that, although he agrees withall the changes. He's not sure
how well it'll go over with theother developers on this
project. So for that reason, hewould kind of like to put it
behind the extra flag so thatit's easier to convince people
(26:59):
to use GoFund. And I agree withhim.
Even though I can't think of areason I don't want to use this
feature, I would rather on newprojects adopt the rest of
GoFund without naked returnchanges than to not redopt it at
all, if that makes sense.
Shay Nehmad (27:13):
And isn't it such a small change it doesn't actually
warrant a review? Not to be alike, it why would you review
it? I ran GoFund. I'm done. Whoneeds to review it?
Why do you care?
Jonathan Hall (27:24):
I suppose if I don't know. On an open source
project, might. You you wannamake sure somebody isn't
smuggling something in. Yeah. Igenerally don't review those
either.
But for an open source, ifsomebody submitted me a code
review on my open source projectthat did GoFund, I would read it
line by line. So I could seethat.
Shay Nehmad (27:40):
Or you would just, take main and run GoFund
yourself and go diff?
Jonathan Hall (27:45):
Yeah. That would do that too. Yeah.
Shay Nehmad (27:46):
I don't know. It's obviously, it's it's more
complicated than what I'msaying, but to me, it feels
like, it's it's probably better.You know what I mean? Yeah. But
it's the the main thing is,like, okay.
So it met some resistance. Is itnot going in? Well, what's the
decision?
Jonathan Hall (28:05):
So it's already there. No decision has been
made. So this is a call foraction if you care about this.
No decision has been made, butDaniel Marti, the the maintainer
of the project, suggestedpossibly putting it behind extra
and, asked for people to upvotehis comment if they want that.
And it's gotten a small numberof upvotes.
It looks like three upvotes sofar.
Shay Nehmad (28:27):
We'll see. Anyways, it's like for the extra extra
among us. Like, if you don'twant it, just use the normal
GoFMT, not not GoFump. Right? Soit's not actually
Jonathan Hall (28:38):
One of the interesting things about this,
discussion is it brought myattention to the fact that extra
exists. I didn't realize it did.And there's there's only one
other feature behind that flagright now, and that feature is
to remove the type definitionsfrom concurrent or the type name
from concurrent types in afunction signature. So if you
have like string user stringpassword, it would change it to
(28:59):
to I'm sorry, the user stringcomma user password or change it
to user comma password string. Isaid that wrong, but I hope you
get the idea.
Shay Nehmad (29:08):
Yeah. Yeah. I I I understood what you got. Instead
of a int comma b int, it's gonnabe a comma b int.
Jonathan Hall (29:15):
Exactly. And I like that.
Shay Nehmad (29:17):
I don't like it.
Jonathan Hall (29:18):
You don't like it. So that's why it's behind
extra. Yeah. I I don't becauseit well, sometimes I do maybe,
but in general, it just makes itfunction sooner or longer. I
have another linter.
I think it's part of Revive thatI use with Golang CLINT that
does that for me also, but Ihave to go manually change it.
Now that I know that GoFump cando it, I can just turn that
extra flag on and it'll handleit. If you have an opinion
(29:41):
whether it should or should notbe part of extra, go comment on
the issue. Of course, that linkwill be in the show notes. Yeah.
That's that.
Shay Nehmad (29:49):
Cool. Cool. Cool. I think that wraps it up for the
show. I don't think we even havetime to do a lightning round.
We dove into too like like thedwarves, we delved too hungrily
and too deep. We should be back.Yeah. We should be back next
week with a normal episode, andthen the week after that is
gonna be like a live recordingepisode. If you're in San
(30:12):
Francisco, you'll be able tojoin.
Sounds great.
Jonathan Hall (30:15):
See you then.
Shay Nehmad (30:15):
Program exited. Program exited. Goodbye.
This show is supported by you. Stick around
(00:02):
till after the news or actuallyduring the news to hear a little
bit more about that and some newswag we're trying to sell that
you might want, you definitelywant. This is Cup of Go for
Friday, 10/10/2025. Keep up todate with the important
(00:24):
happenings in the Go communityin about fifteen minutes per
week. I'm Jonathan Hall.
Shay Nehmad (00:28):
And I'm Shay Nehmad. And aren't I happy that
you're not in sales?
Jonathan Hall (00:32):
I used to be. This thing that you might want
this thing. I actually won a skitrip because I was the I was the
second best salesperson in mydepartment
Shay Nehmad (00:42):
No way.
Jonathan Hall (00:42):
Of of technical support people.
Shay Nehmad (00:45):
I also heard that you worked at Denny's today.
Jonathan Hall (00:47):
I worked at Denny's lot of
Shay Nehmad (00:48):
my two employment history. I used to bus stables.
I also had a different job.
Jonathan Hall (00:52):
Yeah. I used to mow lawns. I used to lots of
things. These days, I mostlyjust break people's computers.
Shay Nehmad (00:57):
Talking about hard work. I really appreciate all
the hard work Andy Williams hasput into the last episode.
Thanks for covering for me, man.I really appreciate it. You know
where I went, Jonathan?
Where did you go? I went toDisneyland. Woo hoo. It was
(01:22):
actually super fun. I was sureI'm just gonna like, my kid was
gonna have fun, and I was justgonna be there to, like, watch
her.
But actually, Disney's awesome.Not sponsored, obviously. But,
man, the mouse knows what he'sdoing. So while I was, in
Disneyland, apparently, all thelittle security, problems came
(01:42):
on to roost. We have tensecondurity fixes in this minor
release, folks.
Although, when reading throughthem, they all have very similar
vibes and a lot of them from thesame company, Katana Cyber. So
they're all about, like,excessive CPU consumption,
quadratic complexity. Not all ofthem, but a lot of them are,
(02:04):
like, performance relatedsecurity bugs that can cause
resource exhaustion. So I assumethat the CVs themselves don't
have very high score because theonly thing it can do is like
make your server run Yeah. Toomuch.
And, you know, it's from allover, the National Cybersecurity
Center in Finland and thiscompany called Katana Cyber,
which is so European coded, it'snot even funny. Like, they're
(02:28):
you you open their site and it'slike, what Katana Cybers brings
to the cybersecurity field isthe, a word meaning lock in
Italian and used to describe themost defensive play system in
soccer.
Jonathan Hall (02:39):
Sounds a bit European.
Shay Nehmad (02:41):
Immediately alienating all their, potential,
American customers. Anyway, Iwanted to You should upgrade
1.25.2 and 1.24.8. You shouldalways upgrade patch versions
They're anyway, like nonbreaking and they only bring
benefits normally. I did wannamention a few of them just so
(03:02):
you understand, like, the vibe.One of them is, for example,
there's no limit when you'reparsing cookies, which is I
don't know if it's true for youpersonally in life as well.
Jonathan Hall (03:13):
I have no limit to cookie intake.
Shay Nehmad (03:17):
Exactly. So even though, HTTP headers have a
limit, the number of cookies,like, size limit, the number of
cookies, did not have a limit.
Jonathan Hall (03:28):
I could I could make a server or a client that
just, like, sends countlesscookies forever and ever.
Shay Nehmad (03:34):
Yeah. I can make you allocate a large amount of
struct Uh-huh. Causing largememory consumption. And now it's
limited to 3,000, which is feelslike a lot. That does
Jonathan Hall (03:47):
sound like
Shay Nehmad (03:47):
a lot. Cookies than you should have. But I don't
know. Maybe there's a legitimateuse case. You're you're actively
trying to be tracked by everysingle ad agency in
Jonathan Hall (03:57):
the I have a think. Like, if I if I if I
drove up and parked in front oftwo restaurants, one said all
you can eat cookies and one said3,000 cookies, I don't know how
I'd choose which one to go to.
Shay Nehmad (04:06):
I well, probably based
Jonathan Hall (04:08):
on price.
Shay Nehmad (04:08):
I don't know. I I actually can't enjoy cookies as
much because I can't have dairy.So all the really good ones, the
brown butter stuff, I can'thave. But now you have a maximum
amount of cookies that theserver can parse, which can be
adjusted using the http cookiemax num go debug option, which I
(04:31):
they missed an opportunity tocall it HTTP cookie max num num.
Yeah.
Jonathan Hall (04:34):
That's what it should have been.
Shay Nehmad (04:35):
But that's is this me? So these security fixes have
all been of this type. Like
Jonathan Hall (04:41):
I'm also surprised it's not exposed as an
option, although this would havebeen more than a patch release,
but, like, an option in eitherthe server or the client
configuration. Because I could Icould see somebody wanted to set
that to, like, three for commoncases. But calling debug,
whatever, seems a little bit of,like, a roundabout way to do
that. And it also doesn't letyou control it on a per client
or per server basis. You know,if you want if you want part of
(05:03):
your application to allowmaximum three other maximum 50
or something, you can't do that.
Shay Nehmad (05:07):
Yeah. I think doesn't the HTTP have a default
server
Jonathan Hall (05:10):
Yeah.
Shay Nehmad (05:10):
That you're not, like, setting up? So I guess
it's for that one.
Jonathan Hall (05:13):
Oh, okay.
Shay Nehmad (05:13):
The net HTTP one
Jonathan Hall (05:15):
I guess it makes sense.
Shay Nehmad (05:16):
Which you don't, like, control. Other examples
include quadratic complexitywhen checking name constraints.
So some inputs scalenonlinearly, which can cause
just a really big complexity.Again, not a huge CV in terms
of, oh my god, someone is gonna,like, own your computer.
Jonathan Hall (05:34):
Mhmm.
Shay Nehmad (05:35):
But definitely a worthwhile fix. This is from
Jacob Sialik, and also a friendof the show, Joobob, which now I
I know how to pronounce yourname finally, also has a
security, patch in this one,which is really cool. It's
really fun to see, like, namesof people from the show on these
notes. From the show, meaningfrom, like, the Slack that talk
(05:57):
to me, that I don't know themfrom anywhere else but the show.
Yeah.
The the cookie thing was hisAwesome.
Jonathan Hall (06:03):
So I can blame him for
Shay Nehmad (06:04):
not getting enough Yes. Exactly. And one other that
I really, really liked, you'renot gonna believe it.
Jonathan Hall (06:11):
I already don't believe it. You're lying to me.
Shay Nehmad (06:13):
Net URL What? I p v six.
Jonathan Hall (06:16):
Oh my goodness.
Shay Nehmad (06:18):
So as everybody knows, we're really we're just
moments from running out of IPvfour addresses in the world.
Jonathan Hall (06:24):
Moments away for the last fifteen years. We
should probably upgrade to IPveight to fix all these IPv six
problems.
Shay Nehmad (06:32):
Yeah. That's exactly the kind of take that I
can really imagine an AI makingin, a Twitter argument. If
you're not if you're not on IPVeight, you're not you're an
NGMI. You're not gonna make it.Yeah.
I bet I bet you, unironically, Icould raise $5,000,000 for IPV
eight Oh, wouldn't be startup.Like, in a week. Anyway, there's
(06:54):
a whole thing about, mistakenlynot validating bracketed h IPv8
host names, when you parse them.So you need to put them in a
square bracket. Right?
And the IPv four addresses mustappear in these square brackets.
(07:15):
And then there's a whole thing.I really love this comment where
they, like, have a screenshot ofthe RFC with specific parts of
it, like, highlighted. And thenapparently, it was like, oh, it
doesn't have to be. Oh, it doeshave to be.
It's like unquoted brackets havea diff different meaning in
something that I didn't thinkabout since my computer science,
(07:36):
like, degree, the augmentedBacchus Naur form, which is like
a language, like a meta languagewhere you have, like, rule sets
and It's a thing that's strictlyused for, like, RFCs and things
like that when you need todefine anyways, I love it. If
you love, like, people sufferingover details of RFCs, this one
is the is the thing for you.
Jonathan Hall (07:57):
I think we can safely say IPv6 isn't gonna
replace your network. Right? Itit's someone else's IPv4 using
IPv6 that's gonna replace yournetwork to tie it back into the
whole AI debate.
Shay Nehmad (08:08):
Yeah. Yeah. Ten secondurity fixes in, like, the
standard library, plus we're notgonna go into it, but two
security fixes in the XNet, aswell. I think from similar
people.
Jonathan Hall (08:22):
Yes. And they're both related to, you'll never
guess it, HTML.
Shay Nehmad (08:27):
Yeah. It's all, like, parsing or whatever. And
also, it's not again, it's not,like, gonna own your computer.
It's mostly performance stuff, II feel. I I try to review all of
them.
It's like 12. If I missed onethat's actually CV 10, forgive
me. They should order them inorder of importance on the There
you go. On the security bullet.
Jonathan Hall (08:46):
Yeah. Right? Most important first.
Shay Nehmad (08:49):
By the way, one thing I highly recommend is
going to these fixes themselvesbecause I think actually reading
these, when I me when I sayfixes, I mean actually the
googlesource.com, like, changelist because these ones are a
really good way to learn about,how to identify and how to fix
these sort of things. I thinkthat, like, looking at these
(09:09):
change lists, let's take, forexample, the net mail quadratic
behavior. So when you parse themail address, they parse it,
like, one character at a timeinstead of a sub slice and then
included the benchmark in thecommit message. So you can,
like, take a look at it and seethat it actually is better. And,
you know, if you just look atthe file itself, it's it's
(09:30):
really easy to see how a tinychange can cause this, like,
security issue.
If you but if you were to lookjust at the change without the
context of which change list itis, you would never be able to
guess what this does. So I thinkit's actually a good, like,
learning opportunity to, like,look at this change and see, oh,
I define the d text len and the,you know, the the string outside
(09:55):
of the for instead of doing it,like one by one and then it's,
avoiding quadratic behavior.It's like, oh, this is how you
avoid this is the pattern, youknow what I mean, to avoid
quadratic behavior in my code.Whenever there's a four, instead
of, working on whatever's leftat every time, just add it in a
sub slice, for example. So it'sgood, like, for the pattern
(10:17):
recognition of security stuff.
Yeah.
Jonathan Hall (10:19):
That's clever.
Shay Nehmad (10:20):
Which if you if you pull that up in a code review,
man, people look like a littlelike you're a Jedi. Like, this
four thing has a quadraticcomplexity. Like, oh my god. How
did you know? It's it's justlike practicing chess.
It's pattern recognition. Nice.Anyway, tons of security fixes.
Go upgrade. And also veryinteresting one, so go read
them.
Jonathan Hall (10:38):
Also very interesting. I see here that Cup
of Go is sponsoring a meetupcoming up, on October 23. It
looks kinda scary. Oh. If you'rein San Francisco on the twenty
third, 05:30.
It says 05:30PM. That must be mytime, not local time. Right?
Shay Nehmad (10:54):
It's San Francisco.
Jonathan Hall (10:55):
Starts at 05:30PM San Francisco time. Okay. Till
07:30PM. Go listen to You CanEdit the Runtime presented by
Josh Bleecker Snyder. Did youknow you could edit the runtime?
Yeah. It sounds scary to to saynothing else.
Shay Nehmad (11:07):
Yes. It is an October Halloweeny it's my first
Halloween in The States, andpeople here are, like, super
excited about Halloween. Like,all my neighborhood is skeletons
already, so I was like, I'mgonna make it scary as
Jonathan Hall (11:20):
costume selected yet for yours for Halloween or
for the meetup?
Shay Nehmad (11:23):
I didn't think about any just stumped me. I
really
Jonathan Hall (11:27):
If you get a Brewster costume,
Shay Nehmad (11:29):
I'll I'll send
Jonathan Hall (11:30):
I don't know. That would be cool.
Shay Nehmad (11:34):
Yeah. I don't know.
Jonathan Hall (11:35):
Also scary in the same meetup, a live recording of
Cup of Go. I don't know if
Shay Nehmad (11:39):
that's scary for the listeners. Maybe. We'll see
we'll see how go how well itgoes. Yeah. So given the fact
that
Jonathan Hall (11:45):
you might have a conflict. So I'm I'm I'll try to
pop in for a few minutes, but Iwon't be there for the whole
thing. I will be at the speakersdinner for Go West, which is the
conference is happening the nextday. So if you are also a Go
West speaker, you obviouslywon't be at the San Francisco
meetup that day. And then afterthat, lightning talk, using LLMs
to write murder mysteries.
(12:06):
Also scary.
Shay Nehmad (12:07):
And finally, durable workflow orchestration
with Golang and Postgres. Sosome serious stuff, some not so
serious stuff. Overall, itshould be a lot of fun. We we
have, some, like, 30 or 40people attending already. Nice.
Some including friends of theshow or people I've already met,
and some people for whichthey're, like, their it's their
(12:29):
first event ever. So I'm, like,very excited to have everybody.
Jonathan Hall (12:33):
That's awesome.
Shay Nehmad (12:34):
Yeah. But we want more people.
Jonathan Hall (12:36):
So The more the scarier.
Shay Nehmad (12:38):
We wanna fill the room. Yeah. And, there's another
meetup, in Israel, which I'm notthere anymore, but, like, I
still, follow Micky on Twitterand whatever. So I saw it. Go
Israel December 2025 meetup.
If you don't know Micky, I'm,like, name dropping him. He's
our first interviewee
Jonathan Hall (12:57):
A whole way back on episode one.
Shay Nehmad (12:59):
From, like, two years ago or whatever. It's
gonna be over at Kato Networksoffice in Leonardo Da Vinci 2
Street in December December 10.
Jonathan Hall (13:08):
December 10, Tel Aviv. Up upcoming talks are
Shay Nehmad (13:11):
talks are
Jonathan Hall (13:11):
still TBD. TBD. Guess that means if you want to
give a talk, reach out to Mickeyand see if there's a spot. It
sounds like there probably isone.
Shay Nehmad (13:19):
Yeah. There's sounds like there are two. Yeah.
Or maybe they just haven't
Jonathan Hall (13:24):
Might just not have updated.
Shay Nehmad (13:25):
Yeah. I can't see the attendees because it's like
a meetup plus feature blah blahblah. You know what I mean? It's
like you need the premium. But Ican see, four of the attendees,
and I already see I know allfour of them.
So Wow. Looks like it's gonna bea great event. I'm not gonna be
there because I'm not in Israel,at that time, but looks like a
(13:45):
great event as well. A link inthe show notes.
Jonathan Hall (13:48):
Awesome. I think that's a good time to do a
break. We do have some more newscoming up. Some we're gonna talk
about some past news issues,some updates, but let's do a
quick break first before we getto that.
Shay Nehmad (14:06):
This show, as Jonathan mentioned at the top,
is supported by you. The bestway to support us is directly
through Patreon. This is ahobby, we do it for fun, but
it's kind of expensive, youknow, our time and editing fees
and hosting fees and whatever.So if you want, you can join our
Patreon, $8 a month or Cup ofGopher Mini for $3 a month, and
(14:28):
just help us, like, cover costsfor the show. We have some new
Patreons.
Jonathan Hall (14:32):
A big shout out to Kent Smith, Jeff Macy, and
Jennifer Johnson. Thank you forjoining us. Thank you for
supporting.
Shay Nehmad (14:38):
Yes. Thank you for joining. We really appreciate
it. Other than that, we youknow, the usual spiel. You can
find everything at cupago.dev,and we're on Slack at hashtag
cupago, kabobcase with hyphens.
If you wanna email us, it'snews@cupago.dev. Another way to
support the show is to leave areview on Spotify or Apple
Podcasts, wherever you listen toyour podcasts. Just let people
(15:00):
know about the show. We don'tpay for advertising at all, just
word-of-mouth. So if you'regoing to one of these meetups or
if you're going to a conference,go west, talk about the podcast
because we want more peoplehere.
Talking about things you canbring to the conference, we have
new swag.
Jonathan Hall (15:18):
We sure do.
Shay Nehmad (15:20):
We actually have a new logo
Jonathan Hall (15:21):
Yes.
Shay Nehmad (15:22):
Which we're like it's not gonna fully replace the
existing one. It's just like asimple version.
Jonathan Hall (15:28):
We have two new logos, to be honest.
Shay Nehmad (15:30):
Actually, that's true. You can find all of the
new things in store.capago.dev.So we have one logo that's extra
explicit, the Range RoverBrewster recursive.
Jonathan Hall (15:39):
Extra explicit. Do not let your children look at
this one.
Shay Nehmad (15:44):
R rated sticker. No. It just says cupago on the
bottom so people know what's up
Jonathan Hall (15:49):
with it.
Shay Nehmad (15:50):
And the and the cup is recursive, which is fun.
Jonathan Hall (15:53):
So Brewster's cup has Brewster holding a cup has
Brewster holding a cup. Blahblah blah.
Shay Nehmad (15:58):
Exactly. And so that's a new big sticker you can
you can place on your laptop oryour bag or whatever.
Jonathan Hall (16:06):
Or if you come to Go West, you can get a free one.
Shay Nehmad (16:09):
Oh, what what challenge do they have to pass
to get the sticker?
Jonathan Hall (16:12):
You just have to come say hi or or pick it up off
the table. I'm I'm not sure howthat's gonna work, but I'll be
speaking there, so I'll I'll behanding them out. If nothing
else, come talk to me. I alsohave new Boldly Go stickers from
our from my YouTube channel.Give you one of those for free
if you come say hi as well.
Shay Nehmad (16:25):
And we have new socks. The Go sucks. Oh, no.
Wait. Go socks socks.
And one thing I'm most excitedabout, because I recently lost
my hat and I need a new hat, isthe Cup Go hat, the
controversial Cup Go hat in twovariants, white and pink. I
(16:46):
think I'm gonna get the whiteone. I think I might get both.
The pink one actually lookssuper dapper. And we still have
all the old swag, the Cup O Gocoffee mug, the t shirt, the
sweatshirt, which is like mynumber one hoodie at work.
I just keep it at the office,super comfy. The old sticker,
and the infamous, one personbought it over the last couple
(17:08):
of years, wireless charger.Yeah. So all our new swag with
the new simplified logo. Give usyour feedback if you like it or
not.
Like, we don't know.
Jonathan Hall (17:18):
And if you want something else, you know, the
the the place where you're doingthis has all sorts of stuff, but
we don't wanna upload 10,000products that nobody's gonna
buy. If there's something you dowant, though, let us know, and,
we're happy to be happy toconsider adding it.
Shay Nehmad (17:31):
Yes. And let us know what you think of our Lou
logo. It's it's going like thesame way every tech company has
gone where it had like anintricate logo. It's like the
Cracker Barrel thing. Now wehave a simplified logo.
Jonathan Hall (17:44):
If you don't like it, we'll fire our new CEO just
to let you know, to be on, you
Shay Nehmad (17:48):
know Yeah. For sure. I don't think we should
fire him. I think we should justdo like, we should do the
Theranos thing, the FDX thing.Just throw him in jail.
In reality, we had to get thenew logo because for the hat,
has to be simple
Jonathan Hall (18:01):
Yeah.
Shay Nehmad (18:01):
For them to embroider it correctly. That's
that's the actual reason thishas happened. We also you also
have a necktie. Right?
Jonathan Hall (18:09):
Yeah, I just got a custom made necktie. This
isn't a Cup of Go specific. Iused the pattern that we talked
about on show a few episodesago, and I made The
Shay Nehmad (18:18):
new Hawaii pattern.
Jonathan Hall (18:20):
Yeah, the Hawaiian shirt pattern. It also
works for a nice necktie. I hadthis made at Zazzle, but we we
could also make go ties. That'sthat's what we're gonna call it.
If we sell a bow tie, it's gonnabe called a go tie.
We can sell bow tie or neckties,I should say. I don't think they
have bow ties on our provider.But if you would like a Brewster
necktie, we can add those to thestore too.
Shay Nehmad (18:40):
Yeah. We'll add them. Anyway, so lots of new
swag. If you've been looking foran opportunity to buy, like,
gifts for the holiday season oryou just need some new socks and
you wanna show support for theshow, you can grab all of these
off the store as well. I haven'tgotten by the way, if you want
if you're not, like, the sort ofperson that installs the RC
release the moment it comes out,I ordered the the preview,
(19:02):
prints for these, and I haven'tgotten them yet.
So, you know, if you wanna waitfor next week's episode for me
to tell you if they're good ornot, you you can you can wait
one extra week. Alright. Let'sget back to news. I'm excited to
hear about these proposals.
Jonathan Hall (19:16):
Alright. All right. First up, this proposal
has been accepted. I I don'trecall if we talked specifically
about this proposal, but wetalked about its cousin or its
brother or whatever. You mayrecall there was a proposal that
was accepted several weeks,maybe months ago, to make the go
(19:36):
fix command do nothing becauseit had a whole bunch of outdated
stuff.
Shay Nehmad (19:40):
Yeah. To replay it was, like, deprecated or
something and go vet replacesit, something like that?
Jonathan Hall (19:45):
So like the last time it was updated was to
update from XNet context tocontext, which is like Go 1.7 or
something. So it was it had somestuff in it. It's just the stuff
that's completely obsolete bynow. So they accepted the
proposal to make it do nothing.Command doesn't delete it.
It just does nothing. Nowthey're adding functionality
back into it and incorporatingthat into Go, please. So
(20:05):
specifically, one of the thingsit does is it adds the existing
modernize analyzer, which iskind of a standalone tool you
can run-in the X package. Itlooks like it's also part of go,
please, but it will run thatthrough the go fix command. So
this is stuff that alreadysimplifies certain code examples
to newer versions that aresimpler.
So that'll be part of go fix.And then the other specific
(20:28):
thing it does is, I think wetalked about this in previous
episodes also, there's arelatively new go colon fix
directive you can put to inlinewhen you add a new function that
replaces an old function.Remember that conversation? So
that will be part of GoFix aswell, which is kind of cool
because that means that GoPleasecan update code that has nothing
(20:50):
to do with the GoStudderlibrary. If you use a GoFix
directive yourself and then youupdate versions or whatever, Go
Please will or Go Fix, I shouldsay, will update that for you.
Go Fix is rapidly jumping fromthe 1980s to modern day in its
usefulness.
Shay Nehmad (21:08):
I'm worried about, like, people using it to perform
changes you wouldn't expect.That's the only thing I'm
worried about with thisproposal. Where do I define
like, how does GoFix determinewhich fixes to run? Is there
like
Jonathan Hall (21:24):
So I think you can I think you have to put the
GoFix directly above thedeprecated function? So, like, I
I couldn't put a GoFix directivein my code that would tell your
code to run my code instead.
Shay Nehmad (21:35):
Unless you I import your code as a library.
Jonathan Hall (21:38):
Even then, don't I would only be able to do it.
And I mean, I could tell my codeto call your code, but I
wouldn't be able to do thereverse. Now that that might
still be dangerous in somecases. Like, I don't know.
Shay Nehmad (21:47):
That that's the only thing I'm I'm I'm because
it's like because people tend totrust the results of these, but
then suddenly it's like, oh, Iforked the supersave popular
library and I could go fix itfrom using, like, the function.
If I did that, I already ownedthe the supply chain thing, so I
actually need GoFix two to
Jonathan Hall (22:06):
make it happen. Exactly.
Shay Nehmad (22:08):
Maybe maybe it's not actually a real worry.
Jonathan Hall (22:10):
I would I think my first concern would be people
using it not knowing whatthey're doing or swapping code
that isn't actually equivalentout of LOSS.
Shay Nehmad (22:18):
Oh, yeah. That's also that's also a potential
problem. But other than all theproblems, I think this actually
could be useful. Cool. Yeah.
One, update I see here issomething we don't usually
mention, which is a proposalthat's put on hold.
Jonathan Hall (22:35):
Yeah, so I think we talked about this a while
back, adding experimentalHTTPthree support. It's been put
on hold, it's interesting. Thereason I put this in the backlog
was to talk about the reasonit's put on hold. Basically,
don't want to expose thisfunctionality to the world yet
as they don't want to advertiseit as complete because it's
still highly experimental. Sothey want to put it behind a Go
(22:56):
experiment flag, which we're allfamiliar with.
If you've talked or listened atall about JSON v2, for example,
that's behind an experimentright now. Different things in
the past. Math ran v2 was behindan experiment flag for a while.
The problem is the experimentflag is handled by the main
compiler and Xnet HTTPthreedoesn't have access to that. So
(23:22):
the second the next option waswe could use a build tag, but
that of course makes buildingthings a little more complicated
and so on.
So for now, it's on hold, Ithink, basically until the
experimental implementation isless experimental so that they
can either go full on with it.Isn't that
Shay Nehmad (23:38):
a chicken and egg thing, though?
Jonathan Hall (23:39):
Kind of. If they
Shay Nehmad (23:40):
can't add if it's on hold, how can they make it
less experimental?
Jonathan Hall (23:44):
I don't know the answer
Shay Nehmad (23:45):
to that. You know what I mean? You gotta move
forward unless they're waitingfor a specific thing. But
anyways, I'm I'm sure that thiswill, like, move forward. And we
talked about HTTPthree and whatdoes it actually mean in the
past, so you can go look up thatepisode if you wanna understand
what this means.
Generally, I I think it's gonnabe a really good protocol, and
(24:07):
we should get on with, like,implementing it as as default
and adding it to the librarybecause people are not gonna
notice what's gonna make theirservers, like, way way better.
Jonathan Hall (24:18):
It is interesting because, like, to me, XNet is
already semi experimental, Iguess. They they also talk about
putting it under the EXPnamespace, but that makes it
harder to promote to thestandard library later on. So,
yeah, there's like there's a lotof not quite perfect solutions
to this issue.
Shay Nehmad (24:34):
It's actually it's funny, but all this process is
actually agile. Right? Oractually Yeah. You wanna put it
in the hands of some people totry it out and then improve and
then improve and, incrementallyimprove. It's just what's the
best way to do it withoutdisrupting people who are using
the current product, I guess.
Jonathan Hall (24:49):
I wonder if it would make sense for the Go
experiment flag to be translatedto a build tag so that you could
expose that in your own code.Like, I've I've kinda wanted to
they
Shay Nehmad (25:02):
talk about it in the in the proposal, and you
can't actually do that becausethe build tags are maintained in
the main repo or something likethat. So so technically, it
doesn't it doesn't suit
Jonathan Hall (25:12):
your wonder if they should change that because,
like, I could see myself wantingto write code that works with
the JSON v one or JSON v two,and I don't know how to do that
on a code level. I don't thinkyou can control that.
Shay Nehmad (25:24):
Anyways, it's just put on hold for a while, but I'm
sure it'll move forward. And thelast discussion we wanna mention
is your favorite topic, clothingnaked returns.
Jonathan Hall (25:34):
Yeah. So this issue has gotten some some some
resistance since we announced ita few weeks ago. And there's a I
guess I could call it a subproposal to put it behind an
extra flag of GoFumped. Just torecap very quickly, version 0.9
of GoFumped clothes nakedreturns. So if you're using
(25:54):
naked returns, that's you know,you have a return with no
variables at the end.
It adds the variable names foryou. That's what it does. Some
people don't like this, mostlyfor reasons I don't really agree
with, but that doesn't matterbecause some people don't like
it. And Josh Blicker Snyder,who's been on the show a few
times, makes an interestingpoint. He says, I was really
excited to see this change land.
However, I'm slowly coming tothe position that it should be
(26:17):
an extra. And the reason hegives, I've evangelized GoFund
everywhere I've worked and in abunch of open source projects
that I have contributed to. Theconversation usually goes like
this. Hey, I suggest you useGoFund. They don't like it so
much.
He sends a diff. The diff issmall. Nobody objects to it.
They agree. And then pretty soonthey thank him for implementing
GoFund.
(26:37):
Recently, he's run the newGoFund on an open source project
he's on, and it had some prettybig diffs, presumably due to
naked returns. And he's a littlebit reluctant to ask for review
of that, although he agrees withall the changes. He's not sure
how well it'll go over with theother developers on this
project. So for that reason, hewould kind of like to put it
behind the extra flag so thatit's easier to convince people
(26:59):
to use GoFund. And I agree withhim.
Even though I can't think of areason I don't want to use this
feature, I would rather on newprojects adopt the rest of
GoFund without naked returnchanges than to not redopt it at
all, if that makes sense.
Shay Nehmad (27:13):
And isn't it such a small change it doesn't actually
warrant a review? Not to be alike, it why would you review
it? I ran GoFund. I'm done. Whoneeds to review it?
Why do you care?
Jonathan Hall (27:24):
I suppose if I don't know. On an open source
project, might. You you wannamake sure somebody isn't
smuggling something in. Yeah. Igenerally don't review those
either.
But for an open source, ifsomebody submitted me a code
review on my open source projectthat did GoFund, I would read it
line by line. So I could seethat.
Shay Nehmad (27:40):
Or you would just, take main and run GoFund
yourself and go diff?
Jonathan Hall (27:45):
Yeah. That would do that too. Yeah.
Shay Nehmad (27:46):
I don't know. It's obviously, it's it's more
complicated than what I'msaying, but to me, it feels
like, it's it's probably better.You know what I mean? Yeah. But
it's the the main thing is,like, okay.
So it met some resistance. Is itnot going in? Well, what's the
decision?
Jonathan Hall (28:05):
So it's already there. No decision has been
made. So this is a call foraction if you care about this.
No decision has been made, butDaniel Marti, the the maintainer
of the project, suggestedpossibly putting it behind extra
and, asked for people to upvotehis comment if they want that.
And it's gotten a small numberof upvotes.
It looks like three upvotes sofar.
Shay Nehmad (28:27):
We'll see. Anyways, it's like for the extra extra
among us. Like, if you don'twant it, just use the normal
GoFMT, not not GoFump. Right? Soit's not actually
Jonathan Hall (28:38):
One of the interesting things about this,
discussion is it brought myattention to the fact that extra
exists. I didn't realize it did.And there's there's only one
other feature behind that flagright now, and that feature is
to remove the type definitionsfrom concurrent or the type name
from concurrent types in afunction signature. So if you
have like string user stringpassword, it would change it to
(28:59):
to I'm sorry, the user stringcomma user password or change it
to user comma password string. Isaid that wrong, but I hope you
get the idea.
Shay Nehmad (29:08):
Yeah. Yeah. I I I understood what you got. Instead
of a int comma b int, it's gonnabe a comma b int.
Jonathan Hall (29:15):
Exactly. And I like that.
Shay Nehmad (29:17):
I don't like it.
Jonathan Hall (29:18):
You don't like it. So that's why it's behind
extra. Yeah. I I don't becauseit well, sometimes I do maybe,
but in general, it just makes itfunction sooner or longer. I
have another linter.
I think it's part of Revive thatI use with Golang CLINT that
does that for me also, but Ihave to go manually change it.
Now that I know that GoFump cando it, I can just turn that
extra flag on and it'll handleit. If you have an opinion
(29:41):
whether it should or should notbe part of extra, go comment on
the issue. Of course, that linkwill be in the show notes. Yeah.
That's that.
Shay Nehmad (29:49):
Cool. Cool. Cool. I think that wraps it up for the
show. I don't think we even havetime to do a lightning round.
We dove into too like like thedwarves, we delved too hungrily
and too deep. We should be back.Yeah. We should be back next
week with a normal episode, andthen the week after that is
gonna be like a live recordingepisode. If you're in San
(30:12):
Francisco, you'll be able tojoin.
Sounds great.
Jonathan Hall (30:15):
See you then.
Shay Nehmad (30:15):
Program exited. Program exited. Goodbye.
Popular Podcasts
Las Culturistas with Matt Rogers and Bowen Yang
Ding dong! Join your culture consultants, Matt Rogers and Bowen Yang, on an unforgettable journey into the beating heart of CULTURE. Alongside sizzling special guests, they GET INTO the hottest pop-culture moments of the day and the formative cultural experiences that turned them into Culturistas. Produced by the Big Money Players Network and iHeartRadio.
Crime Junkie
Does hearing about a true crime case always leave you scouring the internet for the truth behind the story? Dive into your next mystery with Crime Junkie. Every Monday, join your host Ashley Flowers as she unravels all the details of infamous and underreported true crime cases with her best friend Brit Prawat. From cold cases to missing persons and heroes in our community who seek justice, Crime Junkie is your destination for theories and stories you won’t hear anywhere else. Whether you're a seasoned true crime enthusiast or new to the genre, you'll find yourself on the edge of your seat awaiting a new episode every Monday. If you can never get enough true crime... Congratulations, you’ve found your people. Follow to join a community of Crime Junkies! Crime Junkie is presented by audiochuck Media Company.
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.