December 13, 2024 • 28 mins
- golang.org/x/crypto security update
- Go 1.24 draft release notes
- Blog: What's missing from Golang Generics? by Nick Tobey
- Lightning Round
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Jonathan Hall (00:00):
This show is supported by you. Stick around
till after the news to learnmore about that. This is Cup of
Go for Friday, December 13. Keepup to date with the important
happenings in the Go communityin about 15 minutes per week.
(00:21):
I'm Jonathan Hall.
Shay Nehmad (00:22):
And I'm Shay Nehmad. Hey, Jonathan.
Jonathan Hall (00:25):
Yes, Shay.
Shay Nehmad (00:26):
How do you scare a developer?
Jonathan Hall (00:29):
I'm gonna say something about Windows, but I
don't know. Leave the windowsopen.
Shay Nehmad (00:34):
My other car is a CDR.
Jonathan Hall (00:36):
No problem.
Shay Nehmad (00:38):
Hello, everybody. It is Friday 13th. We hope
you're, all spooked up.Actually, that that's a good
question. What's your, most,like, the scariest movie you
like?
Or I guess the horror movie youlike the most?
Jonathan Hall (00:52):
I don't I don't like horror movies, honestly.
There's a few that kinda countas horror that I guess I like. I
I guess I'll say the 28 DaysLater series because I the 20
year 8 years is about to comeout. I just watched the preview
for that. I'm kinda interestedin that one.
I I I guess that counts ashorror.
Shay Nehmad (01:07):
I'm down to clown with, some horror movies. The
Shining. That's a good one.
Jonathan Hall (01:11):
That's a good one. Yeah. Yeah. That's a good
one.
Shay Nehmad (01:12):
But nothing as scary as looking at my Jira
backlog. So let's look atsomething else and talk about,
Go. But we do have somethingscary to talk about. Security
vulnerabilities in the cryptolanguage. And then again,
security vulnerabilities in thecrypto package.
Before we jump into that, I justwanna give the rundown of what
we're gonna talk about thisweek. So the security
(01:32):
vulnerability as mentioned,we're gonna start talking about
the 124 draft release notes as124 is set to come out around
February ish. Oh, Valentine'sDay. We always have that, bet.
Jonathan Hall (01:45):
It's always it could be Valentine's Day, but it
won't be.
Shay Nehmad (01:47):
Yeah. So we're gonna start going through the
draft release notes so you know,what's definitely there. Then we
have 2, blog posts to talkabout, 1 from Dolthub and 1 from
Victoria metrics, and oneTwitter thing to go through
about a new observabilitylibrary. And a whole bunch of
things in the lightning round.We have a lot of things to talk
about.
(02:08):
Our backlog is only growing,just like my real one. So let's
talk about, some Go, shall we?
Jonathan Hall (02:14):
Yes. Let's see a security. So I saw that, XCrypto
was updated, but, did you diveinto it to understand why?
Shay Nehmad (02:21):
Yes. Let me ask you. Assuming I'm not shy, would
you let me come on the show?
Jonathan Hall (02:27):
Maybe.
Shay Nehmad (02:28):
Assuming I am shy, would you let me come on the
show? Yes. Alright. Can I comeon the show? Yes.
So if you were to base your,answer on the first question,
you would say no. Right?
Jonathan Hall (02:40):
I might say no. Yeah. It depends on who you
like, yeah. So Shai is permittedto go on the show. Other people
some other people are and somearen't.
Shay Nehmad (02:46):
Basically, everybody's permitted. We're
pretty we're
Jonathan Hall (02:48):
pretty sure. Much.
Shay Nehmad (02:49):
Yeah. It's the other way around. People just
don't wanna come. Anyway, thething is there's an SSH,
callback called public key,callback, which you can
configure in your server. Andthe server can, get some
questions about some keys likekey a and key b.
Now, I don't necessarily controlthese keys, but when I do a
(03:13):
actual request, you mightaccidentally, just because of
the way it was set up, I cancall public key callback twice.
1st with a key I don't own andthen with a key I do. And a
vulnerable application make anassumption that I control key a
or control key b, and then makeauthorization decisions based on
(03:33):
key b where I don't control thatkey. I don't control the private
key. This API is widely misused.
Like, people just don't get it,and I don't blame them. It's
very confusing. So this API isreally misused all over the
place. So as a partialmitigation, you this change
enforces that the last key,passed to this function will be
(03:56):
the key that's used toauthenticate the connection. So
you can't do the thing where youask with one key and then use
another one.
Okay. You just have to, use thelast one. And if you want to do
multiple collections, you haveto, call it multiple times with
the same key if, like, if it'snecessary. Like, the the client
(04:16):
still may not control theoriginal key. You're just not
gonna make that, like, mistake,anymore as the server.
Okay. So it's a pretty, coolvulnerability, I think. It's
very logical. It's very nottechnical in a sense Uh-huh.
Which I like.
Feels very human. And just shoutout to Damien, Turnout, Patrick
(04:36):
Dawkins, Vince Parker, andJulius de Vivier from
platform.sh and UpSunengineering teams, for reporting
this CVE. I think, like, gettinga CVE on your on your belt is a
pretty major achievement formost security researchers. Sure.
And it's very cool.
And it's so cool, I actuallywent to their site, and their
(04:57):
site looks pretty cool as well.Like, platform built to Sage
looks like a pretty awesomeservice, like, platform as a
service kinda thing. They're notsponsored. I'm just like, they
found the vulnerability in go.They get a shout out.
Cool. Cool work, guys. Soobviously, if you do have SSH in
your server, upgrade basically,make sure you don't misuse this,
(05:17):
function. The problem is youmight import something that does
this for you and you're notreally aware. That's I think the
main thing you have to worryabout.
So I would, like, go, run govoln check and just make sure
that you're you're not havingany issues.
Jonathan Hall (05:31):
Well, I'll be honest. When I saw that there
was an update to that packagebefore I go and think about it,
I updated it because I feel likeanything in xcrypto, if there's
an update, I probably want it.For
Shay Nehmad (05:39):
sure. We had a a talk about, like, a Slack
conversation about the Voncheck-in our Mhmm. Slack channel
recently. That was prettyinteresting. Like, how people
approach running Von check.
Right?
Jonathan Hall (05:51):
Yeah. It's a it's a good question. Like, do you
run it for every pull request?That was kind of the topic. You
run it for every pull requestand it's a it blocks merges if
there's a break, or do you runit once a night, or, yeah,
different ways to do that fordifferent projects.
Shay Nehmad (06:04):
So so some people say it's it blocks the word on
every feature branch and sobasically the first person who
sees that needs to make a fixedbranch first and the the fact
that this workflow, which Ithink is literally the most
severe workflow you could have,Right? The the person was like,
yeah, this works really wellcompared to Node. Js where Yeah.
(06:25):
Yeah. So even the strictestpossible workflow is, pretty
good.
I don't think it's necessaryjust in terms of, like, if there
is a critical criticalvulnerability, you're gonna hear
about it in the news. Right?You're gonna notice you're gonna
hear it on this show and theworld isn't that fast to react.
Like, all I'm saying is if yourvulnerability program is
(06:47):
actually as good enough as yourcomply, like, compliance
requirements, like yourregulator is asking you to do,
you're probably overachievingcompared to the rest of the
software in the world. But I Iwouldn't do it.
Stop the world. Like, it's justcognitive load or, like, you're
taking people out of flow state.I don't like it. Oleg from the
channel, Oleg Kovalov suggestedto just do it a cron job on on a
(07:09):
weekly. Just, like, fix it andping everybody to rebates, which
I think is a lot morereasonable.
But it's GoVonczyk, very cool,and crypto, very scary.
Jonathan Hall (07:20):
Shadi, did you leave a window open or
something? Is there a draft inhere? Oh, I
Shay Nehmad (07:24):
don't know. Why are you are you hearing something?
Are you seeing something?
Jonathan Hall (07:28):
Oh, oh, oh, here it is. It's the Go 1.24 draft.
And that's our segue, folks.Sorry for the bad jokes. That
part probably.
Shay Nehmad (07:40):
Hashtag sorry, not sorry.
Jonathan Hall (07:42):
Yeah. Exactly. So we're not gonna talk about the
entire draft today of the 124release notes because that would
take too long. We're alreadygonna be over our 15 minutes.
But we're gonna talk about acouple of the highlights.
So so first up, I'm I'm excitedabout this feature. We get the
new, to I don't know how to callit. I would say tool, but, you
(08:02):
know, it's a tool that's calledtool. Mhmm. So you you know how
shy sometimes you, maybe you'reusing a code generator.
Maybe you're building mocks oryou're using SQL c or something
like that that generates code.And it's it's how do you track
that in git so that you alwaysbuild against the correct
version?
Shay Nehmad (08:22):
So you have to create a file. I think it's
called tools dot go, and thenyou import it, but you don't
actually use it. And theneverybody who's new to the
project is confused. And thensomeone deletes the file
because, like, oh, there'snothing here. Like, someone
meant to do it, but they forgot.
And then nothing works for awhile until they figure it out,
then you revert it. Fun times.
Jonathan Hall (08:40):
Yeah. So you yeah. Basically, just like like
you said, you create thistypically called tool dot go or
something like that or tools dotgo that, imports the things you
want, but it's never compiled.So that way, it kind of fools go
mod into importing the correctversion and tagging them and go
to mod and go to some. Well, nowwe're gonna have 1st class
support for doing that correctlywith, tools.
(09:02):
So you can use Go tool, and, Iguess you use it kinda like you
do with, Go mod, but you ratherthan it being a mod that's
compiled, you're just saying,this is a tool I use in this
project. Please track it for meand use this specific version of
it.
Shay Nehmad (09:15):
And the the thing is this is something that other
languages have had for a while.Right? When you work in in
Python or Node. Js or Rust, youhave like dev dependencies. It
always felt really missing atleast for me, Ingo.
Like I I've if you remember, weinterviewed the author of a go
test sum. I think it was one ofour first interviews, like,
(09:37):
ever.
Jonathan Hall (09:37):
Mhmm.
Shay Nehmad (09:38):
And I really like this tool, but I can't, like,
justify putting it in Go tools.That feels really bad, like,
setting up a tools fight justfor a test output. But now that
it's gonna be in the Go mod in,like, a sane place where you
it's where you put thedependencies, I think I'll
switch to using it, like, fulltime. Same thing with Golang CI
Lint. Right?
(09:58):
All these tools that you expectto be installed. I just expect
them to be installed by default.
Jonathan Hall (10:04):
Right. Yeah. I think this will help with a
whole bunch of stuff. I'm reallylooking forward to to using it
and Ergonomics. Yeah.
It'll be great.
Shay Nehmad (10:11):
The second feature we wanted to highlight, from go
124, is about, like, generics,but it's actually about
refactoring. So here's thehere's the use case. Right?
Let's say you have an oldpackage. Right?
And you wanna move to the newpackage which is, better. Right?
Like Barney said from, How HowMet Your Mother. New is always
(10:34):
better. But I'm gonna give you 4words to live by.
New is always better. That's therule. Right? So way back in go
19, there have been type aliaseswhere you could say type, let's
say, x equals to some other typetype y. This is usually a useful
(10:57):
feature when you wanna takesomething that's untyped, that
something that has like a basictype that looks pretty
complicated like a map from athing to another thing.
Just wanna give it a clear name.So I I've always found it useful
for that.
Jonathan Hall (11:12):
Yeah.
Shay Nehmad (11:12):
But it's just a name for an existing type.
Right? You didn't create a newtype. Just gave a name to, to a
new name to an existing type.Mhmm.
Now if you have an old packageand a new package that makes it
really useful if you wannamigrate from an old package to a
new package, you can have thesame name for both. Right? By
(11:33):
type aliasing them and yougradually update the use of the
old package user to the newpackage type just throughout
your project and the compiler ishappy because it's the same
name. You just change theimport. The problem is 118
introduced generics and youcouldn't do that.
Like if you had a generic typein an old package, you couldn't
alias it with the new type andnow you can. It looks really
(11:56):
really reasonable type your newtype name and then square
brackets t any equals to the oldtype and parens t which
basically stands for hey, I'mlacing a new type it can be
anything but it's actually theold type with its type
constraints that are alreadydefined so it's not actually
(12:18):
anything. So you have full typecompatibility when moving like
generic types and you canactually have this already with
the go experiments so if anybodylike really really really wants
to use it you know, like RobertGriesemer, the the person who
told us about this in the blogpost, they can already turn this
on with, experiment flag and nowit's just gonna become the
(12:38):
default because I guess it'sstable enough and they didn't
find any bugs.
Jonathan Hall (12:41):
Mhmm.
Shay Nehmad (12:42):
The the main reason I'm excited about this is it's
an improvement to generics thatdoesn't introduce more features.
It just makes it more ergonomic.So it doesn't make the language
more complicated which I thinkis a good thing. And everybody
agrees on the Internet andnobody has a different opinion
about Go, right?
Jonathan Hall (12:57):
Yeah. Everybody thinks generics are perfect. Oh,
wait. I found this one guy whodisagrees.
Shay Nehmad (13:01):
This one guy.
Jonathan Hall (13:03):
What's one guy?
Shay Nehmad (13:04):
One guy in every single Java developer in the
world, they disagree.
Jonathan Hall (13:09):
Yeah. And so Nick Tubby wrote a a post a while
back back in November aboutgenerics and some of his
challenges with them and gotsome feedback on Reddit and
other places about that. And sothis is kind of a follow-up to
that. Tldr, the old his old postoverlooked some of the features
in Go. He gave a couple examplesof some comments he got on about
(13:31):
his old post.
The one he said that stung themost was, this code looks like
Java. I'm sure we've allexperienced that before if
you've we need to go for anyother time. We run into this
code that looks like Javawritten and go or PHP written
and go or Ruby written and go,etcetera. Anyway, so he writes
this. It's a fairly long postactually.
Shay Nehmad (13:47):
Very detailed, very detailed.
Jonathan Hall (13:49):
Yeah. Yeah. Kudos to him for being detailed and
not just hot taking and andtrying to throw crap. He's
trying to be detailed here.
Shay Nehmad (13:57):
I think the the main thing is about having more
features with generics thatother languages tend to have
that that allow you to do morecomplicated things with generic.
Jonathan Hall (14:08):
Yes. And he also makes the point that he
appreciates the Go team'sreluctance to add new features,
which I completely agree with.On the other hand, you know,
there there has to be a tradeoff. Right? And I think that's
kind of the whole point of thisarticle is is we had to find
balance between adding featurestoo quickly and making the
language bloated and confusingand adding them too slowly and
(14:29):
sort of we're working with ourhands tied behind our back,
while we try to work around thelanguage's limitations.
And clearly, Nick feels thatthose too much on the hand side
behind your backside of thespectrum. I'm not sure I agree,
although I definitely canidentify with some of his
frustrations. There are I havedefinitely found places where
generics, in particular, havefelt too limiting. But I'm not
(14:50):
sure that the solution is tojust add more features because I
don't want Go to become Java orPHP.
Shay Nehmad (14:58):
There are a few things like self referential
type aliases and parameterizedtype aliases, which funnily
enough, you know, the lastfeature we discussed from the
124 blog is in that sameneighborhood, but it's
definitely not the same scale.These are like huge Ferraris in
the driveway whereas the typealiases, 124 supports generics
(15:20):
of theft. It's like a cart thatyou can pull by hand. It's
definitely not the same scale ofcomplexity when you think about
it. Yeah.
The thing that first of all, Ilove this, blog post. Shout out,
Nick. Like, thinking about alanguage that deeply and, like,
saying actually listing featuresyou would want and giving
examples, Super cool. Theproblem I have with it is that
(15:40):
the whole focus of the articleis about the code. Writing clean
code and the act of coding, andnot the act of reading the code.
It's like, how can I code golfthis and make this as concise
and as quote unquote clean,which I found as as years go by
as an excuse to, like, the way Ilike it versus, anything else?
Jonathan Hall (16:03):
Mhmm.
Shay Nehmad (16:04):
And nothing about how this will impact the
artifact in production. Like,will this make compiling slower?
That's a bad trade off. Willthat make, race conditions or,
like, complicated edge cases inproduction harder to debug
because you don't have you justcan't point to, like, debugger
on the line and just know whatit says because a lot of things
(16:26):
are generated by the compilersort of behind your back. The
higher level and the morecomplicated you make a language,
it's almost impossible to makethat without the trade off
happening somewhere.
Whether it's compilation time orthe actual artifact you're
shipping being worse because youI don't know suddenly you have
to do reflection in the runtime.Right? So this on the one hand
(16:48):
does a really really deep diveinto the code like the construct
but it almost says nothing aboutthe artifact like the binary
that's gonna come out the otherend and I think that's it's very
easy to do that because youspend your days nights looking
at the code but the code is notthe end all be all. It's just a
means to generating the binarythat's actually running in
production. And I I reallyprefer blog posts that say, hey,
(17:12):
maybe you can do this feature tomake compiling faster or to make
the binary smaller, to makethings that matter to the users
and not things that make,developers productive.
Because I found that it's veryrarely the, like, latest and
greatest feature in the languagethat matters. It's the test
suite. It's the flow state. It'swhether you have meetings. It's
whether your manager's anasshole.
Like, there's a lot of thingsthat matter a lot more for your
(17:33):
developer productivity. So but Iagain, I really like it. I also
really like the memes. Goodchoice of memes which is always
appreciated in a in a blog post.It's posted on DultHub which
also, again, not sponsored, butI think they have a pretty cool
idea.
I don't know if you've heard ofthem, but they're trying to do
like a database with branches.Like, you can diff and branch
your DB, which is pretty cool.Like a SQL interface, but a git
(17:56):
approach with, like, productiondatabases, in the cloud in the
back end. Like, that's prettycool. That's a cool idea.
I'm not sure how we use it,like, what's the use case, but
it's very cool.
Jonathan Hall (18:08):
Well, you should get someone from Dault on the
show and talk about it.
Shay Nehmad (18:11):
Damn. Nick, if you're listening to this or if
someone sent you this episode,come on the show, man. We would
love
Jonathan Hall (18:17):
to have you. Yeah. Oh, what does that sound
mean? It means it's time for thelightning round.
Shay Nehmad (18:23):
You're you're going a bit heavy handed with the this
is not a kids show. Lightninground.
Jonathan Hall (18:34):
First up in the lightning round, we have weak
pointers in Go and why theymatter now by Phong Li. It's a
blog post that goes into theupcoming feature in Go 1.24
about weak pointers. What areweak pointers? It's the ability
A weak pointer is basically away to reference a chunk of
memory without locking it down.So the garbage collector can
clean it up if no one else isactively using it, but it a
(18:55):
strong pointer, the normal typeof pointer says, I'm using this
memory, you can't clean it up.
A weak pointer says, if it'sstill there later, I'd like to
have it, but if if you need itfor something else, go ahead and
clean it up. So it's a memoryoptimization technique. And this
blog post goes into why it'simportant now and how to use it.
So check out the blog post, andwe'll dive into this more a
little bit later on in a laterepisode, as go on 24 approaches.
Shay Nehmad (19:18):
On my lightning round table, there's a really
cool new, approach for forinstrumenting, observability
over from the folks at Datadog,which I really think, other than
the fact that they're veryexpensive, are really best in
breed both in, developerdocumentation tooling,
observability. They're they knowtheir stuff. Product design, and
(19:39):
this blog post just flaunts it,man. They released, Orchestrion,
which is a cool name. It's beenon our backlog for a while now.
I'm really happy we're gettingto it. It's compile time auto
instrumentation for Go. Most oftheir customers have
instrumentation for APM. Right?They want to do tracing.
(20:00):
They want to, like, get signalout of your application. But you
don't want to waste developertime doing that because it's
basically the same everywhere.Right? Languages like Python,
Node, whatever, the runtime justallows you to do that. You can
just inject things into theruntime all willy nilly because
it's, you know, you have a veryhigh level.
Jonathan Hall (20:16):
Dynamic. Yeah.
Shay Nehmad (20:17):
Yeah. Exactly. Go compiles to a native binary. So
it's very difficult to injectstuff at run time. Historically,
if you wrote Go, you just spenda lot of your development time,
like, putting metrics everywhereand traces and and middlewares,
etcetera, etcetera.
Right? Where this is not yourbusiness logic. You may want
these dashboards for SRE reasonsor debugging capabilities, but
(20:41):
that's not the software you'rethere to build. So they created
a thing called Orchestrion whichis I'm not sure how they do it,
but they process the source codeat compilation time and just
automatically insertinstrumentations to give you
traces. Interesting.
Yeah. Very very, cool. They useit for multiple products at
(21:02):
Datadog. If you never usedDatadog before, it's a huge
platform with a lot ofcapabilities. I'm not saying
that necessarily is a goodthing, because all of these
capabilities are separatelypriced and very expensive.
But it's not just used fortracing. At least at Datadog,
they also use it to run theirnew exploit prevention, thing.
(21:23):
It's a sort of a reachabilityanalysis. It's just very
interesting. I never thoughtabout compile time
instrumentation as an option.
Right? I just thought abouteither you patch the binary
which is very dangerous, youmanually instrument which is
time consuming or you do thingslike eBPF which don't give you a
lot of visibility and don'talways work, and they don't work
(21:44):
locally, and they're like kindof iffy. But the orchestration
is almost fully automated andgets you all the features. So I
really really like it. I can'twait to start using it actually.
I really hope it's usefuloutside of the Datadog sphere.
And it's a very cool approach. Ididn't know existed before, to
be honest. Cool stuff.
Jonathan Hall (22:04):
Cool. One other lighting round item I'd like to
bring up is a, blog post thatwas brought to my attention by
one of my, Go mentees. It'scalled building a distributed
log using s 3 in under a 150lines of Go. Damn. The basic
idea is it's an open sourceproject that the the author of
the blog post is is published,and it's a way to log to an s 3
(22:26):
bucket.
So if you need to keep your logsaround sort of indefinitely, for
compliance reasons or justbecause or because it's fun or
whatever, this little tool willdo that. Yeah. Maybe you like
your logs and you you know, ifyou wanna collect them. They
still let you do that. My mymentee really liked it just
because it was, kind ofimpressive how you could do so
much in a 150 lines of go.
(22:46):
And, that's kind of a wholeproject. So I won't say more
about it. There's a link in theshow notes if you wanna check it
out. Very cool.
Shay Nehmad (22:53):
I think people usually say Go is a very verbose
language, and you end up with alot of code for not a lot of
bang for your buck, but thatisn't always necessarily the
case. It's only when you need torepresent really high level
business stuff. But when youjust are building a log thing
that goes into s 3, you can'tget any better than that. Yep.
One final item, this is a watchrecommendation for a lecture
(23:16):
that was released just now froma Golang meetup in Prague 2 days
ago from Robert who has a lastname.
I'm not gonna say it becausethere's no chance. It's like
lasfrashkak, something likethat, about rethinking domain
driven design in Go from mythsto reduced project complexity. I
watched it over lunch today. Itwas very, very good. You should
(23:40):
do that as well.
Cool. Especially if you're likein architecture slash middle
management slash team lead sortof role and you're scratching
your head why things are harderthan you expect them to, this
will answer a lot of thosequestions. Really good stuff.
And it's about go, like, it'snot generic, architecture
lecture. And that wraps up ourlighting round.
Stick around for a short break.Hello. Like Jonathan said at the
(24:09):
top of the show, this scaryFriday is a great time to give
us your money. We want yourmoney. Is that scary enough?
Yeah. This show is supported byour beautiful Patreon
supporters. If you wanna jointhat group and kick, $8 a month
our way, we would reallyappreciate it. This is a hobby.
(24:29):
We do it for fun, and to learnbut it's a rather expensive
hobby mostly for editing feesand and hosting fees.
Supporting us via Patreon is thebest way to support the show. If
you wanna reach us, you can goto cupago.dev. You can find the
links to everything thereincluding the our Slack channel,
hashtag cupago with someinteresting conversations. You
can email us at news atcupago.dev. And another way to
(24:52):
support the show is to share it.
Share it with a friend or acolleague or leave a review on
what wherever you listen to yourpodcast like Apple Podcasts,
Spotify, blah blah blah becauseit helps us climb the charts and
just reach more people, which isfun. We last week, we said we
want to do a live episode forour, a 100th episode celebration
that's gonna be in, like, 2months ish. People gave us
(25:12):
really warm, responses on that.So, yeah, it's definitely
happening. We're thinking aboutsome fun ideas, maybe doing the
live participation, polls,Twitch, YouTube live, whatever.
We don't have a we don't have itset in stone yet. So if you have
a cool idea or if you wanna helpus arrange that, that would be
very cool.
Jonathan Hall (25:30):
You know, sorry. If it if it happens to fall on
on Friday 13th again, we shoulddo some live coding because
that's pretty scary.
Shay Nehmad (25:37):
The scariest of all. No. I'm not the the main
thing that's gonna be scary ishow rusty I am with, Google.
Cool. So or you're suddenlygonna see my setup, and you're
gonna be, like, you're using VIMwith Versus Code with these
plugins?
For the amount of time we'vepodcast together, we never
recorded together. I mean, thatcould be a good thing to do in
(25:57):
the live episode, actually.
Jonathan Hall (25:59):
That sounds like an April first thing to do.
Shay Nehmad (26:01):
Yeah. For sure. We could try one of these, coding
challenges we talked aboutrecently. Oh, yeah. Yeah.
I I get his newsletter, andevery time, like, yeah. Yeah.
I'll do that. That sounds likehe recently their latest coding
challenge was, like, SoCAT.Like, yeah, that would be so
cool.
I look at my calendar and Icried for 10 seconds and I went
to my next meeting.
Jonathan Hall (26:21):
Yep. Yep.
Shay Nehmad (26:22):
So, yeah, that that will happen. We'll give you
details, as that, comes up. Andfinally, one super boring
update. If you're buying thingsfrom us in the swag store, you
can buy some cool stuff like, ahoodie or a cup. Stickers.
Yeah. Stickers are pretty cool.We need to do some changes, to
(26:43):
comply with the EU's generalproduct safety regulations, and
everybody just turned off thepodcast.
Jonathan Hall (26:51):
Where? Where?
Shay Nehmad (26:52):
Yeah. So everything in the EU needs some additional
product information. We're gonnaneed to turn on that setting. So
basically, if you're in Europe,our products are not gonna be
available for a while. You'reyou're gonna have to wait.
Sorry. I need to updateeverything in the GPSR section
(27:14):
in case our cups are extradangerous. Yeah. And, no
politics, but thanks to you for,doing some regulation. You
really needed a bit of that.
You you lacked. You lacked someregulation. So yeah. But the
product's not gonna be availablefor a while until we figure it
out with, our supplier,Printify. So if you really,
(27:34):
really, really want one, you'rejust gonna have to wait until we
And
Jonathan Hall (27:36):
if you do really, really want one, let us know so
we know that somebody's waiting,and maybe it'll maybe it'll
Yeah. Fire at our buzz.
Shay Nehmad (27:43):
Cool. Thanks for listening to our show this week.
That's all we have for you. ForRogram exited. Goodbye.
Rogram exited. Goodbye.
This show is supported by you. Stick around
till after the news to learnmore about that. This is Cup of
Go for Friday, December 13. Keepup to date with the important
happenings in the Go communityin about 15 minutes per week.
(00:21):
I'm Jonathan Hall.
Shay Nehmad (00:22):
And I'm Shay Nehmad. Hey, Jonathan.
Jonathan Hall (00:25):
Yes, Shay.
Shay Nehmad (00:26):
How do you scare a developer?
Jonathan Hall (00:29):
I'm gonna say something about Windows, but I
don't know. Leave the windowsopen.
Shay Nehmad (00:34):
My other car is a CDR.
Jonathan Hall (00:36):
No problem.
Shay Nehmad (00:38):
Hello, everybody. It is Friday 13th. We hope
you're, all spooked up.Actually, that that's a good
question. What's your, most,like, the scariest movie you
like?
Or I guess the horror movie youlike the most?
Jonathan Hall (00:52):
I don't I don't like horror movies, honestly.
There's a few that kinda countas horror that I guess I like. I
I guess I'll say the 28 DaysLater series because I the 20
year 8 years is about to comeout. I just watched the preview
for that. I'm kinda interestedin that one.
I I I guess that counts ashorror.
Shay Nehmad (01:07):
I'm down to clown with, some horror movies. The
Shining. That's a good one.
Jonathan Hall (01:11):
That's a good one. Yeah. Yeah. That's a good
one.
Shay Nehmad (01:12):
But nothing as scary as looking at my Jira
backlog. So let's look atsomething else and talk about,
Go. But we do have somethingscary to talk about. Security
vulnerabilities in the cryptolanguage. And then again,
security vulnerabilities in thecrypto package.
Before we jump into that, I justwanna give the rundown of what
we're gonna talk about thisweek. So the security
(01:32):
vulnerability as mentioned,we're gonna start talking about
the 124 draft release notes as124 is set to come out around
February ish. Oh, Valentine'sDay. We always have that, bet.
Jonathan Hall (01:45):
It's always it could be Valentine's Day, but it
won't be.
Shay Nehmad (01:47):
Yeah. So we're gonna start going through the
draft release notes so you know,what's definitely there. Then we
have 2, blog posts to talkabout, 1 from Dolthub and 1 from
Victoria metrics, and oneTwitter thing to go through
about a new observabilitylibrary. And a whole bunch of
things in the lightning round.We have a lot of things to talk
about.
(02:08):
Our backlog is only growing,just like my real one. So let's
talk about, some Go, shall we?
Jonathan Hall (02:14):
Yes. Let's see a security. So I saw that, XCrypto
was updated, but, did you diveinto it to understand why?
Shay Nehmad (02:21):
Yes. Let me ask you. Assuming I'm not shy, would
you let me come on the show?
Jonathan Hall (02:27):
Maybe.
Shay Nehmad (02:28):
Assuming I am shy, would you let me come on the
show? Yes. Alright. Can I comeon the show? Yes.
So if you were to base your,answer on the first question,
you would say no. Right?
Jonathan Hall (02:40):
I might say no. Yeah. It depends on who you
like, yeah. So Shai is permittedto go on the show. Other people
some other people are and somearen't.
Shay Nehmad (02:46):
Basically, everybody's permitted. We're
pretty we're
Jonathan Hall (02:48):
pretty sure. Much.
Shay Nehmad (02:49):
Yeah. It's the other way around. People just
don't wanna come. Anyway, thething is there's an SSH,
callback called public key,callback, which you can
configure in your server. Andthe server can, get some
questions about some keys likekey a and key b.
Now, I don't necessarily controlthese keys, but when I do a
(03:13):
actual request, you mightaccidentally, just because of
the way it was set up, I cancall public key callback twice.
1st with a key I don't own andthen with a key I do. And a
vulnerable application make anassumption that I control key a
or control key b, and then makeauthorization decisions based on
(03:33):
key b where I don't control thatkey. I don't control the private
key. This API is widely misused.
Like, people just don't get it,and I don't blame them. It's
very confusing. So this API isreally misused all over the
place. So as a partialmitigation, you this change
enforces that the last key,passed to this function will be
(03:56):
the key that's used toauthenticate the connection. So
you can't do the thing where youask with one key and then use
another one.
Okay. You just have to, use thelast one. And if you want to do
multiple collections, you haveto, call it multiple times with
the same key if, like, if it'snecessary. Like, the the client
(04:16):
still may not control theoriginal key. You're just not
gonna make that, like, mistake,anymore as the server.
Okay. So it's a pretty, coolvulnerability, I think. It's
very logical. It's very nottechnical in a sense Uh-huh.
Which I like.
Feels very human. And just shoutout to Damien, Turnout, Patrick
(04:36):
Dawkins, Vince Parker, andJulius de Vivier from
platform.sh and UpSunengineering teams, for reporting
this CVE. I think, like, gettinga CVE on your on your belt is a
pretty major achievement formost security researchers. Sure.
And it's very cool.
And it's so cool, I actuallywent to their site, and their
(04:57):
site looks pretty cool as well.Like, platform built to Sage
looks like a pretty awesomeservice, like, platform as a
service kinda thing. They're notsponsored. I'm just like, they
found the vulnerability in go.They get a shout out.
Cool. Cool work, guys. Soobviously, if you do have SSH in
your server, upgrade basically,make sure you don't misuse this,
(05:17):
function. The problem is youmight import something that does
this for you and you're notreally aware. That's I think the
main thing you have to worryabout.
So I would, like, go, run govoln check and just make sure
that you're you're not havingany issues.
Jonathan Hall (05:31):
Well, I'll be honest. When I saw that there
was an update to that packagebefore I go and think about it,
I updated it because I feel likeanything in xcrypto, if there's
an update, I probably want it.For
Shay Nehmad (05:39):
sure. We had a a talk about, like, a Slack
conversation about the Voncheck-in our Mhmm. Slack channel
recently. That was prettyinteresting. Like, how people
approach running Von check.
Right?
Jonathan Hall (05:51):
Yeah. It's a it's a good question. Like, do you
run it for every pull request?That was kind of the topic. You
run it for every pull requestand it's a it blocks merges if
there's a break, or do you runit once a night, or, yeah,
different ways to do that fordifferent projects.
Shay Nehmad (06:04):
So so some people say it's it blocks the word on
every feature branch and sobasically the first person who
sees that needs to make a fixedbranch first and the the fact
that this workflow, which Ithink is literally the most
severe workflow you could have,Right? The the person was like,
yeah, this works really wellcompared to Node. Js where Yeah.
(06:25):
Yeah. So even the strictestpossible workflow is, pretty
good.
I don't think it's necessaryjust in terms of, like, if there
is a critical criticalvulnerability, you're gonna hear
about it in the news. Right?You're gonna notice you're gonna
hear it on this show and theworld isn't that fast to react.
Like, all I'm saying is if yourvulnerability program is
(06:47):
actually as good enough as yourcomply, like, compliance
requirements, like yourregulator is asking you to do,
you're probably overachievingcompared to the rest of the
software in the world. But I Iwouldn't do it.
Stop the world. Like, it's justcognitive load or, like, you're
taking people out of flow state.I don't like it. Oleg from the
channel, Oleg Kovalov suggestedto just do it a cron job on on a
(07:09):
weekly. Just, like, fix it andping everybody to rebates, which
I think is a lot morereasonable.
But it's GoVonczyk, very cool,and crypto, very scary.
Jonathan Hall (07:20):
Shadi, did you leave a window open or
something? Is there a draft inhere? Oh, I
Shay Nehmad (07:24):
don't know. Why are you are you hearing something?
Are you seeing something?
Jonathan Hall (07:28):
Oh, oh, oh, here it is. It's the Go 1.24 draft.
And that's our segue, folks.Sorry for the bad jokes. That
part probably.
Shay Nehmad (07:40):
Hashtag sorry, not sorry.
Jonathan Hall (07:42):
Yeah. Exactly. So we're not gonna talk about the
entire draft today of the 124release notes because that would
take too long. We're alreadygonna be over our 15 minutes.
But we're gonna talk about acouple of the highlights.
So so first up, I'm I'm excitedabout this feature. We get the
new, to I don't know how to callit. I would say tool, but, you
(08:02):
know, it's a tool that's calledtool. Mhmm. So you you know how
shy sometimes you, maybe you'reusing a code generator.
Maybe you're building mocks oryou're using SQL c or something
like that that generates code.And it's it's how do you track
that in git so that you alwaysbuild against the correct
version?
Shay Nehmad (08:22):
So you have to create a file. I think it's
called tools dot go, and thenyou import it, but you don't
actually use it. And theneverybody who's new to the
project is confused. And thensomeone deletes the file
because, like, oh, there'snothing here. Like, someone
meant to do it, but they forgot.
And then nothing works for awhile until they figure it out,
then you revert it. Fun times.
Jonathan Hall (08:40):
Yeah. So you yeah. Basically, just like like
you said, you create thistypically called tool dot go or
something like that or tools dotgo that, imports the things you
want, but it's never compiled.So that way, it kind of fools go
mod into importing the correctversion and tagging them and go
to mod and go to some. Well, nowwe're gonna have 1st class
support for doing that correctlywith, tools.
(09:02):
So you can use Go tool, and, Iguess you use it kinda like you
do with, Go mod, but you ratherthan it being a mod that's
compiled, you're just saying,this is a tool I use in this
project. Please track it for meand use this specific version of
it.
Shay Nehmad (09:15):
And the the thing is this is something that other
languages have had for a while.Right? When you work in in
Python or Node. Js or Rust, youhave like dev dependencies. It
always felt really missing atleast for me, Ingo.
Like I I've if you remember, weinterviewed the author of a go
test sum. I think it was one ofour first interviews, like,
(09:37):
ever.
Jonathan Hall (09:37):
Mhmm.
Shay Nehmad (09:38):
And I really like this tool, but I can't, like,
justify putting it in Go tools.That feels really bad, like,
setting up a tools fight justfor a test output. But now that
it's gonna be in the Go mod in,like, a sane place where you
it's where you put thedependencies, I think I'll
switch to using it, like, fulltime. Same thing with Golang CI
Lint. Right?
(09:58):
All these tools that you expectto be installed. I just expect
them to be installed by default.
Jonathan Hall (10:04):
Right. Yeah. I think this will help with a
whole bunch of stuff. I'm reallylooking forward to to using it
and Ergonomics. Yeah.
It'll be great.
Shay Nehmad (10:11):
The second feature we wanted to highlight, from go
124, is about, like, generics,but it's actually about
refactoring. So here's thehere's the use case. Right?
Let's say you have an oldpackage. Right?
And you wanna move to the newpackage which is, better. Right?
Like Barney said from, How HowMet Your Mother. New is always
(10:34):
better. But I'm gonna give you 4words to live by.
New is always better. That's therule. Right? So way back in go
19, there have been type aliaseswhere you could say type, let's
say, x equals to some other typetype y. This is usually a useful
(10:57):
feature when you wanna takesomething that's untyped, that
something that has like a basictype that looks pretty
complicated like a map from athing to another thing.
Just wanna give it a clear name.So I I've always found it useful
for that.
Jonathan Hall (11:12):
Yeah.
Shay Nehmad (11:12):
But it's just a name for an existing type.
Right? You didn't create a newtype. Just gave a name to, to a
new name to an existing type.Mhmm.
Now if you have an old packageand a new package that makes it
really useful if you wannamigrate from an old package to a
new package, you can have thesame name for both. Right? By
(11:33):
type aliasing them and yougradually update the use of the
old package user to the newpackage type just throughout
your project and the compiler ishappy because it's the same
name. You just change theimport. The problem is 118
introduced generics and youcouldn't do that.
Like if you had a generic typein an old package, you couldn't
alias it with the new type andnow you can. It looks really
(11:56):
really reasonable type your newtype name and then square
brackets t any equals to the oldtype and parens t which
basically stands for hey, I'mlacing a new type it can be
anything but it's actually theold type with its type
constraints that are alreadydefined so it's not actually
(12:18):
anything. So you have full typecompatibility when moving like
generic types and you canactually have this already with
the go experiments so if anybodylike really really really wants
to use it you know, like RobertGriesemer, the the person who
told us about this in the blogpost, they can already turn this
on with, experiment flag and nowit's just gonna become the
(12:38):
default because I guess it'sstable enough and they didn't
find any bugs.
Jonathan Hall (12:41):
Mhmm.
Shay Nehmad (12:42):
The the main reason I'm excited about this is it's
an improvement to generics thatdoesn't introduce more features.
It just makes it more ergonomic.So it doesn't make the language
more complicated which I thinkis a good thing. And everybody
agrees on the Internet andnobody has a different opinion
about Go, right?
Jonathan Hall (12:57):
Yeah. Everybody thinks generics are perfect. Oh,
wait. I found this one guy whodisagrees.
Shay Nehmad (13:01):
This one guy.
Jonathan Hall (13:03):
What's one guy?
Shay Nehmad (13:04):
One guy in every single Java developer in the
world, they disagree.
Jonathan Hall (13:09):
Yeah. And so Nick Tubby wrote a a post a while
back back in November aboutgenerics and some of his
challenges with them and gotsome feedback on Reddit and
other places about that. And sothis is kind of a follow-up to
that. Tldr, the old his old postoverlooked some of the features
in Go. He gave a couple examplesof some comments he got on about
(13:31):
his old post.
The one he said that stung themost was, this code looks like
Java. I'm sure we've allexperienced that before if
you've we need to go for anyother time. We run into this
code that looks like Javawritten and go or PHP written
and go or Ruby written and go,etcetera. Anyway, so he writes
this. It's a fairly long postactually.
Shay Nehmad (13:47):
Very detailed, very detailed.
Jonathan Hall (13:49):
Yeah. Yeah. Kudos to him for being detailed and
not just hot taking and andtrying to throw crap. He's
trying to be detailed here.
Shay Nehmad (13:57):
I think the the main thing is about having more
features with generics thatother languages tend to have
that that allow you to do morecomplicated things with generic.
Jonathan Hall (14:08):
Yes. And he also makes the point that he
appreciates the Go team'sreluctance to add new features,
which I completely agree with.On the other hand, you know,
there there has to be a tradeoff. Right? And I think that's
kind of the whole point of thisarticle is is we had to find
balance between adding featurestoo quickly and making the
language bloated and confusingand adding them too slowly and
(14:29):
sort of we're working with ourhands tied behind our back,
while we try to work around thelanguage's limitations.
And clearly, Nick feels thatthose too much on the hand side
behind your backside of thespectrum. I'm not sure I agree,
although I definitely canidentify with some of his
frustrations. There are I havedefinitely found places where
generics, in particular, havefelt too limiting. But I'm not
(14:50):
sure that the solution is tojust add more features because I
don't want Go to become Java orPHP.
Shay Nehmad (14:58):
There are a few things like self referential
type aliases and parameterizedtype aliases, which funnily
enough, you know, the lastfeature we discussed from the
124 blog is in that sameneighborhood, but it's
definitely not the same scale.These are like huge Ferraris in
the driveway whereas the typealiases, 124 supports generics
(15:20):
of theft. It's like a cart thatyou can pull by hand. It's
definitely not the same scale ofcomplexity when you think about
it. Yeah.
The thing that first of all, Ilove this, blog post. Shout out,
Nick. Like, thinking about alanguage that deeply and, like,
saying actually listing featuresyou would want and giving
examples, Super cool. Theproblem I have with it is that
(15:40):
the whole focus of the articleis about the code. Writing clean
code and the act of coding, andnot the act of reading the code.
It's like, how can I code golfthis and make this as concise
and as quote unquote clean,which I found as as years go by
as an excuse to, like, the way Ilike it versus, anything else?
Jonathan Hall (16:03):
Mhmm.
Shay Nehmad (16:04):
And nothing about how this will impact the
artifact in production. Like,will this make compiling slower?
That's a bad trade off. Willthat make, race conditions or,
like, complicated edge cases inproduction harder to debug
because you don't have you justcan't point to, like, debugger
on the line and just know whatit says because a lot of things
(16:26):
are generated by the compilersort of behind your back. The
higher level and the morecomplicated you make a language,
it's almost impossible to makethat without the trade off
happening somewhere.
Whether it's compilation time orthe actual artifact you're
shipping being worse because youI don't know suddenly you have
to do reflection in the runtime.Right? So this on the one hand
(16:48):
does a really really deep diveinto the code like the construct
but it almost says nothing aboutthe artifact like the binary
that's gonna come out the otherend and I think that's it's very
easy to do that because youspend your days nights looking
at the code but the code is notthe end all be all. It's just a
means to generating the binarythat's actually running in
production. And I I reallyprefer blog posts that say, hey,
(17:12):
maybe you can do this feature tomake compiling faster or to make
the binary smaller, to makethings that matter to the users
and not things that make,developers productive.
Because I found that it's veryrarely the, like, latest and
greatest feature in the languagethat matters. It's the test
suite. It's the flow state. It'swhether you have meetings. It's
whether your manager's anasshole.
Like, there's a lot of thingsthat matter a lot more for your
(17:33):
developer productivity. So but Iagain, I really like it. I also
really like the memes. Goodchoice of memes which is always
appreciated in a in a blog post.It's posted on DultHub which
also, again, not sponsored, butI think they have a pretty cool
idea.
I don't know if you've heard ofthem, but they're trying to do
like a database with branches.Like, you can diff and branch
your DB, which is pretty cool.Like a SQL interface, but a git
(17:56):
approach with, like, productiondatabases, in the cloud in the
back end. Like, that's prettycool. That's a cool idea.
I'm not sure how we use it,like, what's the use case, but
it's very cool.
Jonathan Hall (18:08):
Well, you should get someone from Dault on the
show and talk about it.
Shay Nehmad (18:11):
Damn. Nick, if you're listening to this or if
someone sent you this episode,come on the show, man. We would
love
Jonathan Hall (18:17):
to have you. Yeah. Oh, what does that sound
mean? It means it's time for thelightning round.
Shay Nehmad (18:23):
You're you're going a bit heavy handed with the this
is not a kids show. Lightninground.
Jonathan Hall (18:34):
First up in the lightning round, we have weak
pointers in Go and why theymatter now by Phong Li. It's a
blog post that goes into theupcoming feature in Go 1.24
about weak pointers. What areweak pointers? It's the ability
A weak pointer is basically away to reference a chunk of
memory without locking it down.So the garbage collector can
clean it up if no one else isactively using it, but it a
(18:55):
strong pointer, the normal typeof pointer says, I'm using this
memory, you can't clean it up.
A weak pointer says, if it'sstill there later, I'd like to
have it, but if if you need itfor something else, go ahead and
clean it up. So it's a memoryoptimization technique. And this
blog post goes into why it'simportant now and how to use it.
So check out the blog post, andwe'll dive into this more a
little bit later on in a laterepisode, as go on 24 approaches.
Shay Nehmad (19:18):
On my lightning round table, there's a really
cool new, approach for forinstrumenting, observability
over from the folks at Datadog,which I really think, other than
the fact that they're veryexpensive, are really best in
breed both in, developerdocumentation tooling,
observability. They're they knowtheir stuff. Product design, and
(19:39):
this blog post just flaunts it,man. They released, Orchestrion,
which is a cool name. It's beenon our backlog for a while now.
I'm really happy we're gettingto it. It's compile time auto
instrumentation for Go. Most oftheir customers have
instrumentation for APM. Right?They want to do tracing.
(20:00):
They want to, like, get signalout of your application. But you
don't want to waste developertime doing that because it's
basically the same everywhere.Right? Languages like Python,
Node, whatever, the runtime justallows you to do that. You can
just inject things into theruntime all willy nilly because
it's, you know, you have a veryhigh level.
Jonathan Hall (20:16):
Dynamic. Yeah.
Shay Nehmad (20:17):
Yeah. Exactly. Go compiles to a native binary. So
it's very difficult to injectstuff at run time. Historically,
if you wrote Go, you just spenda lot of your development time,
like, putting metrics everywhereand traces and and middlewares,
etcetera, etcetera.
Right? Where this is not yourbusiness logic. You may want
these dashboards for SRE reasonsor debugging capabilities, but
(20:41):
that's not the software you'rethere to build. So they created
a thing called Orchestrion whichis I'm not sure how they do it,
but they process the source codeat compilation time and just
automatically insertinstrumentations to give you
traces. Interesting.
Yeah. Very very, cool. They useit for multiple products at
(21:02):
Datadog. If you never usedDatadog before, it's a huge
platform with a lot ofcapabilities. I'm not saying
that necessarily is a goodthing, because all of these
capabilities are separatelypriced and very expensive.
But it's not just used fortracing. At least at Datadog,
they also use it to run theirnew exploit prevention, thing.
(21:23):
It's a sort of a reachabilityanalysis. It's just very
interesting. I never thoughtabout compile time
instrumentation as an option.
Right? I just thought abouteither you patch the binary
which is very dangerous, youmanually instrument which is
time consuming or you do thingslike eBPF which don't give you a
lot of visibility and don'talways work, and they don't work
(21:44):
locally, and they're like kindof iffy. But the orchestration
is almost fully automated andgets you all the features. So I
really really like it. I can'twait to start using it actually.
I really hope it's usefuloutside of the Datadog sphere.
And it's a very cool approach. Ididn't know existed before, to
be honest. Cool stuff.
Jonathan Hall (22:04):
Cool. One other lighting round item I'd like to
bring up is a, blog post thatwas brought to my attention by
one of my, Go mentees. It'scalled building a distributed
log using s 3 in under a 150lines of Go. Damn. The basic
idea is it's an open sourceproject that the the author of
the blog post is is published,and it's a way to log to an s 3
(22:26):
bucket.
So if you need to keep your logsaround sort of indefinitely, for
compliance reasons or justbecause or because it's fun or
whatever, this little tool willdo that. Yeah. Maybe you like
your logs and you you know, ifyou wanna collect them. They
still let you do that. My mymentee really liked it just
because it was, kind ofimpressive how you could do so
much in a 150 lines of go.
(22:46):
And, that's kind of a wholeproject. So I won't say more
about it. There's a link in theshow notes if you wanna check it
out. Very cool.
Shay Nehmad (22:53):
I think people usually say Go is a very verbose
language, and you end up with alot of code for not a lot of
bang for your buck, but thatisn't always necessarily the
case. It's only when you need torepresent really high level
business stuff. But when youjust are building a log thing
that goes into s 3, you can'tget any better than that. Yep.
One final item, this is a watchrecommendation for a lecture
(23:16):
that was released just now froma Golang meetup in Prague 2 days
ago from Robert who has a lastname.
I'm not gonna say it becausethere's no chance. It's like
lasfrashkak, something likethat, about rethinking domain
driven design in Go from mythsto reduced project complexity. I
watched it over lunch today. Itwas very, very good. You should
(23:40):
do that as well.
Cool. Especially if you're likein architecture slash middle
management slash team lead sortof role and you're scratching
your head why things are harderthan you expect them to, this
will answer a lot of thosequestions. Really good stuff.
And it's about go, like, it'snot generic, architecture
lecture. And that wraps up ourlighting round.
Stick around for a short break.Hello. Like Jonathan said at the
(24:09):
top of the show, this scaryFriday is a great time to give
us your money. We want yourmoney. Is that scary enough?
Yeah. This show is supported byour beautiful Patreon
supporters. If you wanna jointhat group and kick, $8 a month
our way, we would reallyappreciate it. This is a hobby.
(24:29):
We do it for fun, and to learnbut it's a rather expensive
hobby mostly for editing feesand and hosting fees.
Supporting us via Patreon is thebest way to support the show. If
you wanna reach us, you can goto cupago.dev. You can find the
links to everything thereincluding the our Slack channel,
hashtag cupago with someinteresting conversations. You
can email us at news atcupago.dev. And another way to
(24:52):
support the show is to share it.
Share it with a friend or acolleague or leave a review on
what wherever you listen to yourpodcast like Apple Podcasts,
Spotify, blah blah blah becauseit helps us climb the charts and
just reach more people, which isfun. We last week, we said we
want to do a live episode forour, a 100th episode celebration
that's gonna be in, like, 2months ish. People gave us
(25:12):
really warm, responses on that.So, yeah, it's definitely
happening. We're thinking aboutsome fun ideas, maybe doing the
live participation, polls,Twitch, YouTube live, whatever.
We don't have a we don't have itset in stone yet. So if you have
a cool idea or if you wanna helpus arrange that, that would be
very cool.
Jonathan Hall (25:30):
You know, sorry. If it if it happens to fall on
on Friday 13th again, we shoulddo some live coding because
that's pretty scary.
Shay Nehmad (25:37):
The scariest of all. No. I'm not the the main
thing that's gonna be scary ishow rusty I am with, Google.
Cool. So or you're suddenlygonna see my setup, and you're
gonna be, like, you're using VIMwith Versus Code with these
plugins?
For the amount of time we'vepodcast together, we never
recorded together. I mean, thatcould be a good thing to do in
(25:57):
the live episode, actually.
Jonathan Hall (25:59):
That sounds like an April first thing to do.
Shay Nehmad (26:01):
Yeah. For sure. We could try one of these, coding
challenges we talked aboutrecently. Oh, yeah. Yeah.
I I get his newsletter, andevery time, like, yeah. Yeah.
I'll do that. That sounds likehe recently their latest coding
challenge was, like, SoCAT.Like, yeah, that would be so
cool.
I look at my calendar and Icried for 10 seconds and I went
to my next meeting.
Jonathan Hall (26:21):
Yep. Yep.
Shay Nehmad (26:22):
So, yeah, that that will happen. We'll give you
details, as that, comes up. Andfinally, one super boring
update. If you're buying thingsfrom us in the swag store, you
can buy some cool stuff like, ahoodie or a cup. Stickers.
Yeah. Stickers are pretty cool.We need to do some changes, to
(26:43):
comply with the EU's generalproduct safety regulations, and
everybody just turned off thepodcast.
Jonathan Hall (26:51):
Where? Where?
Shay Nehmad (26:52):
Yeah. So everything in the EU needs some additional
product information. We're gonnaneed to turn on that setting. So
basically, if you're in Europe,our products are not gonna be
available for a while. You'reyou're gonna have to wait.
Sorry. I need to updateeverything in the GPSR section
(27:14):
in case our cups are extradangerous. Yeah. And, no
politics, but thanks to you for,doing some regulation. You
really needed a bit of that.
You you lacked. You lacked someregulation. So yeah. But the
product's not gonna be availablefor a while until we figure it
out with, our supplier,Printify. So if you really,
(27:34):
really, really want one, you'rejust gonna have to wait until we
And
Jonathan Hall (27:36):
if you do really, really want one, let us know so
we know that somebody's waiting,and maybe it'll maybe it'll
Yeah. Fire at our buzz.
Shay Nehmad (27:43):
Cool. Thanks for listening to our show this week.
That's all we have for you. ForRogram exited. Goodbye.
Rogram exited. Goodbye.
Popular Podcasts
On Purpose with Jay Shetty
I’m Jay Shetty host of On Purpose the worlds #1 Mental Health podcast and I’m so grateful you found us. I started this podcast 5 years ago to invite you into conversations and workshops that are designed to help make you happier, healthier and more healed. I believe that when you (yes you) feel seen, heard and understood you’re able to deal with relationship struggles, work challenges and life’s ups and downs with more ease and grace. I interview experts, celebrities, thought leaders and athletes so that we can grow our mindset, build better habits and uncover a side of them we’ve never seen before. New episodes every Monday and Friday. Your support means the world to me and I don’t take it for granted — click the follow button and leave a review to help us spread the love with On Purpose. I can’t wait for you to listen to your first or 500th episode!
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com