Go: Google's Plan9 refugees are staging a breakout

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Go: Google's Plan9 refugees are staging a breakout

Breaking Glass: Dec 15, 2021

Hughmoris posted:

For you Go'ers (or whatever you call yourselves...): do you use Go for any sort of data analytics / data analyst jobs?

We use it for logs and event analysis of pretty egregiously large streaming datasets (petabytes). I think Segment does too for data, as well as Uber for lots of different things. It's pretty well suited for getting most of the c++ performance with fewer footguns.

pprof is your friend.

# ¿ Apr 15, 2022 03:46

Adbot: ADBOT LOVES YOU

# ¿ May 5, 2024 21:35

Breaking Glass: Dec 15, 2021

Pham Nuwen posted:

Funny, I also use it for logs & event analysis. Do you work on an analysis product, and if so, do you mind sharing which one? If not, that's obviously fine.

Can't post it here but happy to nerd out over discord if you wanna DM

# ¿ Apr 15, 2022 04:00

Breaking Glass: Dec 15, 2021

They're pretty great. We used them to write a workflow system and it was a massive improvement to the prior implementation. The limitation that variadic arguments have to all be the same type is a little frustrating.

# ¿ Apr 10, 2023 23:39

Breaking Glass: Dec 15, 2021

I'm rusty on the proposal but I think it was cut from an implementation complexity standpoint rather than a design issue, but I don't totally remember.

# ¿ Apr 10, 2023 23:53

Breaking Glass: Dec 15, 2021

I guess it makes sense in that slices are also invariant. There'd have to be a runtime type assertion when accessing a generic slice, which you can just do yourself. It's still annoying for our thing's API, which ended up like:

Dep1(thing)
Dep2(thing, thing)
...

Still, having the compile time type safety did catch errors and make refactoring easier than it was without generics.

Anyway I wanna learn rust after like the last 8 years of my life being Go.

# ¿ Apr 11, 2023 14:00

Breaking Glass: Dec 15, 2021

fletcher posted:

The route I ended up going with was:
code:
git clone https://github.com/sentriz/gonic
cd gonic
git checkout v0.15.2
go install cmd/gonic/gonic.go
Slightly better I think, but not perfect, of course. Is there a "go install ..." equivalent that can install it from github? How come I need to go through this go.senan.xyz host for it?

The equivalent of this command is

code:

go install https://go.senan.xyz/gonic/cmd/gonic@v0.15.2

Under the hood, cmd/go will first fetch https://go.senan.xyz/gonic/cmd/gonic?go-get=1 (note the query parameter). This tells the web host that the HTTPS client is looking for a go module. In the response, you see a couple headers:

code:

# curl -v "https://go.senan.xyz/gonic/cmd/gonic?go-get=1"
...
<meta name="go-import" content="go.senan.xyz/gonic git https://github.com/sentriz/gonic">
<meta name="go-source" content="go.senan.xyz/gonic https://github.com/sentriz/gonic https://github.com/sentriz/gonic/tree/master{/dir} https://github.com/sentriz/gonic/blob/master{/dir}/{file}#L{line}">
...

This is what instructs the go client that the hosted code should be fetched from github. (See https://pkg.go.dev/cmd/go#hdr-Remote_import_paths and adjacent code for details, if you're curious.)

fletcher posted:

Well, the way I see it is that at least the source code in github has the opportunity for me to review it, and it has more eyeballs on it in general.

That random server though, it could be compromised and there would potentially be a lot less visibility on it.

skul-gun is correct that by requesting go.senan.xyz/gonic/cmd/gonic@v0.15.2, you're guaranteed to get the same code that is in the checksum database maintained by the Go team at Google. This is documented here: https://go.dev/ref/mod#checksum-database.

The checksum database is probably the biggest killer feature for the language, and protects you against the exact kind of risk that you are worried about. It's also independently auditable. The module URL serves as the canonical identifier for that code, and you can verify that with your eyeballs, git client, and your local cache of installed modules on your machine located at # go env GOPATH.

I always install with a specific version tag when I don't absolutely trust the source. But @latest is really handy for things you do trust, like go install golang.org/dl/go1.21.0@latest.

One last note worth mentioning is that go install is as safe as git then compiling it can be, in terms of curl | bash. No code is evaluated during go compilation like it is by package managers for other languages, such as npm.

Edit:

You check out the checksum tree node yourself, too:

code:

# curl "https://sum.golang.org/lookup/go.senan.xyz/gonic@v0.15.2"
14508769
go.senan.xyz/gonic v0.15.2 h1:oNQmvtzykWIn1GSZe1WuZDrcMV4KAnYOhbb1kLtXjz4=
go.senan.xyz/gonic v0.15.2/go.mod h1:Ik4Z2JJ92Fn7kclsQ7J8Vn8RzFukOj2kkq0nDLTBILU=

go.sum database tree
19357738
0yxtX24hWJ8X8GMTBiz7BMltZmt45gzA7IWmSNLh2U0=

� sum.golang.org Az3grpurPxcRYohe88GqMor19nIMyKhChumxTqfggY1ORJTJGCTu2VQ9hZGaG8yQwpgI/fzFfT1DKZV86PBIM9tSLw4=

If anything about this version or any prior version changed, it would invalidate the tree, and cmd/go would refuse to install it. This tree is kept up to date via modules fetched through https://proxy.golang.org/.

Breaking Glass fucked around with this message at 22:01 on Aug 31, 2023

# ¿ Aug 31, 2023 21:30

Adbot: ADBOT LOVES YOU

# ¿ May 5, 2024 21:35

Breaking Glass: Dec 15, 2021

The vulnerability database is really useful, too: https://pkg.go.dev/vuln/

# ¿ Sep 1, 2023 00:43

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Go: Google's Plan9 refugees are staging a breakout