👻 Spooky integer printing and 🧛🏻 scary fast ring buffers

Jonathan Hall:

This show is supported by you. Stick around until the end to hear more about that. This is Cup of Go for Halloween, 10/31/2025. Keep up to date with important happenings in the Go community in about fifteen minutes per week. I'm Jonathan Hall.

Shay Nehmad:

And I'm Shay Nehmad. I am very excited for my first Halloween ever. Woo hoo.

Jonathan Hall:

Do you have a costume?

Shay Nehmad:

My kid has a costume.

Jonathan Hall:

Your kid has

Shay Nehmad:

a I didn't I'll probably like put on a sheet, whatever. Yeah. Like I'll improvise something.

Jonathan Hall:

They'll do something.

Shay Nehmad:

The like rule, you know, I'm going with my kid up to a house, she's knocking, she'll say trick or treat. How many candies am I getting? One, two?

Jonathan Hall:

Probably a few. You personally or your kid?

Shay Nehmad:

All of us is like a I'm not dressed

Jonathan Hall:

You're not dressed up. You're there to and observe and to steal the candy after she goes to sleep.

Shay Nehmad:

That's the plan.

Jonathan Hall:

Yeah. Yeah.

Shay Nehmad:

Any dress up for you?

Jonathan Hall:

I don't have a costume this year. I have worn costumes in years past. My son was a firefighter yesterday at preschool. My daughter stayed home sick, so she didn't go as the fairy princess that costume we bought for her. And the last time I dressed up for Halloween was probably eight years ago.

Jonathan Hall:

I was I was Mario. I went all out. I I dyed my mustache to be brown and I had some blue overalls and white gloves and everything.

Shay Nehmad:

One costume I'm considering, I might do it, I'm still like debating, is getting like some bubble wrap from someplace and just writing AI on it. The AI bubble who's above the top.

Jonathan Hall:

Right.

Shay Nehmad:

Right. That's a bit too on the nose though on working at an AI security startup, you know?

Jonathan Hall:

Yeah. And you are in San Francisco.

Shay Nehmad:

I I think it's considered hate speech here too, hate on LLMs. Right.

Jonathan Hall:

You're not allowed

Shay Nehmad:

to say clanger in the street, you know what I mean?

Jonathan Hall:

Maybe we can get an inflatable gopher outfit.

Shay Nehmad:

Oh, that actually that could be cool. Talking about Halloween and being scared, like, don't know, I'm scared out. I'm I'm creeped out. Give me some like normal proposals, Bring me back to normalcy.

Jonathan Hall:

All right, here's a question for you, Shai. What happens if you use FMT printf with the percent Q operator for an integer? I don't

Shay Nehmad:

remember. What is percent Q? Have to admit, I'm really bad about this stuff. I always use percent plus v no matter what. I'm just like, whatever, give me the most verbose representation I I'll I'll need.

Jonathan Hall:

So percent q does a quoted version of a string. So if you pass in a string that has escape characters entered or something, it will quote it so that it's safe.

Shay Nehmad:

Oh, okay. Cool.

Jonathan Hall:

But but if you pass a non string, like an integer, what would you expect happens? Like, you pass one two three.

Shay Nehmad:

To string, like, try to find the best string representation of it.

Jonathan Hall:

So you might expect it to print, like, quote one two three end quote or something like that. Right?

Shay Nehmad:

Yes.

Jonathan Hall:

If you if you use one twenty three if you pass one two three to that, the result is actually much scarier than that. The actual result is it prints the opening curly brace because it converts it to ASCII.

Shay Nehmad:

Oh, no way. Yeah.

Jonathan Hall:

That's cool. So that's kind of

Shay Nehmad:

actually cool.

Jonathan Hall:

It might be cool. It is a little bit unexpected. So there's a new proposal to add a check for that case to GoVet and warn if someone tries to do that. I think that's kind of useful. I don't know that I've ever run into that problem, but I could could see it happening.

Shay Nehmad:

The but that does sound like possible intended usage. Like, how should I?

Jonathan Hall:

Someone someone could mean that. But if you really want that, like you wouldn't use percent Q, you would probably use percent S to intentionally convert your integer to a string.

Shay Nehmad:

But then it's not quoted.

Jonathan Hall:

Well, it's not quoted in this case either. Are you oh. Because it's not a string. You know, it's it's yeah. I don't know.

Jonathan Hall:

It's weird.

Shay Nehmad:

Cool. Well, if this bit you, whenever you were trying to use percent cube, go upvote this issue, this proposal, sorry. Seems like there's no CL yet,

Jonathan Hall:

so you could even try to do that. Yeah. This is this is still new, so it hasn't been accepted yet. But I I I don't think it's a there's a not a high chance that it will be rejected. I I my my that's my feeling.

Shay Nehmad:

Seems a bit

Jonathan Hall:

a no brainer, but

Shay Nehmad:

Someone did the thing I like, Alan Donovan did the thing I like of actually going digging through Go code and finding examples where someone used q and passed in the wrong type. And it seems like a lot

Jonathan Hall:

of people made that mistake. He's, I don't

Shay Nehmad:

know why he's dunking specifically on HashiCorp, like all those mistakes. Look at HashiCorp doing it wrong. But I guess they just write a lot of Go code. That's also another option.

Jonathan Hall:

Yeah, maybe they Yeah, I don't know. I'm not gonna make jokes about HatchiCorp. So

Shay Nehmad:

cool, go up for that proposal. Also, don't think there's a CL yet, and this sounds like actually a pretty easy one. I would try Honestly, if you were looking for an opportunity to

Jonathan Hall:

write a CL, I would definitely do that.

Shay Nehmad:

Before jumping to the next blog post, last week's episode was a live episode and you were in Go West. How was that? How was the conference?

Jonathan Hall:

It was great. I had a I had a good time. I spoke at the end of the day, so everybody was falling asleep already, I suppose, before before I got to speak. But, no, it was it was a good good talk. I actually did two talks.

Jonathan Hall:

I did a lightning talk also last minute about the CMP package in the standard library. And I know, felt like all the talks that were presented were great. I think they'll be online before too long. So we'll try to share, you know, mention that on the show with a link in the show notes when that's available.

Shay Nehmad:

Yeah, we'll definitely put a note to look into that.

Jonathan Hall:

There were a lot of talks aimed at more beginner intermediate folks sort of breaking down like how memory management works and not so much the how memory management works, but why memory management is important, which is something that's often overlooked. And great talk about channels. So yeah, I look forward to

Shay Nehmad:

sharing those videos when they're available. And you mentioned before the show, you met a lot of people who were actually on the show before, right?

Jonathan Hall:

Yeah. So of course I met Moriah and Derek who are co organizers of the show, and they've been on the show before. Moriah at least twice. I also met Elliot Mins of Dreams of Code. He was there.

Jonathan Hall:

He was one of the panel presenters, so he was one of the speakers. And I met a few other people. Of course, many people I'd never met before. A couple of others I had met that weren't with any relation to the show. Almost met Lane Wagner from boot.

Jonathan Hall:

Dev. He's been on the show a couple of times, but he was at his brother's wedding. Same on you, Lane. But he sent sent a couple of his

Shay Nehmad:

You gotta prioritize, man. You gotta prioritize. Your brother could get married like three, four times on average. But you go west twenty twenty five, that happens only once.

Jonathan Hall:

But he did send a couple representatives from Roo. Dev, so I got to meet those folks. And yeah, it was a great time.

Shay Nehmad:

Would you recommend people to like fly into the conference next year?

Jonathan Hall:

I think so. Mean, I I would love to go again.

Shay Nehmad:

Sounds like a great time.

Jonathan Hall:

It's a great time. About 120, 130 people attendees. So it's a small it feels like a big meetup more than like a large than like a small conference, if that makes sense. If that's your sort of thing, yeah, it was great. Very good.

Jonathan Hall:

So as you mentioned, while I was busy meeting folks, you were also meeting folks. And we of course did a little bit of an awkward live episode from a noisy restaurant parking lot.

Shay Nehmad:

That was a little, I don't know, not super official. Saw behind the scenes a little bit, but it was good. Yeah, I helped organize the Go San Francisco meetups.

Jonathan Hall:

This

Shay Nehmad:

is the second one I'm running already. Saw some familiar faces, Simon Law, Josh Bickersteiner of course did a talk, which I found really cool. Changed the Go runtime while like running some programs and then suddenly every time there's an assignment to a map, it prints to the screen. You know what, now arrays increase their size, like slices increase their size three times, not two times every time they need to like increase the capacity. All these cool things, I really liked it.

Shay Nehmad:

And yes, people are getting excited about the Go meetups in San Francisco again. Like I've had more than one person approach me and like, I wanna be part of the organizers, I wanna host, I wanna sponsor. Like, I don't know, feels like San Francisco went through like some downtime during, at least that's what people tell me that they lived here for a while. They had a really rough time during

Jonathan Hall:

the pandemic. Like, the city got like emptied out, you know what I mean? Mhmm.

Shay Nehmad:

And now it's coming back like really, really strong. So there's a lot of excitement about like meetups and Go and whatever. And yeah, we're already planning the next one in January. I don't know, what do you think

Jonathan Hall:

is a is a good cadence for like city meetups? In Amsterdam, we did about 10 a year. So we usually do one a month except during summer or maybe around Christmas time.

Shay Nehmad:

I'm like, I wanna do four a year. I don't know

Jonathan Hall:

if that's like too too few to get people like I think it depends on the most important thing is don't burn out your organizers. You're If you have the energy to do four, then do four.

Shay Nehmad:

I think I think I'll do one in, January and if, there'll be a bit more attendance. It was a really good crowd, but it was pretty small. One of the things that pissed me off of it, like, we had 50 people RSVP and about 20% show up. That was kind of frustrating because we ordered a ton of food and ended up going to waste. But under that, I had a great time.

Shay Nehmad:

I'll definitely do it again. And there is gonna be one in January. So if you're in the area like, or you're listening to this podcast, like stay tuned. I will update on it. But yeah, very face to face y sort of week for us the Go.

Shay Nehmad:

How do you like to call it? Meet space. Meet space, yes. All right. There is a blog post I wanna talk about.

Jonathan Hall:

Let's do it.

Shay Nehmad:

Andrew Eyre posted a blog post which I really like called, I'm independently verifying Go's reproducible builds. I think these are sort of blog posts that you're either gonna really like, you're gonna really find super boring. Well, I'll try to explain it. Do you know what supply chain attacks are? They've been all over recently.

Jonathan Hall:

Yes. Yes. Yes. Yes. How do I explain this?

Jonathan Hall:

Like, I know I know what it means. We've talked about it on the show before.

Shay Nehmad:

Yeah. So you and get

Jonathan Hall:

so on.

Shay Nehmad:

But So you have typo squatting and you have like, even people replacing your binaries like in the CI to be bad ones, etcetera, etcetera. It basically means introducing vulnerabilities, at least in software, right? Introducing vulnerabilities in code that you import and not code that you write in some level of the stack. And one important level of that stack is the Go runtime itself, right? I could replace the Go runtime to, I don't know, send me a message every time I'm open a Go routine that opens a port that I can connect to your machine remotely and you wouldn't want that.

Shay Nehmad:

And because you don't read and review all of the Go code, you know, while you build, you need something to protect you from it. What do you do you think protects you from it today? Like, because this is not something that worries you when you release Go to production.

Jonathan Hall:

Not usually. So I tend to trust I tend to put a lot of trust in a lot of things that maybe I don't deserve it. But I I guess I trust things like HTTPS to to download dependencies securely. I trust that my compiler is secure because I got it from an official source.

Shay Nehmad:

So that's the thing you trust that is a single point of failure at the moment is the go check some database. So the go command verifies that the tool chain you downloaded matches that database and the database is open, so anybody can see it. So when you reuse the go command, unless someone messed up with your go command and now we're getting into the point of like, oh, can I even trust anything? But when you download the Go binary from the site for the first time, can compare its hash because it's like posted on the site. So assuming you have the correct Go command, the Go command makes sure that it's the exact same binaries byte for byte.

Shay Nehmad:

If you had built a tool chain from source yourself, because of Google's go check some database. This blog post is all about who's watching the watchers, like who promises that Google doesn't introduce like, slip in a backdoor or maybe they even have a bug and their builds aren't actually reproducible. And these checksums are like wrong, right? So they could give you the source code on one side and tell you this is the hash on another. But if you haven't test, I actually built from source yourself and tested it, it comes out byte for byte the same and then ran the checksum and saw that the checksum comes out the same, how would you know?

Shay Nehmad:

Like, how would you know that that database is correct? Most people, including myself, I just like trust Google. And I was like, ah, there's there is gonna be someone who's pedantic enough to actually test it. And this person, Antwire, just did that.

Jonathan Hall:

Oh, wow.

Shay Nehmad:

They built all the versions and it seems like in all words. And indeed, the Go checksum is correct from Go 01/2020, up until now. They actually tested 2,672 tool change, which is pretty cool. And yeah, I like this sort of work, you know, sort of mitigating trusting trust attacks, which is a thing I like to say. There are a few problems like making this work.

Shay Nehmad:

It's not literally just downloading a thing and compiling it and seeing the results. Google has a private key, you can't reproduce that private key, you have to strip it and compare the stripped versions. And there's some like compilation related issues. There's also a funny thing that there's one Go version that isn't a valid version number. I didn't know that.

Shay Nehmad:

But apparently 1.9.2 RC2 is not a valid version, but it is a version.

Jonathan Hall:

Funny.

Shay Nehmad:

Yeah. It should be like a 1.9 RC two, but they just have an extra two there, guess.

Jonathan Hall:

I see.

Shay Nehmad:

It was released by mistake, but because it's like an append only check the log database sort of thing, you can't like ignore it. Right. So there's just a special case in the code for that specific version of Go one point nine point two, just because it was released by mistake. This is really, really cool. I love this work.

Shay Nehmad:

Also mentions, Filipa Valsorta by name, like, he seems involved in it as well. And yeah, seems like I can trust the the Go. This is a long winded way of saying the Go check some database, which you didn't even know you check against, but you do, actually works really well. But I do love the peeling the onion and seeing the, like, one layer below a thing that I didn't I I know Go is, secure, but now I know why.

Jonathan Hall:

Yeah. Awesome. Would have been a little bit different story. More interesting in a way if if he had found problems, right?

Shay Nehmad:

Yeah. Definitely would have been we would have opened with it seems like Google has slipped a backdoor into all of our tool chains. Yeah. But honestly, whenever a a blog post comes out like this of, like, someone going really deep doing a security research, and then everything's okay, I love these sorts of blog posts as well. Because it's very easy to talk about vulnerabilities, but it's actually interesting to talk to like independently verify and say, I think confidently this is okay.

Shay Nehmad:

As a security like person, when you find a problem, it's super easy to talk about it. When you don't find anything, you need a lot of confidence to stand behind and say like, I'm pretty sure this is okay.

Jonathan Hall:

Yeah. Because if it's not

Shay Nehmad:

okay, you know what I mean? People are gonna come back to your blog post and be like, that guy,

Jonathan Hall:

I'm get looking at something that looks kind of promising. It's the JetBrains Language Promise Index. I love this

Shay Nehmad:

tools and trends.

Jonathan Hall:

Did you know that Go has more promise than JavaScript? Is saying something because JavaScript has promises and Go doesn't, right?

Shay Nehmad:

You know what, I bet someone did like that. I'll look it up right now. Promise syntax in Go. Generic promise library for Go.

Jonathan Hall:

Love it.

Shay Nehmad:

There you go, Go type promise.

Jonathan Hall:

There we go. Go has promises now too. So JetBrains published recently their language promise index and a whole bunch of other statistics. I don't know what the promise index means. It's sort of an arbitrary number.

Jonathan Hall:

It says we combine growth, stability, adoption momentum, and user loyalty to identify programming languages with the biggest chance of expansion over the coming year. And TypeScript is ranked at number one with a plus two twenty three, whatever that means. Go comes in at number four with plus 115. JavaScript only has plus 15. So Go is ahead of JavaScript by 100 promise, whatever that means.

Shay Nehmad:

100 promise points. Yeah. Rust is number two, which I think indicates, this number is more like who is going to expand versus who has market share right now. Although these things that tend to be related, I think this is a pretty It's a combination of like real world adoption, but also like aspirational thinking by developers.

Jonathan Hall:

It must because like Shell is rated at plus 41 above PHP and SQL and Ruby has minus 21. Yeah. I can understand Objective C having a minus three because that kind of lost the battle a long time ago, right? It's been superseded by, I don't remember what, but yeah, don't know. Are- Slumber

Shay Nehmad:

end things.

Jonathan Hall:

Yeah, yeah, exactly. But anyway, like, I don't know. Seeing Shell outperforming Ruby is strange.

Shay Nehmad:

It's not really comparable. I am sad to see SQL so low on that list. I wish more people knew better SQL instead of like really liking TypeScript and then writing stuff with ORMs, but that's just another battle. The important numbers I saw is that something that I think a number I can understand is top five languages developers want to adopt next. So these are like the share of developers expressing an intention to adopt said language.

Shay Nehmad:

And number one is Go with 11%. Rust to write behind it with 10%, and then like Python, Kotlin and TypeScript. First of all, this says something we talked about in the right in the beginning of the show, I think one of the first episodes, that Go is very much a second language. You remember we I remember talking about blog it, yeah. Post about it.

Shay Nehmad:

Like nobody starts with Go because you have to start like someplace else and then you can appreciate all of Go's little parts of like why it actually helps you out. But yeah, a lot of developers want to move to Go. I think also like dynamically typed languages that help you like type less and do things more freely. The more I talk to people, I don't know if you got the same vibe, but it seems like they're losing their allure because people want their compilers to check AI generated garbage. It's much harder to write like garbage that won't compile in using LLMs, in Rust or in Go than it is in TypeScript, JavaScript or Python, where it's really easy to generate plausible looking like text that isn't actually a valid program.

Shay Nehmad:

I don't know what's the reasoning behind it. But I'm obviously, I'm happy to see it. More people coming to Go, meaning more, open source contributions, more usage, more bugs, more listeners to Cup of Go. I love it. Any other number you looked at at at this, sort of report that stood out to you?

Jonathan Hall:

I did see other numbers, most weren't Go related. I was encouraged to see that Postgres is finally more popular than MySQL. MySQL had a strong lead for years and Postgres is now 1% higher.

Shay Nehmad:

Great. I love Postgres.

Jonathan Hall:

I'm not sure why that is. I've been a Postgres fan for years. I suppose MySQL's acquisition and licensing issues and forks and all of it, you know, probably all plays a role. But

Shay Nehmad:

And also all the new fancy hosting stuff like Neon and Superbase and blah blah blah. Actually, don't know about Superbase, I'm taking that back. But definitely like Neon and there's a lot of like newfangled hosting, like cloud hosting companies that give you fancy Postgres, I think made it easier to adopt.

Jonathan Hall:

I I suppose we should also mention MariaDB is listed separately and it has a 16%. So if you were to combine Maria and MySQL, it would still be Postgres. So that ecosystem might still be winning if it's a battle, but whatever.

Shay Nehmad:

I think it's interesting. Like the more something is popular, the easier it is to adopt it in like an enterprise perspective, right? Or a company. So like, I'm hiring for engineers right now. Would I try to write my thing in Objective C, which has like 2% or TypeScript, which has 45%?

Shay Nehmad:

And that's a good question for Rust, right? If you think that they are, or Go, if you think this survey is correct and these languages have a lot of promise, it would make sense to use Rust or Go for your next project instead of like TypeScript or Python if you think these have a benefit because people would wanna move to it. And from a job seeker perspective, this is a bit more complicated like reading this, feel. Because you'd much rather learn a language that would be employable, but also you wanna learn the language you wanna learn, right? Like if you enjoy using, I don't know, I know a lot of people enjoy using Kotlin, for example.

Shay Nehmad:

They love the syntax, the functional approach, blah, blah, blah. So would you learn Kotlin right now because you want it and, you know, it's according to this thing, it's on the up and up, versus, I don't know, learning Swift, which is like sort of going down. Would you learn Java, which is like pretty stable and not moving anywhere? You know what I mean? Yeah.

Shay Nehmad:

Both from a job seeker and already established team, these numbers I think are. They could inform someone who's actually making the decision of should we rewrite it in Rust? Follow-up.

Jonathan Hall:

Sure, definitely.

Shay Nehmad:

So link in the show notes, you can check this out.

Jonathan Hall:

I don't know where

Shay Nehmad:

they got the numbers for these, by the way. I'm like trusting these numbers, but I have no idea where they got the numbers.

Jonathan Hall:

They probably didn't use the Go Checksum database, so these numbers might not be secure.

Shay Nehmad:

Yeah, exactly. But I don't know, I have an innate trust in JetRains, even though I hate to their IDE. I feel like they're a good engineer y company. It's just a brand thing. I can't justify it for sure.

Shay Nehmad:

All right, and given that survey, you have the link in the show notes. Let's move to a quick ad break. Like, Nosferatu mentioned at the top of the show, this show is supported by you. The best way to support the show is directly via Patreon. We wanna say a lot of thanks to the our new Patreon, Shiva Best.

Shay Nehmad:

Thank you for supporting, the show. Really, really appreciate it. You can find the link to the Patreon and all the rest of the stuff in kapago.dev, that is kapago.dev. There you'll be able to find links to our Slack channel, kapago. Our email address newskapago.

Shay Nehmad:

Dev, Our swag store, which includes brand new swag that people have been enjoying, new hats, new stickers, and the GO socks, like rooster socks, which I haven't gotten, I'll admit. I have too many socks, I just did like a Costco run, but someone wanted them. So buying the swag and then like sharing, your love for the show is, appreciated as well. Finally, if you want, you can also leave a review and a rating on like whatever app you use to listen to the podcast, or just tell about the show, to your coworkers, to your friends. If you're one of these 11% aspirational developers who's moving to Go right now, or you know one of them, let them know about the show, we would really appreciate it.

Shay Nehmad:

It's a lot of fun when more and more people listen to the show. And all the support goes to just making the show. Jonathan and I do it for fun, but it's a pretty expensive hobby all in all. And this stuff helps us pay for hosting fees, editing fees, things like that. We're not getting rich off the program yet, don't worry about it.

Shay Nehmad:

That does it for the ad break. Let's move to a quick lightning round and close out this episode. Lightning round.

Jonathan Hall:

First up on the lightning round, why I built a 39,000,000 operations per second zero allocation ring buffer for file watching in Go. Why not? Why not? Yeah. It sounds like fun.

Jonathan Hall:

I love zero allocations. Everything it's it's like it's like the new Code Golf. Right? How many is how many allocations can we get out of our our Game of Life or our FizzBuzz or whatever else you're doing?

Shay Nehmad:

Seems like you're not you're not loving the zero allocation vibe.

Jonathan Hall:

So the truth is, I think zero allocation is is quite useful for certain applications. I guess I feel like I I I've seen it before. You don't care. I don't I don't care. Yeah.

Jonathan Hall:

It's not worth not worth bragging about anymore. Everybody does zero allocations now. I don't know.

Shay Nehmad:

I think I think it's useful for specific applications. This is part of like a high performance dynamic configuration framework.

Jonathan Hall:

Absolutely, yeah.

Shay Nehmad:

And configuration has never been a bottleneck in any application of growth. Sometimes, you know, there was like a very inefficient logger or whatever. It's something you do a lot, But honestly, most of the times where like this infrastructure stuff have been a bottleneck, it was because I used it incorrectly.

Jonathan Hall:

Right.

Shay Nehmad:

So, if you have an application that reads tens of thousands of configuration variables a second, you should probably stop for a second and then ask why? Anyway, I actually like the premise of the project, like let's build a really, really high performance piece of infrastructure and then you can do 39,000,000 operations per second, blah, blah, blah, a nanosecond latency and throughput and zero allocations memory. People on Reddit really hated on it. And this is not me like doing the usual Reddit thing. I don't understand why people are like so negative towards such a such a cool project.

Jonathan Hall:

Because it's Reddit.

Shay Nehmad:

Maybe.

Jonathan Hall:

If you try to give them all money, they they criticize you for doing charity. I don't know.

Shay Nehmad:

You're trying to get me to pay more taxes? Anyway, if you if you need the really fast configuration thing or you're looking for some performance related inspiration, you can go check out this project. My thing is something, it's been on the backlog for a while, so I decided to just do it in a lighting run instead of letting it rot. A modern approach to preventing CSRF in Go. I don't know about you, but, I hate it when I develop, web applications, then I have CSRF issues.

Shay Nehmad:

I'm also very worried that don't exactly remember which headers I need to add, every time. And I like always have a task to take care of it once in every HTTP server I need to implement. This blog post like tells you at the simplest, you can do HTTP dot new cross origin protection, which is a pretty new thing, in Go. And it's like, you know, Go 01/25 introduced HTTP dot cross origin protection middleware. Just as part of the standard library, this blog post asks the question, do you need to import anything?

Shay Nehmad:

You know, just build a completely secure web application without bringing like Gorilla CSRF or NoSurf or any of the other packages? And the answer is yes, if you use it correctly. So what I would do is I would just take this blog post, go to the end where it says, putting it all together, there are like six bullet points that you need to make sure, you implement. Take them, put them in your cursor or codex or whatever and tell it, implement that. And then your application will be secure.

Shay Nehmad:

If you're interested in the details, you can actually read it as well, which I think is pretty good. Yeah, Alex Edwards, a pretty cool site with like lots of books and whatever, like, you know, let's go, let's go further, go beyond the syntax, which is coming soon. It's a good blog, period. Like, I always love looking at the other write ups here. I can't wait for the next one, to be honest.

Shay Nehmad:

So, a good one. It's in the show notes if you want to make sure your thing is If you wanna knock out Gorilla CSRF from your, like, dependencies, one less dependency, one fewer dependency issues.

Jonathan Hall:

Nice correction. That does it for the show. It sure does.

Shay Nehmad:

Thank you for listening. See you all next week. Happy Halloween. Program exited. Goodbye.

Shay Nehmad:

Program exited. Goodbye.

Creators and Guests

Jonathan Hall
Host
Jonathan Hall
Freelance Gopher, Continuous Delivery consultant, and host of the Boldly Go YouTube channel.
Shay Nehmad
Host
Shay Nehmad
Engineering Enablement Architect @ Orca
👻 Spooky integer printing and 🧛🏻 scary fast ring buffers
Broadcast by