jub0bs
LightNews LightNews
jub0bs.com
jub0bs
@jub0bs.com
2.3K followers 260 following 400 posts
infosec enthusiast • Go dev & trainer • minor contributor to the Go project • minimalist • atheist • chaotic good • trying to make sense of the Web • he/him
Blog: https://jub0bs.com
Free Go course: https://github.com/jub0bs/go-course-beginner
Free 🇵🇸!
Posts Replies Media Videos
Pinned
jub0bs.com
jub0bs @jub0bs.com · Aug 30
⚡ I've been contributing micro-optimisations to Go's standard library in my spare time: github.com/golang/go/co...

💸 I don't intend to stop any time soon, but if you benefit from my work and would like to support it, consider sponsoring me on GitHub: github.com/sponsors/jub...

#golang #OpenSource
Sponsor @jub0bs on GitHub Sponsors
infosec enthusiast • Go developer & trainer • minimalist • chaotic good • trying to make sense of the Web • he/him
github.com
Reposted by jub0bs
mvdan.cc
Interesting expansion of generics in #golang 👀
Proposal: Generic Methods for Go · Issue #77273 · golang/go
Proposal: Generic Methods for Go A change of view. Background For clarity, in the following we use the term concrete method (or just method when the context is clear) to describe a non-interface me...
github.com
January 23, 2026 at 12:35 AM
Reposted by jub0bs
thepudds.bsky.social
A good way to keep up with the Go project is this starter pack from @mvdan.cc (long-time #golang contributor).

Two other good ways to keep up are subscribing to the Go proposal review meeting GitHub issue:
go.dev/issue/33502

and the Go compiler & runtime meeting notes issue:
go.dev/issue/43930
January 16, 2026 at 3:01 PM
Reposted by jub0bs
thepudds.bsky.social
Related #golang PSA:

Gophers often mistakenly put a -u in 'go get -u foo', when they would have been better off with just 'go get foo'.

'go get foo' says to upgrade foo itself. It's shorthand for 'go get foo@upgrade'

'go get -u foo' says to *also* upgrade all the direct and indirect deps of foo.
January 14, 2026 at 4:54 PM
jub0bs.com
Developers who rely on AI coding agents to produce documentation for otherwise undocumented code, have you heard of Hyrum's law? 🤔

www.hyrumslaw.com

Can you guarantee that the resulting documentation only advertises behaviour that was intended by the author(s) and isn't merely accidental? (No.) 🙄
Hyrum's Law
www.hyrumslaw.com
January 8, 2026 at 10:30 AM
Reposted by jub0bs
jakebailey.dev
My GopherCon talk was just posted!
GopherCon 2025: Porting the TypeScript Compiler to Go for a 10x Speedup V2 - Jake Bailey
YouTube video by Gopher Academy
youtu.be
January 7, 2026 at 2:50 AM
Reposted by jub0bs
antonz.org
Accepted! Go 1.26 will introduce errors.AsType — a modern, type-safe alternative to the clunky errors.As.

No reflection. No runtime panics. Concise code. This is big!

antonz.org/accepted/err...
Go proposal: Type-safe error checking
errors.AsType is a modern alternative to errors.As.
antonz.org
December 2, 2025 at 10:07 AM
jub0bs.com
☝️Unpopular opinion: most Gophers should (re-)read @joshbloch.bsky.social's Effective Java book. Much (though not all) of the wisdom it contains is transferable to #golang.
December 13, 2025 at 3:34 PM
jub0bs.com
Difficult to disagree with this post by Efron Licht: Gin, #golang's arguably most popular Web framework, is pretty bad and should be avoided at all costs. 🙅

eblog.fly.dev/ginbad.html
ginbad.md
A good software article you should probably read
eblog.fly.dev
December 12, 2025 at 3:47 PM
jub0bs.com
Your weekly reminder to migrate from rs/cors to jub0bs/cors. 😇
github.com/rs/cors/issu...
With some CORS configurations, some handlers can introduce synchronisation bugs and cause data races · Issue #198 · rs/cors
Problem Presumably for performance, the library (v1.11.1 and some older versions) reuses some non-exported slice variables and struct field from one middleware call to the next: package-level var h...
github.com
November 21, 2025 at 7:44 PM
Reposted by jub0bs
filippo.abyssdomain.expert
So tempted to write a troll thread on how this incident shows Rust has bad error handling and wouldn’t have happened in Go, where we actually handle errors 🫣🫢😜

blog.cloudflare.com/18-november-...
Cloudflare outage on November 18, 2025
Cloudflare suffered a service outage on November 18, 2025. The outage was triggered by a bug in generation logic for a Bot Management feature file causing many Cloudflare services to be affected.
blog.cloudflare.com
November 19, 2025 at 10:14 AM
Reposted by jub0bs
agarri.fr
The release candidate of the OWASP Top 10 2025 has been released

owasp.org/Top10/2025/0...

The definitive release should be out on November 20th
Introduction - OWASP Top 10:2025 RC1
OWASP Top 10:2025 RC1
owasp.org
November 7, 2025 at 12:19 PM
jub0bs.com
"A good API should be, not only easy to use, but also hard to misuse." (Josh Bloch)

github.com/rs/cors/issu...

#golang #CORS
Near-arbitrary origins can still be allowed with credentials · Issue #197 · rs/cors
Problem PR #56 implemented a restriction regarding the wildcard; middleware created as follows don't reflect arbitrary origins (good): cors.New(cors.Options{ AllowedOrigins: []string{"*"}, AllowCre...
github.com
November 9, 2025 at 12:11 PM
jub0bs.com
Productivity tip: don't have kids; don't have cats. 😬
November 4, 2025 at 10:52 AM
Reposted by jub0bs
golang.org
🥳 Go 1.25.2 and 1.24.8 are released!

📢 Announcement: https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI/m/qZN5nc-mBgAJ

📦 Download: https://go.dev/dl/#go1.25.2

#golang
$ go install golang.org/dl/go1.25.2@latest $ go1.25.2 download Downloaded 0.0% ( 0 / 58280426 bytes) ... Downloaded 50.0% (29140213 / 58280426 bytes) ... Downloaded 100.0% (58280426 / 58280426 bytes) Unpacking go1.25.2.linux-riscv64.tar.gz ... Success. You may now run 'go1.25.2' $ go1.25.2 version go version go1.25.2 linux/riscv64
October 7, 2025 at 6:51 PM
jub0bs.com
"Bonjour. Je suis Nicolas Sarkozy, et j'ai le grand plaisir de lire 'Le temps des oranges' pour Audible." 😂
September 25, 2025 at 1:59 PM
jub0bs.com
CVE-2025-10630: REDoS in Zabbix plugin for Grafana dashboard (fixed in v6.0.2)

To anybody relying on some PCRE engine (such as github.com/dlclark/regexp2): either forbid users to submit arbitrary patterns or enforce some reasonable timeout on matching.

#websecurity #golang

youtu.be/Z_mYyBYP4ZI
CVE-2025-10630: REDoS in Zabbix plugin for Grafana dashboard (fixed in v6.0.2)
YouTube video by jub0bs
youtu.be
September 24, 2025 at 3:00 PM
jub0bs.com
🤦 #AIslop in action! Grafana's fix to CVE-2025-10630 in v6.0.0 of their Zabbix plugin happened to be way off base, but this AI tool fails to figure it out and happily lulls Grafana users into a false sense of security. www.miggo.io/vulnerabilit...
CVE-2025-10630: Grafana-Zabbix ReDoS vulnerability | Miggo
Grafana is an open-source platform for monitoring and observability. Grafana-Zabbix is a plugin for Grafana allowing to visualize monitoring data from Zabbix and create dashboards for analyzing metric...
www.miggo.io
September 24, 2025 at 2:41 PM
jub0bs.com
💡 Judiciously ponder the design of a function that operates on user input and returns a slice or a map, lest it constitute a denial-of-service vector. If you're not careful, a single malicious request may cause a huge spike in allocations. cwe.mitre.org/data/definit...
#golang #websecurity
CWE - CWE-405: Asymmetric Resource Consumption (Amplification) (4.18)
Common Weakness Enumeration (CWE) is a list of software weaknesses.
cwe.mitre.org
September 23, 2025 at 1:36 PM
Reposted by jub0bs
roland.zone
I did a talk at the UK GopherCon last month about what my team does, and I only let my laptop fall asleep twice! www.youtube.com/watch?v=oLtq...
Go Security – Past, Present, and Future - Roland Shoemaker
YouTube video by GopherCon UK
www.youtube.com
September 19, 2025 at 5:26 PM
Reposted by jub0bs
mvdan.cc
And now it looks like #GopherConUK started publishing videos!
September 18, 2025 at 12:02 PM
Reposted by jub0bs
bboreham.bsky.social
My talk from #gopherconuk is up on YouTube!
My take on how map is implemented in Go, and what changed from Go 1.23 to 1.24 and 1.25.

youtu.be/M05t7Q6LbFs

* Talk contains no AI, but does contain pictures of cats.
Swiss Maps in Go - Bryan Boreham
YouTube video by GopherCon UK
youtu.be
September 18, 2025 at 1:13 PM
Reposted by jub0bs
t0xodile.com
The recording for my latest research has been released! If you prefer to listen rather than read, now is your chance.

P.S. It may be worth listening to it at a slower speed due to my tendency to talk at the speed of light...
The Single-Packet Shovel: Digging For Desync-Powered Request Tunnelling - Thomas Stacey
YouTube video by Bsides Exeter
www.youtube.com
September 11, 2025 at 3:19 PM
jub0bs.com
When the stars align, a one-character change can have a surprisingly significant impact on performance. 🤩

In this case, omitting a superfluous index in a slice expression was enough to make the enclosing function inlineable. ⚡

github.com/golang/go/pu...

#golang
path: make Base inlineable by jub0bs · Pull Request #75269 · golang/go
This change adds benchmarks for Base and simplifies it ever so slightly to the point of making it inlineable, thereby unlocking a nice speedup. Here are some benchmark results (no change to allocat...
github.com
September 4, 2025 at 9:14 PM
jub0bs.com
⚡ If you find yourself implementing an iterator on some recursive data structure, do check out the doc comment of golang.org/x/tools/gopls/internal/analysis/recursiveiter. Very useful performance tip by @adonovan.bsky.social! #golang
The Go Programming Language
golang.org
September 4, 2025 at 7:16 PM