🎉 Surprise! 😯 A new security release is coming!

Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Jonathan Hall (00:00):
This show is supported by you, our listener.
Stick around to Life for theNews to hear more about that.
This is Cup of Go for05/02/2025. Keep up to date with
the important happenings in theGo community in about fifteen

(00:20):
minutes per week. I'm JonathanHall.
And I'm Shay Nehmad. And we havea surprising show for you.
Surprising because we haven'treally planned the whole thing
very well, so it'll be asurprise for us too.

Shay Nehmad (00:31):
Yeah. We'll we'll figure it out at runtime. It's
it's JIT podcasting, just intime podcasting. There it is.
Jonathan frantically moving thecards around in our trail board
as we speak.
While you're adjusting all that,I'll tell you, I had a pretty
intense week. Oh, yeah? Boy, amI happy to sit with you and just
talk about Go. I was in SanFrancisco for RSA, which is like

(00:54):
the big security conferencebecause my company is a
cybersecurity company, thestartup. Mhmm.
I met like the guys from myprevious startups there. Like
basically, the entirecybersecurity scene of Tel Aviv
was in San Francisco last week.

Of course. Yeah. Yeah.

It was a lot of fun. You're seeing, like, your
old companies doing very well inthe trade show, having, the
booth. Mhmm. I came up to thebooth and, you know, it's an
American salesman who joined thecompany after I left, so doesn't
know me. Like, what are you guysabout?
And he's like starting to tellme about the the features that
like I built. That was that wasa lot of fun. But San Francisco

(01:34):
is very intense.

Yeah. Yeah.

It's very tiring. And I worked on, like, the
current product, and I moved tomy new apartment. Wow. If
anybody has a couch in the SanJose area, I would love to have
a couch or a desk. Desk alsogood.
Or a TV, TV also good.

I'm curious though, did you happen to run
into maybe, I don't know, Yuhoeor anybody else knows about Go
Security stuff who could key usin to what's coming up on
Tuesday?

I don't know. I really all the people there were
salespersons. It's not nobodythere was like with their laptop
doing security research. I canpromise you that. I can we
probably know the people who payYuho, but not you

or those people. All right. So what that means is
that the first surprise of theshow for all of us is that Go
one point two four point threeand one point twenty three point
nine will be coming out onTuesday with a surprise security
fix in them.

Mark your calendars.

Mark your calendars.

We don't know what's going on there yet. I did
some digging. I think it'srelated to some Chinese
operating system, but it mightjust be like a CVE mix up.
Here's another surprising thing,Jonathan. You ready?

I'm ready.

There's a conference.

Yes. And the speakers who will be there are
the surprise because we don'tknow yet.

You could, hand in your call for papers. Right?
They're they're looking forpapers.

They're looking for papers. You have until June
3. So about a month.

When and when? Like, is it online? Is it
somewhere?

So it will be in Lehi, Utah on twenty four
October twenty twenty five. Lastyear, it was twenty five October
twenty twenty four. So we justput those digits around and we
got the new date. Aside fromthat, we have, we mentioned this
last week, but the details werefinalized May 7. So that's this
week in Atlanta.
I will be presenting at the GoAtlanta user group meetup on how

(03:50):
to write idiomatic tests in Go.So if you wanna come there and
you're in the area.

You give us like a How do you write idiomatic tests
in Go?

Well, I'm gonna spend the next weekend cramming
on learning how to do thatbecause I don't really know.

So far all your tests have been like super
shitty.

Oh, they definitely are. Yeah, some of
the highlights will be why theGo advice is to not use
assertion libraries, how towrite table driven tests. I'll
talk about test containers. Wehad Manuel de la Pena on the
show a while back to talk abouttest containers. He's the
maintainer of that.
So I'll probably do a plug forthat. And probably Adelina's

(04:31):
book, TTD in Go. So yeah, thoseare some of the things I'll be
talking about.

No, like how to write tests with AI, AI, AI? A
talk that's not about AI, isthat allowed in 2025?

I don't know. I guess I'll just see if I get the
rotten fruit thrown at me at theat the presentation.

I would ask Claude if it's if it's fine or not.
I'll just say quickly that I'msuper happy with, test
containers and I've beensurprised at how fast you can
spin up multiple of them on mynew, like, m four machine. I've
just split up my tests into six,and I'm spinning up, like, six
Postgres containers. It takes,like, three seconds. Yeah.

(05:08):
Yeah. Super and because it's allin code, it's really easy. I
just, like, split my test filesinto multiple files and then it
runs like multiple containers.

Very

cool. There is something that is not very
surprising. Go one twenty five.As time marches on, you know,
every February aroundValentine's Day and every,
August around the the end ofsummer, we release a new version
of Go. Go one twenty five is setfor August 2025, expected.

(05:38):
Hopefully, everything, works outthat way. And you can start
taking a look at the releasenotes. Just go to
tip.golink.org/docs/go1.20five,and you can look at like all the
changes. Obviously, it's stilldraft and not everything's here
yet, and it's gonna change alot. This is one of those like
live documents.

(05:59):
But if you really wanna track,you know, the development or
you're involved in a specificpart, you can take a look, at at
this document and see what'slike going on. There's like
changes to the runtime, changesto the compiler. Some things
we've discussed in the show,obviously, some things that, not
yet. And, it's always fun tolike look at this document

(06:20):
slowly, very slowly, like getswritten and then a week just
like you and your talk, a weekbefore it needs to be released,
everybody's, like, cramming onit. Human nature, I guess.
But, yeah, the link is in theshow notes if that sort of thing
interests you. But other thanthings being added to the
language, there are some thingsthat were removed from the
language, this version, and wesorta missed on them. Can you

(06:43):
fill us in?

Yeah, the GOAT team was pretty busy writing
blogs over the last couple ofmonths and we haven't been
keeping on top of them. But oneof them they wrote from Robert
Gressymir, I hope I said thatright. Goodbye core types,
hello, Go as we know and loveit. Do you know what a core type
is, Shy? I'm ashamed to admit

I sort of don't. Thought I understood it from the
name. Was like, oh, core type,like int. Mhmm. And it's the
blog post is, like, all abouttyping and type theory is always
a bit confusing to me.
But I think it's like somethingthat it's like a class almost
sorta thing maybe.

I don't So you're not alone in being confused by
what core types are. So Iactually not long ago finished
what was essentially a two yearseries of writing every day
about the Ghost spec, right? SoI started at the beginning and I
would point by point wrote to mydaily email list about the Ghost
spec. And after doing that, Istill did not have a solid

(07:45):
understanding of core types. SoI don't think you need to feel
embarrassed for notunderstanding core types.

Well, if I understand this blog post
correctly, if you go throughthis exercise again, you won't
even know about core types,That's

right, that's right. So in a nutshell, I'm not
even gonna explain what they aretechnically, but I'm gonna
explain how they came to be morelike that. When generics were
added in Go 1.18, they had abunch of special cases that
like, I don't even know what theexamples are right now. Not
gonna worry about that. But likeunder this circumstance, we need
to do this weird thing with thistype, but for other types we
need to do this other weirdthing.

(08:19):
And so they introduced theconcept of a core type, which
kind of served as an abstractionto make some of these special
cases go away.

Yeah. I thought in slices, like slices in generics
had a lot of problems.

Well, they've decided that actually the core
type concept is probably moreconfusing than it is helpful. So
they're removing that from thespec. And in fact, many places
where there weren't specialcases, they just like would
replace the term underlying typewith core type. But they're
slightly different in certainweird corner cases. What they
decided to do is remove theconcept of core type and then

(08:56):
just enumerate those specialcases every time they matter.
So it's a little bit less of anabstraction, thinking in like
coding terms, more copying andpasting, if you will, of these
special cases. But it makes iteasier to understand the spec.

It makes it easier to understand the spec,
especially if you don't dogenerics, which Yeah. Most of
the code, you're you're you willwrite is not generic. Right.
I've used generics.

Even with generics.

I like them.

But most

of the code I write is just like, you know, straight
up code. I wanna do some things.They don't wanna write generic
handlers or things like that.

Right, right. But even with the generic code, like
I still think it's easier to seea list of here's the four
special cases in thiscircumstance rather than refer
back to the concept of coretypes. We have to jump over
there and read up on core typesand try to figure out, okay, so
given that this is a core type,that means what in this
circumstance? That's confusing.Even if like in some sort of
abstract sense, it's general.

(09:55):
I think this is a goodimprovement. It doesn't actually
change the language. That's themore important thing to notice
here. This isn't actuallychanging the language. No
functionality is changing, nocapabilities or generics are
changing.
It's just how they describe thelanguage. The spec is changing
to be easier to understand. It'srefactoring I think that's
important.

An easy spec to understand and, know, simple
language is one of the, thingsthat differentiate Go from a lot
of languages that are verycomplicated or have a ton of
keywords.

That's right.

Yeah. I'm working, one of the languages we're
using, at the current place andalmost every place I've worked
at had some Python code. Youknow, there are so many weird
cases that, you know, you know,they're they're in Python, you
could do four else. Yeah. Youcould do it, but you don't have
to do it.
You can chain operators. Youhave advanced f string
formatting and now theyintroduce t formatting and like,

(10:46):
there's just so many options todo so many things. And it's just
nice to have one language say,hey, we introduced this thing.
It was too complicated. Let'ssimplify.

Yeah. Yeah.

It's pretty good.

I should also mention since I did mention my
daily list, I'm still doingthat. I'm not talking about the
spec right now. But if you'reinterested in some daily go
tips, hold to go.tech/daily andyou can subscribe.

Of course. You know, when you say you like go
through the entire spec and sortof reminds me, like of this,
some people in, some Jewishpeople, they do that with a
Bible. They would like startwould try to finish the bible in
a year. Mhmm.

Oh, I I know, Christian people do that too.
Yeah. And it's harder becausethey have a longer bible. Yeah.

Yeah. It's like a go to everything that didn't go
into the the Jewish, you know,the Jewish Bible. All right,
let's do the new one. File itunder go to issue.

I guess some people have tried to simplify
the Bible and, with mixedresults, right? One final blog
post I wanna mention, also

pretty simple, also pretty useful. We talked a lot
about the tool directive, thenew Go tool. Which is related to

the perfect circle directive, right?

I don't know. Just a very simple command. And the
problem is if you worked with Gofor a while, you know this pain
of having a tools.go file, whichis, oh, I need Golang cilint
installed, but I don't wannaforce like all my developers to
install it externally. And thenI in CI, I have to have a

(12:17):
command that's like install devtools or whatever. So linters
like Golang CI lint, codegenerators like mockery, open
API code gen, protobuf, allthese things, you have to
install manually.
And then the solution mostpeople found, which is not
great, is to do tools. Go. Justyou just add a file that imports
all these things, doesn't usethem, but then, you know, they

(12:39):
they end up in Go mod. So to fixthat, there's a go get minus
tool, which is very, verysimilar if you're coming from
Python or TypeScript to the orRust to like a dev dependency
sort of thing. It's exactly thesame concept.
And this blog post is, by AlexPliotow, I hope I'm saying that

(13:00):
correctly, is just the bestdocumentation I found for it.
It's very simple. Add a new toolto Go Mod, you run this command.
Once installed, you run it byrunning Go to whatever, then
it'll end up in your Go Mod.What's great about it, you can
pair it with Go generate and youcan put it in a separate Go.
Mod file. And the obviousquestion, wait, what if I have a

(13:22):
non Go tool that I want toinstall? For example, the
protobuf stuff that's notnecessarily Go, right? OpenAPI
generators, which tend to bemostly Java, although there is
openAPI dash cogen. So it's notsupported yet, and you'll have
to do something external likeyou used to do.
That's it. Very simple blog postbecause it's a very simple
feature. I just wanted to shoutout Alex for writing like

(13:44):
shortest and most simple blogpost about this feature.

Way to circumlocute.

Yeah. Sometimes the official docs can be a bit like
wordy and not actually tell youwhat you need to do. Like this
is pretty, pretty simple.

So we've made it through most of news. We're
gonna do a lightning round.We're gonna do a quick break,
and then we're gonna be backwith two more less newsy news
items to discuss. So don't goaway.

Lightning round.

First up on this week's lightning round, you may
remember, I think it was twoweeks ago, I brought up a blog
post about writing Go for thePlayStation two. If that was
just totally your bag and youwant more of it, there's a part
two out now. So go along on the

PlayStation Is it about writing for PlayStation
three?

You would think. No, I think this is 2.5. I don't
know how that works. But Ricardogoes into more details and more
things he's learned about readyto go for the PS two. I'm not
gonna go to the details becauseI know it's kind of a niche
thing.
That's why it's in the lightninground. Just wanted you to know
it's there so you can go find itin the show notes if you wanna
go read it.

My thing for the lightning round, if you
remember, we had, Bill Kennedyon the show.

Oh, yeah. I'm a partner.

Bill Kennedy (14:59):
I own a company called Arden Labs. We're
primarily a consulting shop. Wedo a lot of projects, and I
focus a lot on training,building a lot of training
material. I've written well overa hundred blogs. I've written
the books.
I'm really focused a lot todayon trying to teach software
design as opposed to

So I was pretty excited to see two days ago,
Ardan Labs, which is, Bill's,like, you know, technical
training provider, has official,certification exams for Go and
Rust. They're like a serioustraining organization. I would
trust their certificate as a asa hiring manager. I can say that
for sure. There's a wholeinteresting, like, side

(15:39):
discussion, which we won't gointo right now because this is
the lightning round aboutwhether certificates actually
mean anything or not or are theyuseful.
But in my opinion, it's a prettygood value. And it's cool that
the Aldan Labs not only providesthe training, but also, like,
certs. So if you're looking fora job right now and it's a
pretty brutal market, maybe itcan give you an advantage.

I haven't done the certifications.

I'm pretty sure I can do the Go one. I'm pretty
sure I can do the Rust one, atleast without not going through
their training. But if you wannaregister for it, just go to
aldanlabs.training. Really coolstuff. Happy to see it.

One last Lightning Round thing. It
actually fits the themeperfectly of Lightning Round
because their, their logo is alightning bolt. A former boss of
mine has started a new startupthat does logging and they have
an app called sparklogs.app.It's kind of like Papertrail or
Logs.io or whatever. But I justlearned recently it's written in
Go.
So I'm actually going to try toget him on the show for an

(16:34):
interview. Until then, there's alightning round mention. If
you're looking for a logsprovider that has a great free
plan, 25 gigabytes of ingestionper month, fourteen day
retention for free,sparkblogs.app, check it out.
And that's that.

Cool stuff.

Not sponsored by the way.

Yeah, just like friends, friends

of the Exactly.

All right, let's move to an ad break. There are
some interesting updates thereas well actually.

Jonathan, you mentioned at the start of the
show that the show is supportedby the listener.

Yes. What does that mean?

It means that our listeners are responsible for
the success of the show byword-of-mouth advertising for
us, by joining us in the Slackchannel where we talk about
things on the show, by sharingnews items with us, and of
course, if they want to, bysupporting us financially,
because this is not a freehobby.

Yeah. It's a pretty expensive hobby. We do it for
fun, but it's, pretty expensive.I wanna shout out, Moshe Viner,
who joined as a paying member.Thanks so much.
Thanks for joining our, crowd ofPatreons Patrons. If you wanna
reach us, you can find us atcupogo.dev, where you can find
any, like, anything and anyeverything about the show, like

(17:56):
our swag, which if I'm taking aquick tangent here, I'm at the
WeWork right now, and rightbefore the show started, I went
to get like a cup of coffee, andI have the Cup O Go hoodie on
because it's super nice and likewhite with the logo on it, which
is really good. I was like, hey,good morning to the, you know,
WeWork staff people, becausethey're really nice. And the guy

(18:18):
was like, oh my god, I like Ilove your sweater. And I was
just like, store.cupago.com.
I was just like so excited. AndI was so excited, I forgot we
didn't buy the Com, the .dev,you know, work for him. So I I
lost all the bravado of like, ohmy god, it's my brand. It's my I
was like, oops, I meant dot dev.So it's cupago.dev, where you

(18:40):
can find hoodies and shirts andcups that I can say from
firsthand experience, get yourandom compliments from people
at the office, even if theydon't know anything about Go.
You can talk to us at the Go forSlack, hashtag cup of go with
kebab case, or email us,news@cupofgo.dev, news at cup of

(19:00):
go dot dev. Well, I say emailus, it's just email you. Right?

Yeah. But I share it with you when it's not
obviously spam. I actually havea question for you about
SwagShai. We don't sell magnets,do we? No.
I want a magnet now. I want alittle Brewster magnet because I
have a new coffee cup, but it'sstainless steel and I wanna put
a a go a gopher magnet on it.

I will take a look into it.

Because I don't think we're gonna sell these
because these are a hundred and$50 a pop.

I don't think I'm gonna buy them. Why do you need

a hundred and 50? It's it's a self heating battery
powered mug.

Just drink your Some things were fine a hundred
years ago, like like mugs. Mycold coffee. Lead paint? Sounds
good. You know what's the lastmug I bought?
I went to Goodwill because Ijust moved, and I bought, like,
six different mugs,

$10. Pretty good.

Awesome. One of them is, like, best grandma
ever. I don't know who but itwas, like, 50¢, and it's really
good. Anyway, we might domagnets. But all the rest of the
swag and our Patreon links, pastepisode transcribes, all on
cupugo.dev.
If you wanna support the show,not financially, you can leave a
review or share it with, youknow, people, you think would

(20:15):
find the show interesting.Wherever you listen to your
podcast, Spotify, Apple Podcast,Overcast, whatever, these
ratings help us just get to newpeople organically. We don't pay
to advertise or push this showat all. So it's just y'all
sharing it with other people.Other than, you know, the normal
ad boilerplate and Jonathanadvocating for adding Magnus to

(20:38):
the swipe store.
The San Francisco meetup ishappening and it's sponsored,
which is freaking

That's awesome. Yes. Yes.

It was approved just like this morning, so I'm
super excited about it. Yes.It's gonna be in San Francisco.
It's gonna be, by Elastic,sponsored by Elastic, which is
very, exciting. I really wannasay a lot of thanks to Shauna
Kashyap, I hope I'm saying thatcorrectly, for reaching out and
like making this happen.

(21:09):
You rock. And yeah, there'sgonna be a real capital, M
meetup for the Go community inSan Francisco in May 27. Note
that it's moved to twentyseventh. It's not on the twenty
eighth. I'm gonna put the linkin the show notes.
I'm arranging it, so pleasecome. So, you know, it won't be
awkward. And there are somepeople who are interested in

(21:32):
giving talks already, but I'msure we can shift the schedule
to fit all of you. So if youhave talk ideas, please hand
them in. And we're gonna do alive episode recording, so
Jonathan, make sure you clearyour schedule as well.

Oh, yeah.

It's gonna be super great. I'm very excited about
it. Very cool. Yes. Alright.
Let's dive into these, non newsnews, sort of thing. What do you
say?

Let's do it. Yes. All right, Shy, I want to share
some non news news with you.

My grandma always used to say, no news, good news.

Oh, there we go. So this must be some good news
then. Because it's no news. Iskind of news. So Gorm has a new
release, version 1.26.0.
What is Gorm? I'm curious howthat makes you feel.

It makes me feel indifferent because I don't use
ORMs, but it also makes me feelsuspicious that this release is
like a hundred bullet pointrelease. Because why are so many
people still working with ORMsin 2025?

I see.

That's that's where I'm at right now.

Oh, alright.

Yeah. But I just before before we dive into the
actual details of the release, Ilooked I just, like, randomly
saw update copyright as one ofthe bullet points. I was like,
oh, that's funny. Someoneforgot, like, there's a chore
update from, 2024 to 2025. Iopened the change itself.
The change itself is changinglike the year from like 2013

(22:59):
until now to 2013 until present.

What? What?

So so I don't know.

Don't That's ridiculous. I don't

know who's gaining from that, but that's just
funny.

Yeah. I don't

I got Maybe some legalese that you wrote now at
this time of the commit versuslike, I don't know, whatever. So
what is Gorm?

So Gorm, it is it's the name of an alien
species from Star Trek, isn'tit? It sounds like what it
should be. It claims to be afull featured ORM. ORM being an
object relationship managerlibrary, I guess. Have to be All
cards on the table, I don't likeORMs either.

(23:42):
So if you're an ORM fanatic andyou don't like hearing people
complain about them, stoplistening now. So I'm skeptical
of the claim that it's a fullfeatured ORM for the very simple
reason that no ORM ever has allthe features. That's kind of the
nature of an ORM is they'realways trying to add new
features and new ways to dodifferent joins and different
things and so on and so forth.So much so that way back in

(24:02):
02/2006, Ted Neuer wrote apopular, I would call it a blog
post, but it's more like athesis, it's pretty long, called
The Vietnam of Computer Science.And he likens ORMs to the
Vietnam War, which is basicallythe analogy being that The US at
least in the Vietnam War didn'treally have a specific goal in
mind.
So they just kept like had thishuge scope creep throughout the

(24:24):
entire campaign. And that's howORMs tend to work, is they're
always there's there's no boundsto what they're trying to
accomplish.

Generally, when you talk about these, one thing that
pops up is like the impotencemismatch, right? Just the
difficulties between working ina relational data store and the
data in a domain driven objectmodel. There is it's funny that
we're talking about it herebecause there's recently been a
Twitter you're not on Twitteranymore, right? X? No.
So there's recently been an XCarfuffle where uncle Bob, the

(24:56):
clean code guy was like, SQL wasa mistake. SQL sucks.

I suck.

You shouldn't use SQL. You should use an API
instead, which is definitely avery hot take. But my I share
your, like, disdain of ORMs. I'mI'm coming from a, like, pretty
diverse background of I used,the most full featured ORM kind
of thing I think that exists,which is Django in Python. Mhmm.

(25:22):
Which is like everything isaround the what you're not a,
like a code you're not a Pythondeveloper. You're a Django
developer. You're doingeverything with the ORM and the
web server and the plugins andwhatever.

Mhmm.

And I've done pretty lightweight ORM work with
a bun in Go. Have you used thebun for I

have not used it, but I've I've heard people, say
they like it. I I didn't

use lightweight ORM. So it's not trying to do
actual, like, a lot of ORMstuff. It's SQL first, but it is
in Go. So you do like dot withdot column expression dot where
dot select, like these sorts ofthings. And it generates pretty
much the same SQL you wouldimagine it does.

(26:06):
It doesn't do anything like veryspecial. It does have migrations
built in and things like that,which is pretty fun. And I've
used what I'm using right rightlike right now. And I've used
MongoDB like in Python, whichwas a whole nightmare. I've come
to the realization after allthis time, like in my startup
right now, we're doing SQL.

(26:26):
We're writing SQL code and we'regenerating the types in the
language from it. We're notwriting anything in the database
in code. We're writingeverything in SQL, in dot SQL
files. You know what I mean?Like, purists about it.
And Are are you writing a shortprocedure,

you you Or or you're like doing like a It's
now It's

a cool C type of thing, If a if you need a
complex query with a join and awhatever, you write a view. And
then in the code, you just likeuse that, you select from that
view.

Okay.

You wanna add a column? Change the view. Touch,
like, when you do a select, youcan pass, where x, y, zed. You
don't write some ORM, whatever,you pass an object into it. You
just pass this column.
These are the values into yourselect query. But like most of
the work with the database we dois just using raw SQL. All this

(27:25):
tangent, just to say that I amvery happy not using an ORM.
Yeah. After, you know, all thesesorts of different experiences,
I'm trying to understand what'sthe use case, like what am I
missing that people are stillworking on GRM so much and this
new release has so much workinto it, so many different

(27:48):
contributors, just a ton ofwork.
It's like a huge chunk of work.People are working on it a lot.
Now I know I made like, I madefun of the stupid change the
year pull request, but there aresome real pull requests here,
like refactoring the callbacksfor creating and deleting and
preloading, and like there'sreal Go work here, it's a ton of

(28:11):
Go It's like a huge library.What am I missing? Like, why
what am I missing?
That's what I'm trying tounderstand.

You'll probably get a better answer from
somebody who actually uses

I'm trying to get you to play like a devil's
advocate.

But if I'm gonna play devil's advocate, yeah, my
I guess, I would say I can onlythink of one legitimate case
that at least matters to me forORMs. And it's only mattered to
one company that I'll never workfor again. And that is if you
are in a company where you needto partition databases, an ORM

(28:48):
can do that transparently, in away that's invisible to your
application layer. Because youcan tell it that this table's on
this database and this tablehooks database and do the in
memory join or whatever likethat, right? If you haven't a
sophisticated enough ORM.
Of course, that's such a nicheuse case. It doesn't really
apply. I guess I'll go back towhat most people say. I think
they're wrong when they saythis, but most people say that

(29:10):
they pose a dichotomy between,and you almost did this kind of,
it's the opposite dichotomybetween writing raw SQL and
using an ORM. A lot of peoplesay There are lot of

layers in between where you

can have a lightweight ORM,

you can have something like connects, like
writing queries, a query writerthat's in code, defining your
tables in SQL, like you couldhave a lot of different options.

Right. So if you're looking at it just at
that level, most of the timeit's not difficult to write SQL
unless you don't know SQL atall. But I would argue that if
you don't know SQL at all, ifyou can't write a select in SQL,
you need to learn that. It's nothard. And you're going to have a
really hard time using your ORMcorrectly if you don't
understand the foundationalknowledge anyway.

(29:56):
So at that level, my hot takeversion is that ORMs make easy
code easy and they makedifficult things impossible.

That's a really good way to put that.

Select star is already super easy. It's a tiny
bit easier maybe with an ORM.It's not enough easier to be
worth the overhead. But if youhave something complicated like
a six way join or you're usingwindow functions or whatever,
you kind of have to fall back toraw SQL anyway. So an ORM isn't
a benefit there either.
But the reason I think peopleare wrong with that is because

(30:26):
that doesn't really address theproblem of ORMs, which isn't
about writing SQL or not.Because as you just mentioned,
there's other ways you can avoidwriting SQL. You can have query
builders. I have no problemusing query builders to simplify
writing monotonous dynamicinserts or updates or whatever.
I'm happy to use a querybuilder.

(30:48):
So I think it's more about thatimpugnance mismatch you
mentioned that a lot of peopleuse ORMs to fetch relational
data into objects and then turnit into a table to display on a
web page. That is silly becauseyou're taking relational data
converting to objects andconverting it back to relational
data. Why don't you just dorelational to relational? Or

(31:11):
using an ORM to select to do astatistical analysis. If you're
trying to get averages or sums,you don't need an object there
either.
So I like to look at the corewords, ORM. And there certainly
are cases where I need to takemy relational data and turn it
into objects. But I prefer to dothat with custom code rather
than with a general purposelibrary that's never the right

(31:33):
shape for what I need.

And I'll just add one thing. Looking at the issues
fixed in this release, this is abig library, like a a huge chunk
of code. And, picking one atrandom. Fix race issue and
prepare method. This is by xi useven.
They fixed, like although thisis not really fair because it

(31:57):
seems like this is from 2021.This release is kind of weird.
Like the release notes includeevery single commit that's ever
been. Maybe, you know, theysomething's wrong in their like
release notes process orsomething.

Yeah. Let me address that. I think what's
been happening is for the lastfour years, they've been
creating tags without creatingGitHub releases. So the last
GitHub release was about fouryears ago. I think this includes
all of the changes that havehappened since then, even though
many of these were included inmore recent tags.

The I'll just say, like, they're the the fix race
conditions in the library whereif you just wrote it yourself,
you probably wouldn't have. Ihad the chance you would love
this document. I I wish I couldshare it with you, but that's
internal. We did, like, a bakeoff internally when we just
started the the code base, likejust a few months ago, right? I

(32:46):
had to do a bake off between allthe different ORM options and
and levels and layers, not forGo, unfortunately, for
TypeScript.
But it's actually exactly thesame. Like, doesn't matter. The
only problem is that withTypeScript, people are even less
like into simplicity. Like inGo, at least you know the people
you're talking to usually areinto simplicity. With

(33:09):
TypeScript, this is not thecase.
They like their frameworks andtheir new whatevers. And, you
know, there are there are otherfactors to consider as well.
Like you might find a verysimple lightweight ORM, but it
doesn't have a lot of supportand a lot of community behind
it. That's a problem. And theGo, like Gorm clearly has a huge
community of people you can talkto.

(33:30):
So if that's a thing you careabout, that's a benefit. Because
there aren't really SQLcommunities in that sense, you
know what I mean? But I, youknow, I did this entire bake off
between, Prisma, PGType CLI,TypeORM, MicroORM, SQLize,
Kinex, Kisly, Mammoth, KISS ORM,Slonic, Objection JS, like all

(33:52):
the options, literally all ofthem. And the leading option was
writing everything in SQL, andthen using a SQL to TypeScript
generator, which we ended uplanding on Zapatos, which is a
tiny passion project by thislike one guy that does this one
simple thing for us. And, yeah,it's been working super well.
So that's the ORM, discussion.Overall, we we and, what's the

(34:17):
guy's name who did, who inventedClojure? Rich. Rich Hickey. Rich
Hickey also says, don't, dothat.
And by the way, just to, clearup the Twitter thing, I think I
think, uncle Bob also says don'tuse ORMs because they use SQL
under the hood. He's like, talkto a DB that has a proper API,

(34:38):
like Datomic or whatever, butthat's like super niche,
whatever.

Don't know.

Most of us just wanna store stuff

in You have something you might have a point
there, but I'd have to mull onthat for a while. I'd have to
try that API for a while and seeif I agree.

Of Datomic?

Of whatever database we're talking about.
And until the Postgres API givesme the flexibility to do what I
need, I probably don't care.

I think because so many people use Postgres via
SQL, at this point, you know,it's like I think it's called
Hiram's Law. Yeah. It's thatthat's the observable behavior
of the system. There are so manypeople behind it. That's the
contract

right now. You know what I mean? At least
that's how I feeling about it.Yeah. But but maybe in
principle, he he's ontosomething.
I don't know. And maybe not. I Idon't always agree with Bob.
Sometimes I do, sometimes Idon't. So I don't just take his
word for everything.

Similar in the sense that you like to argue
with very, very hot takes that,like, break things that
everybody assumes are correct.But, yeah, it's generally,
there's a new release of Go,GORM. If that excites you, see
see us after class because we weneed to figure out why. And this
is not really news news.

It's because if somebody if somebody really is
excited about that, I wouldn'tmind having them on the show to
talk about and try to understandtheir

view. Yeah. Yeah. I legitimately,

if you wanna talk about that. Gore or if you're
one

of the real maintainers, I don't know if
it's like a a specific bigmaintainer behind this project
or something. That'd be cool.Alright.

We have one of the one of the topic, to discuss
before we call it a show, andI'm gonna let you introduce It's

not news news, but I really wanted to shout out the
cheating the reaper in Go blogpost, by MC Young, Miguel. He
published, this blog post justlike a couple of weeks ago, so
it might be actual news news.But you know how a blog post at
the top has, like, number ofwords and how long it takes to

(36:35):
read and,

like Mhmm. Tags?

This one is, thirty five minutes. Hashtag dark arts,
hashtag pointers, hashtag go.It's a very, very, low level
blog post.

And I've never seen this in a blog before, but
you don't what do they call thatfeature where in your IDE on the
right hand side or left handside, you can see like your
entire file and where you'rewhere you are scrolling in it.
You know what I mean?

Yeah. Yeah. I don't know what it's called from a UX
perspective, but yeah, he hasthat on his blog, which is very
cool.

It's cool. And I have to say it looks cool. Like
visually it's cool, also silly,but whatever. Continue. I'm
distracting.

No. The the first of all, the blog is nice. Like
the the titles are nice and theunderline like, it's definitely
someone cared about this blogquite a lot. The blog post
itself, I want to bring it upbecause the blog post is really
about writing super highperformance Go code to build an

(37:38):
untyped garbage collected arenaabstraction in Go. So it relies
on how the garbage collectorworks and you build a Go arena.
And because Miguel hasexperience in C plus plus and
Rust, there's a lot of like, oh,in Rust and C plus plus I
wouldn't be able to do it. Andthe compiler will like break me.
But in Go, I like I can do itbecause we, use unsafe. Also

(38:04):
that blog post is, named reallywell, like cheating the reaper
in Go, I love that. I try to sitdown and like slowly read
through it line by line and Ithink at the end I understood
it.
That was like a week ago, I'mopening it up back again. It's
fuzzy because it's like superlower level stuff I don't tend
to work with. What I'm wonderingand what I wanted to bring up

(38:29):
with you is, in my sense, thisdemonstrates like really high
level really like high level notin the sense of high level
language, high level in thesense of high expertise,
understanding of the language,and computer science, like, in
general. Being able to, like,implement this stuff and look at

(38:51):
the performance and do moreoptimizations and things like
that. On the other hand, Ireally don't remember when was
the last time I needed, to lookat assembler code and like try
to optimize it where I didn'tjust say, all right, I'll write
this specific part in in Rustand, like, you know, call it
from whatever language I'mactually using.

(39:12):
Have you seen, like, any casewhere obsessing about the super,
super low level performance ofGo code has been worth it, like,
the last few years since Rustbecame more serious and would
put it in production?

I would never needed that. The last time I did
that sort of thing was when Iwas using Perl and working with
C bindings to improveperformance, which ultimately
led me to learning Go so Iwouldn't have to do that.

Never again, you're saying?

So no, I've never had to do that. Mean, I can
certainly imagine cases. I'm nottrying to say that it's not
legitimate. Just haven't neededthat.

There's a whole movement right now of people,
you know, mostly like on YouTubeand things like that. But I I I
feel it as well that saysoftware is getting super slow
and annoying and that we needmore people like that to obsess
about performance. How wouldyou, you know, other than

(40:06):
letting people on the that arelistening right now, like, let
them know about this blog postand go read it and you wanna be
as good or whatever.

There isn't a lot of like, it seems like a lot of

the times in Go, you're like, oh, don't worry
about the pointers too much.It's pretty much Python, but
just fast. Right? That's likehow people try to market it at
least. How can we get moreperformance obsessive generally?


Like the previous topic we discussed about was
GORM, which is exactly theopposite. Right? Like, oh, I'll
just use an ORM. I don't careabout the what the underlying
SQL is generated. And here inthis blog post, the guy's
literally well, the personliterally going into, all right,
let's see the assembly that Gohas generated for this function

(40:52):
to like understand how we canoptimize it even more.
Oh, move q ax to zero at r 11.


How can you get more of that?

So I don't know how. I actually would question
the premise of the question anddo we do any more of that? I
think too many people areobsessed with premature
optimization.

Don't you think overall software has, become
much slower? Like, you openthings and they just, like, chug
along, everything's slow,

everything's I use Linux, everything's fast,
man.

Yeah. I I I installed my audio drivers every
day and it's super fast. No.Just kidding.

I mean, so I'm I'm sure there's a there's truth
to that to an extent, largelybecause hardware is much faster
now, it's no longer necessary tosqueeze performance out of
everything. So we kind of getlazy in that regard. So yeah, I
mean, a sense, sure, there's alot of room for improvement and
it matters in certain apps morethan others. On the other hand,

(41:49):
I mean, could point to a hundredtimes when people have been
trying to optimize performancefor things that literally don't
matter at all. And I can thinkof very few times where the
opposite was true, or theyshould have focused on
performance and they didn't.
So I suppose if I'm going tooffer some sort of blanket
advice, it would be benchmarkfirst and then optimize where

(42:11):
the benchmark shows you have aproblem instead of just
guessing. That would kind ofsolve both, or at least
contribute to solving bothproblems. The people would stop
trying to optimize things thatdon't matter and then focus on
the their efforts on things thatdo. But I don't think I'm really
answering your question becauseI I maybe I don't quite see the
same problem. I I understandwhat you're saying.

The it's not about I think it's it's like you can
tell people people, hey,benchmark first and don't focus
on the wrong thing. What I'msaying is people are not excited
to do that stuff generally. Theythey would like wait until the
software is so slow, it'sunusable instead of like

(42:50):
obsessing about its performance.And I like pieces of software
where people obsessed about theperformance. I recently switched
to using well, never mind.
Some software, I don't wannasound sponsored, where it's
really fast compared to theprevious, like, competitor that
I worked with, which was reallyslow. For something I do every
day, I've just been more happyas a user to to feel that.

(43:12):
Anyway, going back to the to theblog post, not the philosophical
stuff. Altogether, what, Miguelimplemented here is a package
called Arena, where you canallocate, memory very fast, and
reallocate. And it's a it's awhole lot of like take the

(43:32):
minimum allocation size versusthe cap, move the chunk,
increment the pointer, you know,initialize the pools, like it's
very, very low level stuff, verycool, where you can allocate
chunks of words, and you have init and you have finalized to to
make that all happen.
At the end, you have a veryefficient like memory arena that

(43:58):
you can do. And it doesn't havea lot of unsafe code. Like
overall, it does look kind offunky with a lot of

That feels a little bit like saying, well,
airplane has most of its wings.Yeah. That doesn't just doesn't
have

the left phalange, it's fine. I would definitely
recommend. I enjoyed reading itlast week, top to bottom. I do
know assembly, I do know c plusplus so maybe that's why I was
able to follow through theentire thing, but I would highly
recommend reading it. It'sreally well written, a lot of
code, and yeah, really, reallygood stuff, Miguel.
I I liked it a lot. Cool, coolstuff. And like I always do,

(44:36):
there are more, blog posts in,Miguel's, like, backlog about
protobuf, which is also cool.So, you know, go ahead and read
more of his things.

Yeah. Great blog. Thanks, Miguel, for sharing with
the community. Alright.

I think that that's a show.

I think that's it. We'll, see you all next
week.

Program exited. Program exited. Goodbye.

All Episodes

Episode Transcript

Popular Podcasts

Stuff You Should Know

Dateline NBC

On Purpose with Jay Shetty

.css-15opob5{left:0;position:absolute;top:0.8rem;} All Episodes

.css-14f5ked{margin:0;word-break:break-word;display:-webkit-box;-webkit-box-orient:vertical;box-orient:vertical;-webkit-line-clamp:2;overflow:hidden;}🎉 Surprise! 😯 A new security release is coming!