It's 9-0-1, so first of all, thank you very much for waking up so early on a Sunday
after a night of beer.
So thank you very much for being here.
Welcome to the already 12th edition of the Go Dev Room.
12 years has still going strong.
So early morning I would like to start traditionally about talking what is new in the world of
Go with the state of Go this year.
But as if you are new here, hi, my name is Machia and I am a train conductor.
Why is a train conductor talking about Go?
Well, I'm actually the only person in this room who's actually paid to remove rest.
I also have apparently part time senior software engineering go but that's not important.
What's on the agenda for today? Traditionally we're going to look at some changes to our language
standard library and the go tooling as well with a small community update and a look at the future of
Go. What has been used since I last spoke to you last year, year at first them,
stoned you goal releases. One is go to 125 which has been released in August of 2025
and one is go 26 which will be released in February, which is any moment now.
And what has been you in Go since we last spoke? AI.
We now have our shoutbook to Gofer. Hello, my name is Gofer, your AI system. Here to help.
It looks like you are trying to make fun of Google's new strategy. Would you like me to write you
a good joke instead? No, no, no, gofer, no, delete, no. Good news, it's never on our day
eye this year. It's not from new fancai chatbot, it's actual new features to go which are very
welcome for us as well as for AI developers. The first new changes are to the language. We got a major
new change to the goal language this year and it is indeed already introduced new function.
Well, we've all written code like this in the past. We have an object with a counter which is a
point to an integer because it's optional and we march with a JSON or worse, GRPC. We're all used
to having these weird pointers everywhere and not code. We all know the pain of initializing them
because we cannot just do ampersand one that doesn't work. So we have written these help
refunctions in the past, end pointer, but then we have more functions. We need input. We don't
need a float pointer. We do also the boolean pointer and a stream pointer and a strategy pointer.
This is going to be problematic and there have been actual helpful libraries for this. Some good
some bad. That's a high gofer. You are absolutely right. I can generate one for every side for you.
No, no, we have a better solution. This is the new function. So the new function has been changed.
It can now determine the output type in which you define it. So we have here still our same
codes where I say my counts and I just do new one. The goal compiler sees and he was in the
front of the pointer to an integer. I have to return a pointer to an integer. So life changes, right?
That's it for changes in the language, but there is also many more changes in go and let's start
with our tooling. More importantly, we would go that. As go that is run. When we run any tests,
it's quite important to look for any changes in there as your CI might break on any updates.
And this addition, we have two new analyzers in go 125, which is the first new analyzer is the
way group analyzer, which supports any misclaced calls in your code to weight group but add,
which is ultimately a way to not being functioning correctly. There's also a second new one,
which is the host port analyzer, which finds any misaccurances of concatenating the host
with the port string, which we all know in IPv6 does not work. Oh, I go for it. It looks like
you like IPv6, which I like to use net.join host port instead. Actually go for that's a very good one,
because this is the one you have to use instead. Oh, yeah, it's useful sometimes.
Unless a little further change in the go command. And more specifically, first in the go
doc command. The go doc now has dash HTTP, which starts a documentation server on your local machine.
Wait, I am pretty sure I've used this feature in the past. And I see many of you nodding.
What happened? All are we looking? And it turns out that go doc might know space.
Had this feature already, but go doc knows space. As been deprecated since 2019.
So what happened? The feature is simply like baby.
So that happens. And then we have also some improvements to go to. The go binary will now ship
with less people binaries. It will not only ship with what you need as a central, which is the
and the compiler. What do we need more in life? Well, any other go tools that you'll use with the
go tool command will be simply compiled on first run, because a compiler is so fast.
Why would we do this? Simple. We save on download size. Go 124 on the Linux A&B64 platform with 75 megabytes.
Go 125 on the same platform is only 57 megabytes, which saves you a lot of download space
for many use cases, especially in CI, where you don't use anything else in the compiler and the
linker. Next up, go modules. There are also have been some very welcome changes to our go modules.
The first one is that we now have a new ignore directory, a ignore directive, in our gomuffs file.
It can specify some files there. There will be ignored in any general pattern matching.
However, do be careful. They will still be included when you distribute your gomages.
Go also no longer changes the go version, where you run any go module update command,
which almost plays a very welcome change. Well, go 126 goes one step beyond.
But now also changes that if you do go mode in it, it will not use the current go version,
but the previous go version. And if you are on a prenalized version, it will use two versions before that.
This is to promote any still support go versions. If you still want to let us think
great as of go, you can just manually overwrite the go version in your go modules file.
Well, let's put tooling. Now let's take a look at our rich standard library.
First of all, we have a new package, which is the same test package.
Well, this starts your tests into a certain double. And in this bubble, everything runs against
a fake clock. We also can launch many go things in this bubble, which we have a obedient weight
function for. Go for it. It looks like you forgot to delete last year's slide.
No, no, no, no, it's simply no longer experimental.
We also have a new function in HP Package, which is production against cross-site for jury
quests. That's when it's a battle. When I was young, in a sense, and very naive,
I wrote PHP. And I used to write many of these against cross-site resources for jury.
We generated random token from some random data and defy it because of the file secure.
And then we put it into a hidden input field like we did everything back then, hidden input fields
where the world turns out I'm getting old. Because there is a modern solution for this,
which is modern HP errors, which have been set with a new JavaScript fetch function.
And what do we mean by modern browsers? Turns out 95% of our modern browsers,
according to can I use already have this feature. So what is it? Every time you do a call from
JavaScript or anywhere else, your browser will set e, set fetch, site header. And that's several values.
You have the cross-site one, which is probably evil, which means a completely different domain,
long-son JavaScript codes against your API. You have the same origin one, which is,
it's the exact same host and the exact same scheme. You also have the same site one,
which means it might be some different domain. And then you have known which means it has direct access.
So how do we secure against this now, and go? Simple. Does Neo cross-origin protection
and you point it to your max handler and you are protected against these attacks? Quite simple.
Code 25 also has some new fixes in the URL parsing library. It will now reject any URLs
containing a colon in the host, like the incorrect colon colon one. It needs brackets.
Or worse, localhost 8 colon 80, colon 80, design worse. If you rely on incorrect URLs in your
goal program, first of all, stop doing that, second of all, this will be a problem change.
But also I have the same change to the reflect package. We now have two new methods.
One for iterating on fields and methods of structs, and the second one for iterating on the
ends and outs of functions. We can now quite easily get four examples, all methods on my HTTP
client values. I just do type four, which I just get back averageable methods, and I get back
all my functions which I can call, as the mean reflecting. We also have a new change in testing,
we now have the artifacts directory function, which returns us a directory. In this directory,
we can place any testing artifacts which in my generates during the tests, and we rely upon.
It is configurable using test minus artifacts, and it will fall back to default output directory,
if there is no output directory, it will fall back to a temporary directory, which will also clean
afterwards. So more welcome changes are in the photography package. The random parameter in all
your HTTP functions is now ignored. Why people have been accidentally putting incorrect
bad or just static random data in there? Well this costs all your signatures and secure
connections to completely fail based on no random data. Why wasn't there for testing purposes?
Any people who now rely on any cryptographic signatures done with static random data for
reliable testing, now need to use the crypto test patch, and this change is applied to every
cryptographic packaging go including TLS. More chains of TLS is that we now have supports
by default for these two very pronounceable cypressweets. I'm not gonna pronounce.
Basically for nobody who knows TLS, they are quantum resistance.
We also have four new packages. That's a lot. The first one is the HTTP package.
HTTP stands for high-butt public key encryption, which quite simply puts is a methodology of
combining symmetric and asymmetric cryptography with each other. When we already use this
whenever, especially in Nike every browser uses this in TLS, however, the never was a standalone
standard for this. We now have it in RCA 90180, and that means there is now a go package for it.
There is also the new R-shinds package, yet a difficult term. All since stands for single instruction
multiple data. Still experimental, but it allows you to do low level operations of this on any
supported CPUs, which is currently on the NVC4 platform, only with CPUs. Which allows you to do
very complex, but the cooperation is very fast. If you know what this is, you'll probably
very excited if you don't know where this is, just ignore it's math.
We also have a next experimental package, many new experimental studies here, which is the
secret one, which allows you to create a secure facility in which you can compute any secrets,
which will then be securely erased from your memory after your calculations are finished.
It currently only works on the Linux I&D64 and ARM64 platform.
And it is intended for forward secrecy. Let's take a closer look.
Well, what I'm writing today is a VPN, and I just got my peer propublic key, which is public information.
What I need is now my public key, and private key, private key, we're going to delete,
and it's a shinkie. So I create variables for those, those are books, public or semi-public,
so I want these in my memory. Now the secret part starts. What do the new secret that you,
and I put a function in that, it writes in that. But I'm going to do that is I'm going to create
a private key, an object, a arrow. And I will create a shark key by doing an
if you calculate the curve, if you have one hand shake, perfect, soft, so I can generate a shark
secret. From there on, I will do some more cryptographic, moon will jumble to create a
my session key. And then I just say, okay, I also need my public key as well. So you
have some variables above. However, that shark secret is very secret, and the primary key is
even more secret. So we don't want those in memory. Functionants, and go just erase these
securely for memory without even waiting for the garbage collector. What is only remaining in my
memory is my public key and my session key. The only have been in my memory were a very short time.
However, with gauge crispness ability comes quick care. Use this quick care, because if you
use it on multiple platforms, the functional executes, but keeps you no security guarantees.
If you use global variables, you have no security guarantees. If you use a new
gorton in there, there are no security guarantees. If you do go exit, and you don't properly
delay, it cannot erase it, so there are no security guarantees. If you use any references,
which have been still being referenced, it's still down, and no security guarantees. If you
cost any panics, you data may leak, and there are no security guarantees. If you use any pointers,
then correctly, they may leak, and there no security guarantees. Please, with the fucking manual before
use. I hope if you write this kind of stuff, you do that already, just pointing it out still.
That's it for our standard library, but there are many more changes in the go runtime.
And the first one is for panics. Panics, that were recovered, then we panics, now no longer
get locked as to panics. Then now get simply locked as recovered, comma, we panics.
Which I just hope you will never ever see in your entire life.
There's also a compiler bug fixed, which has been there since go 121. And it's breaking.
What happens since go 121 go compounds and executes incorrect code? I was very surprised myself.
It's caused by incorrect delay new point checks. I couldn't believe this, so I went to try it out
myself. I wrote that code again, which I do every day. We are trying to open another system file,
which means that F will be new, and our error will be something.
But then day is I want to file name, because I want to print that, so I take name is F.name,
and then I check the error. And then I check the error. This right there is a very clear new point,
right? What happens if I run this? It will, I run go 124, error opening file.
Okay, that's an error, but that's for the correct error.
Important error. Okay. Okay, this is wrong, because I have a new point right here, and let's go check.
So when I run go 125, I now get the correct error, which is actually a new pointer.
Did you some delay check? Code would actually completely allow new pointers without any issues,
which was incorrect. The profile also comes in the experimental changes, which is a profile
to look for the gore teams. If you have any gore teams, which you have not properly closing your
codes or still running in the background, you can now use this profile to look for the new codes.
That's currently experimental, and it aims to be GA in the next release of gore.
There is also heap address based on the visualization, which will take change the
be based address of your heap into your memory for security purposes, because if the run, if the
address is random, any memory based attacks are easier to, is it too, not easier to do?
The next section I would like to call Fausters Smaller Better, which is a new section
I'm introducing into the state of gore, as gore is getting Fausters Smaller and Better every time.
So let's take a look how gore this year is Fausters Smaller and Better.
First of all, go now on support for green tea.
I can generate you a picture for that, yours is ugly. I can use nano grass for it right now.
No, gore, no, no. This was an actual message given to me by Google Slides by the way.
So what we have is now the green tea gouge platter in an experimental release and go 126.
What is it? Well, it's like it's aims to be 10 to 40% Fausters when using NA, GIC Heavy Workloads,
which sounds very interesting. How does it work? I have no idea.
Yes. So I have two options. I could either start Googling or ask AI. Just invite my best friend
Jesus here, which will be here at 10 a.m. explaining everything inside and out how green tea works
in this stage here, problem solved.
Next up is Fauster photography. If you use any show one hashes, then now 2 times Fauster on the NA 64 platform.
If your CPU has hard press support for it. Charge green on your hand is now 2 times Fauster on
the Apple M124 processors. Which is very welcome for TLS.
Sigo is now also used over at off around 20% less. The JPEG encoder in the decoder is a completely
rewritten. And it's now replaced by a more accurate Fauster lighter, better newer Fauster implementation.
This is a breaking change. If you rely on checking in your test, buy buy buy output of the JPEG package.
Otherwise it just a very nice change which you get for free.
Yeah, package. Now also has a very welcome update. Do the read all function.
The read all functions now allocate way less memory and returns the minimally sized final slice.
In practice it will be around 2 times Fauster than the previous implementation
and use hard as much as memory. Ideal for reading your big files at once.
Talking about memory allocation. We now also have more Fauster memory
allocation for small bytes which mean around 512 bytes or less of memory by using a special size
based allocation on the hardware size. Which will result in practice in around 1% Fauster
runtime in heavy based allocation programs. However, this increases our binary size by around 300
kilobytes. Which goes actually pretty recently given our binary sizes at the average 300 kilobytes
is reasonable. Next up, let's take a look at some GoPort changes.
So one has been a new decision. Go125. Now we will require macOS12 Monterey
our later. Go1256 removes the broken implementation of Windows ARM32 for the snapdragon
used out of us. It's ARM32 ARM64. Go1256 is now also added to the race detector to the
risk file platform on Linux. But it marked the risk file platform on free free is the as broken.
Go1257 the next release will require macOS 13 Ventura our later. And it will remove the
PowerPC 64 big and the M platform. For the 5 PowerPC used in the world, this is the big
and the insistent button little and the insistent IBM for some reason came up with two architectures.
And there are some value welcome changes to little containers for once. This is new in my
port section. I never talked about containers before, not in my life, it's talk.
So we have this new making change in Go1255. So we have this very handy variable in Go which is
the GoMax processes. Which links to your maximum seen links to the number of physical or
logical CPUs in your system. Which is very handy when you use any Go routines and you want to use
the most of your CPUs, you just say as far as many Go routines as their processors,
they put all your workloads in the app. Pre-1255 is possible, this is just your physical number
of CPUs in your system. But then I hear you are asking, what about Kubernetes?
What if I write my Kubernetes deployment one, so I have in my first deployment and I put in some
limits. You're doing Kubernetes and if you don't have a problem. If you put in a limit of maximum
one CPU, logical units and I only request to run CO5. What we will do in Go right now
we'll just give you your 100th track course on your AMD processor. That's all we want right.
So what is now changed in 125? If you're CPU bandwidth in C groups, which is either set with
Docker Kubernetes or your favorite container engine, if you're a C group CPU bandwidth is higher
than your number of physical CPUs. First of all, it's weird, but okay.
Then you still have the maximum number of physical CPUs as your Go Max process file.
If it's lower, it will use this limit. Which means if we do this deployment,
I will hear have just one CPU set as this is my ultra-most limits in my deployments.
Please keep in mind speaking as people, the request is ignored and go as it's not the hard
enforcement. But what if I change it? Good news, Go will automatically update
the variable during the runtime. So if you change your bandwidth limit during the runtime
of your program, Go will actually try to make your program faster again.
That's it for this year of Go releases. But now let's take a look at the future of Go.
And I couldn't find many new white 10-year visions. But what I did find is a very interesting
new change, which already is experimental. But I want to give it a separate section,
which is JSON V2. This is now an experimental already, released in Go 126,
and the Go team encourages you strongly to find your usage and find any more buffs.
Why not GA? There are still many outstanding open issues which have been found by the
community, which is causing it to not be GA yet. So what happens here? Well,
JSON V2 is a completely re-implemented JSON implementation in Go. Why? Well, turns out that JSON is
a popular. It's now the fifth most used package, they include 70, in Go.
And it has issues. So how are we going to fix this? Simple. We throw out the bats, we keep the
goods. Okay, we keep the goods and throw out the bats. Let's try doing experiments and try this.
What is good about the JSON implementation? Well, I personally love martial and martial.
They work, you put something in there, something comes out, it just works.
What do we also love? Struct X. Just an amazing invention. Just be able to pass your JSON
immediately into a start by adding some simple text to it. Honestly, it's the main reason I'm
ago developed these days. It's those struct X. What is bad about it? Everything else.
But for us to have an idea of what happened in Go, what was wrong? We need to look at what
happened in JSON itself. For JSON started back in 2001, and what happened here? Somebody looked at
the web and said, hmm, all these encoding standards for data, they know that goods. I can do one
better. And that's how standards play for it. So what happens? There was a standard about JSON.
Let's do some JavaScript-like object notation. Well, it only took 2006.
Jelly was put in the first RRC standards. Okay, now we have finally followed the
finishing. That is not on some random website. What JSON is? In 2014, well, JavaScript. So the
Agma standards body also released a standard code, which Agma 404, not found. In 2013,
immediately followed up by a correcting RRC, which made changes to the Agma standard,
it was in 2014. And there are multiple ones in between, even. In 2017, RRC 8259 has been released,
which is, I had an order of C, defining how JSON should look like. I used JSON on daily basis,
like, wow, I'm really surprised that it was that complex. And to follow up, there is now even an
ISO standard to find a JSON. However, it was paywall, so I could get a picture of it.
Actually, imagine it looks something like this. So JSON itself was never really properly defined
until the late 2017's. So what cost many of this is this RFC flow, because it has been more
than 10 years old. Yeah, JSON has been changed over a lot over the last 10 years.
What is currently bad enough, we want implementation. In valid UTAV, it is a lot.
According to DRC, that's an absolute no-go. It accepts duplicate member names,
duplicate field names. As a absolute no-go, according to DRC, and even cost security issues in all
the products. New slides will become no, which is according to the developer survey,
not code developers would like. JSON parsed fields also are in case sensitive,
which I was really surprised by but it's true. And the Marshall JSON function which nobody knows,
because it's for strikes and it's incredibly cold, so nobody uses it. The way it is more.
Well, it also has many inquiries of the decode function, because people do not really know
how it works, so people make many mistakes against it. Well, the anchoring decode function in JSON
has options, but the Marshall and Marshall ones don't. There are so many performance issues,
the Marshall and Marshalling JSON. There is also no JSON streaming support for very large datasets.
Help! We cannot just change this. Why? We have this go-one point no-go compatibility promise.
Any program that is put into the go-one specification will continue to compile,
I run correctly unchanged for the lifetime of go-one point though, and as far as I know, we still don't
own go-to point no. So we cannot just rewrite as all because this will break implementations.
What we can do is just release an impact edge, which is the V2 package.
And this has been a group effort from around the go community for the last five years.
And this is the result.
Ferry clean implementation, Marshall, Marshall, right, Marshall and code,
option sets, different availities for using things, same with and Marshall for the same.
With the very complex and solid back end on it.
What has been fixed? We now have support for custom Marshallers,
for any weird special structs. We now have unmashing it at 10 times faster than before.
There's also a very strict adherence to the latest RFC. We have case-sense did matching,
new slides and maps will become empty arrays and objects.
We have only empty, which allows us now also to any node types of empty string,
empty slides and the objects. And there are also been some issues faced with time duration
parsing. So yes, I want to get started now.
Perfect because there is a very long and well-written migration guide for this.
How to migrate your JSON implementation to JSON V2 and any pitfalls you might find.
But what about the old one?
Nobody wants to implement the usage of JSON. Not in go nowhere. Nobody wants this.
What will happen to future is that V1 will gradually be rebuilt,
to use the V2 system as a back end, but still have the same behavior.
V2 migration is thus
encouraged. You should try it, but it's not a lot of requirements. You can still use V1.
As T1 will be supported throughout the whole life of the go 1.0 ecosystem.
That's our changes to JSON. And now at last let's take a look at my favorite one,
which is our community. I have a map of all go meters in the world,
which is getting hard on how to track because V2.com is not up up here anymore.
People are using different platforms. So this is something I try to keep up with.
Same for the go and go bridge, stay remain about stable.
But I want to talk about my favorite community, which is you all, are for them community.
It has been 12 years, different rooms, but we have come up with some amazing traditions.
So many recruiting speakers, many more recruiting attendees,
have been here for the past 12 years, even throughout the pandemic, we kept on going and going
till here, so pictures from last year, but you wear this slightly more bigger room.
This is a picture from last year, and this year, you can just go outside.
Let's hear AI work, AI agents, AI agents, what you talk for you.
Which many of you did?
Warning, this may cause extreme inaccuracies.
I have for you today an amazing lineup of my best speakers. I got to reject some very good speakers as well,
so I hope we have a jump back field day with talks that are amazing.
And last year, I tried to come up with five mini tracks in this day.
So the first section is about go, which is now finished, with over time.
Next up is the deep dives, because it's morning, your mind's still fresh, so we're now getting very deep
due to the technical degree. Our lunchtime, we have a security track here, while we have two talks about
go security. Next up, we have using go, and we have an hour of tiny go-com today.
And the last half hours, I'll about you.
So you've got a taste for go-com process.
What go, all the go-com process out there? If you're joining, please be a little bit quiet, thank you.
We have the year today to go that room, at first them, you are here, please stay.
There is also the next conference, which is go-for-cap in the Czech Republic,
which will be from April 23rd to 34th.
We have go-for-come Europe, which we have in Berlin, this year from June 15th to June 18th.
We have go-for-come US and Seattle this year, from August 3rd to August 6th.
Then we have go-for-come Africa in Johannesburg, which will be if you guys should fight
very quickly from Seattle, August 27th. Go-for-come Latin America will be held in Brazil,
which is September 2nd to 4th. Go-for-come Israel will be held in October 18th.
And go-lap in Italy, Bolonia will be held from November 4th to November 3rd.
The last part of the day is lightning talks.
Our CFP for the lightning talks has just now opened.
If you want to submit a lightning talk, if you have an ID for a talk, if you are coming up with an
ID for a talk, if you just want to have a talk where you talk about your latest go-go-you-choreals,
you can do so. We have five data talks, which you can do, find at go-for-the-plats-slides.
Good you are now feeling the form and request that you want to do a lightning talk.
And now go-for-slides just blocked.
Nope, one before, one before.
Okay, I'm going to split the slides you didn't have to propose.
I gave up.
Nope, no, no, perfect.
If you would like to talk about the go-devil one social media today,
you can just use hash tag go-long hash tag for the $20 on your favorite social media.
If you would like to follow the Fediverers, you can find us at go-devil.x4sonon.org.
And if you are on blue sky, if you're still a sticker for that, you can find us at go-for.lap,
which just redirects back to the Fediverers, which is the only two open social media.
Listen, I would like to thank you very much for listening to my talk and enjoy the rest of the day.