3️⃣3️⃣3️⃣ Security patches for 3 Go versions, 3 meetups, planning our 3 year anniversary!

This show is supported by you, and boy, is it supported by you. Stick around for more about that in just a moment. This is Cup and Go for 01/16/2026. Keep up to date with the important happenings in the Go community about twenty minutes per week, maybe.

Twenty? We've never hit

the fifty minute mark. We're gonna try twenty. I'm Jonathan Hall.

I'm Shay Nehmad, and my New Year's resolution is to finish this show in twenty minutes. Even though this week we have a little more to talk about. Blah

blah. Last week was a long episode. I think our longest ever probably. But more about that in just a second. First up, right, hot off the press as of yesterday. Go 1.26 RC two is out with some security fixes and a bunch of other cool stuff that we talked about last week in what is proving to be our best episode ever.

Yeah. The one twenty six overview episode seems to, like, really bring people in. So if you ever thought about sharing the show with someone, last week's episode is, like, our best performing episode yet, which I'll I don't know. I'm excited about.

Yeah. It's it's pretty cool. So we've had over 1,500 listens since that episode went live, which makes it the best episode in terms of listens for the first two weeks. And it hasn't even been out a week yet. So we blew past the the one week threshold early, early on. So share that episode with your friends. Do you

believe this indicates good things on our show or good things on 01/26? Like, it's gonna be the most highly adopted Go version ever because people like the version. Is it us or is it Go?

I don't think it's it's not me. It might be you, Shay. It actually

is a good question about the show in general. Like, were we to talk about, like, a worse language? If this was, like, Cup of Python, would people like the show the same? Or do people like the show because the language is good?

Maybe they like it better according to those dubious charts we've talked about in the show in the past.

I guess people just can't get enough of their Go routine leak protection or whatever. So what does RC two stand for?

Yeah. Release Candidate two, so that means this could be the final version of Go 1.26, which is scheduled to be released in a couple weeks or so, sometime next month probably.

Although, usually, they go to RC three and four, if I if I

remember the Probably. I mean, it's it's basically, if they find any showstoppers, they'll fix them. And showstoppers could be a a serious bug they've discovered, which the odds of that are diminishingly low as time goes on. You know, usually those bugs are discovered early. But it could also be security releases, security fixes, which is of course what the main thing happened here was.

All right. There are a lot of them. We're not gonna go through all of them, but as usual, update your Go versions, 124.12, 125.6, and 126 RC2, include all these fixes. It's like this awkward window where all three versions are sort of active, right? Before, 126 is officially in and 124 is officially out.

is By the way, Jacob, come on the show. We'd love to talk to you.

Answer my LinkedIn messages, Jacob. So the first one is in the zip the archive zip library, which is fixing a denial of service. When you parse a zip file, if you think about it, it includes all the data inside it and some, you know, headers that help you figure out, you know, what to fix, what to parse, sorry. And the algorithm that does that, the fine name indexing algorithm, is super linear, which I don't know if it's what that means. I just think it's, like, linear. Maybe it's worse

Linear than seems like like yeah. I don't know what

Linear in terms of the runtime.

Right.

Right.

And Like, linear means, like, o one. Right? So simply be like, o one n?

Actually, think linear means o of n, not o

of one. You're right. Right. O of n. You're right. You're right. You're right. So it's like it's like o o o of n times one or something. Have no idea what super linear means.

Anyway, when you construct a zip file that's maliciously constructed, you can make that algorithm just get all, hairy and cause a denial of service. I wonder who like, where that hits people because I know that people use Zip all the time. I can't remember a single time I imported the package.

I've I've imported it a few times, mostly because I had to consume something from somewhere else.

So you you would be vulnerable to this?

Probably, yeah.

If someone gave you like an untrusted zip file, you know, user upload, they could DOS your server, but no more, which is good. Same. Similar thing in NetHttp, so memory exhaustion in request. ParseForm. Again, if you provide a very large number of key value pairs, you can cause a denial of service.

I have to call something out though on this one. This yeah. It's it's only crypto TLS. Who cares about that?

No. I mean, it's important.

It was reported by a 19 old high school student.

Oh, no way.

Yeah. What do

you mean?

Koya Prunt? I hope I said that right. At least their GitHub profile says they're a 19 year old high school student. So, that's pretty cool. Way to way to get involved early.

Very, very cool. I love the genre, you know, people on the on the Internet who are like anime avatar. It's like, it's beyond my in my opinion, it's beyond my my age group already that I I literally can't understand it. Their website is, by the way, blog.gov.cooking. That's awesome. Which is great. It's also, I think, in Chinese or Japanese because I can

I can definitely claim to be in China, so I would assume Chinese, but I can't read the language, so it's the same to me?

Very, very cool RBQVQ. If you are indeed a 19 year old high school student from China and not a SIOP operation to do something else. But it is a worthy shout out. Very, very cool. I wonder what's the who's the youngest person doing Go? You know, people are getting into programming very early.

I started programming when I was eight, but it was it was not in Go, of course.

What do you consider programming? Because I did a super advanced PowerPoint presentation. No. No? It doesn't it literally had the Visual Basic script in it.

Okay. The VB script would be considered programming, yes.

Then 11, I wanna say. Ten, eleven, something like that. But Go is, like, such a second language sort of thing, you know what I mean? Like, you can't imagine someone trying to We we had that discussion. We've discussed that, yeah, yeah.

no. I've used some version in the long, long ancient history, past, ages ago. Can barely spell SVN anymore.

I used SVN a lot, which I like because now whenever I commit something and I wanna skip the the verify, like the pre commit, I do my commit mentions me, like, you know, I the command reminds me of SVN because I do git git commit minus s for the signed off, v for the verbose in the commit editor, and then n for no verify. So it's git commit minus s v n, which feels like poetic justice. And I've used TFS in the past and whatever, but a lot of people still use Mercurial or JJ or things like that.

JJ's a pretty new one though, right?

Yeah, I haven't played around with it yet, but I'm not I'm actually not anxious too, I really like it, I have no problem with it. But apparently, if you have, you know, various VCSs installed, there was a way to have unexpected code execution when you invoke the Go toolchain. Oh. Because on Mercurial, you could like download modules, you know, when you do GoGet or whatever from custom domains. And it's just because how the VCS command is constructed.

These days, all you really need to do is update your Go. Mod to the new version, and it will download the new version. And depending on how you build for deployment, that that's that may be enough as well. I also tend to update my Docker files to pull in the latest you know, the the image based on the new version of Go. That would not strictly be necessary because the go.

Sounds good. So you have a recipe as well.

Yeah, more or less. And then I often forget to do this till later, but my local version of Go, it's nice to have that on the latest version too. It doesn't matter if I'm in a Go module because it uses whatever version Go. Mod specifies. But if I'm outside of a Go module and I try to install a tool, sometimes I get version mismatches or something. It's annoying.

Cool. Alright. Now on to our second, debate. Is it Czechia or Czech Republic?

I am not the one to ask. I've been there, but, yeah, I don't I don't have any idea.

Why are we talking about Czechia or Czech Republic?

Yeah. Because they're they're they like go over there. And on April, Gopher Camp twenty twenty six will be happening. It was just announced recently. Head over to gophercamp.cz and click that get tickets button. They're actually pretty cheap. Super early bird is only €42 until January 18. You have two days. Better hurry. If you don't do that, you'll have to

pay the full price of €89. And there are group student discounts if you have a student ID. Why would I go there, though? What's Go For Camp all about?

About Go.

Well, that makes sense.

You can also, submit a talk, and then we'll know more about what it's about. So it could be about whatever you wanna talk about. The call for speakers is still open. They are looking for thirty minute regular talks, ten minute lightning talks, and ninety minute plus workshops. Until that is a little more complete, I don't think we actually know what the topics will be. We can look at last year's Gopher Camp videos to get a a sense of what it might be like. Understanding runtime traces.

It's gonna be two days now. We're talking about the tickets. €42 for two days.

I mean, if I still lived in Europe, I would be jumping on this. I I can drive I I could have driven there from where I live. I mean, it's a long drive, but I I did it before.

Technically, you know, you can drive Canada Alaska.

Technically, I should do it now with the if I include at least one ferry and several weeks of travel time.

Although I don't know if you wanna travel through the entire path right now. Yeah. Hope every single mile of it is safe.

Safe as a crib. But, anyway, I know a bunch of folks who will be easy to travel to.

So we'll we'll watch this and update you when the when the talks are there. I think at least I know of at least one person who's gonna be there, Bill Kennedy. So Bill Kennedy is is gonna be there. We had Bill on the show, of course, and if you're into Go, you probably heard of Bill.

Building a lot of trading material. I've written well over 100 blogs. I've written the books. I'm really focused a lot today on trying to teach software design as opposed to software design in Go and Kubernetes and Encore as opposed to, like like language mechanics now.

So, yeah, Bill's gonna be there as well. I won't be. Although I'll fly over, I think same dates because I'm thinking I'll be in Israel at that time. But, seems like a great event if you're in Europe.

Awesome. Well, I think that we're coming up on our twenty minute mark. It is time to move into the lightning round. Yes. Let's start.

Lightning round.

Start us off, Shay.

My thing for the lightning round is a blog post on Medium that I found very useful last year, and it's been languishing on our backlog since October 10. But it's how to get consistent classification from inconsistent LLMs. So where I work, we use LLMs for classification. So, you know, get some content and try to classify it. We have our own methods for evaluation and whatever.

I was like, awesome. Well, I have another it's also written in Go item. It's called NGINX UI, but you'll never guess what it is. I'll I'll I'll I'll spoil the suspense. It's an NGINX UI.

Yes. I mean, there is one nice thing about it other than the fact that it's written in Go, which I think is useful, which is it has an MCP server. So I could imagine, you know, you just talking in your cursor and being like, hey, can you use the NGINX MCP server and check if it's down or whatever? That could be cool. And, course, it has dark mode, which is Yeah.

That's what I was gonna call it. That's the killer feature. It has dark mode. So I I can Do

you use NGINX right now on one of your partners?

I do use NGINX fairly regularly, but not for anything very interesting. Like, it's often sort of the base for a static website container. Can

I tell the really fun NGINX bug I had? Okay. Twenty seconds because it's a lightning round. So, I had monitoring on the NGINX logs, and every now and then I saw the monitor would jump on, like, on the HTTP errors, right? So, it was looking for 503s to find, like, problems in NGINX, and they would alert us like, you know, every now and then, and we didn't know what's up because we investigated and we couldn't find any stack trace, we couldn't find any problem like, oh my God, it's a statistical crash in the NGINX server, what's going on?

Yay.

I'm stressed out to keep this in under twenty minutes. I think we already failed. We did. Well, it's a new year. You'll forgive us.

Thanks for listening. Thanks for making our last episode a big success. Continue to share the show with your friends and colleagues. That's the best way you can support the show. Honestly, I mean, I love getting Patreons. It's it's nice to have that vote of financial confidence. But just hearing feedback from listeners and seeing the numbers go up, that's I don't see. That's why I keep doing it. So we we love your support. We're happy to do this.

it this long when we started. Definitely not.

Next week will be our third year our three year anniversary.

Which, by the way, just shows, like, we've been pretty consistent as well because we've had 140 episodes. It's like 2.7 if we, you know you know what I mean? We only missed 0.3 of a year. Mhmm. It was like a 140 divided by 52. It's almost, we've been on, like, consistently every week. I don't know. When did we stop? It was, like, probably October, like, October 7 we took a while off while I was not Yeah.

Mean, we we've taken a few days a few weeks off for holidays and and for summer vacation. For

wars. For wars. Yeah. Various reasons. Cool. So, yeah, it's our three year anniversary and we decided this time to celebrate by hearing what you all have to say. And the way we're gonna do that is we posted thing on Patreon, but it's avail it should be available to everybody. We want you to send in your voice notes, just like a thirty second ish voice note. You can record it in whatever just on your device while you're walking around and send it to us on Slack or at news at cupogo. Dev.

And I think the last item we have before we close out this not twenty minute episode is an update on your San Francisco meetup.

Yes. Nepotism wins again, and we're gonna update only on my meetups because this is my show. And if you don't like it, you can If

you don't like that, send us your meetups, then we'll include them in the show too.

Honestly, please do that. Absolutely. But we have two meetups coming up in San Francisco. Go Rumors meetup in San Francisco hosted by Quantcast on January 28, 05:30PM, on a Wednesday. We would really I would really love for you to, RSVP and come.

I think so too. I think we're done.

Send us your voice notes, please, please, please. If there's only gonna be, like, three of them, we're probably not gonna do that that plan.

Sounds great.

Program exited, guys. Goodbye. Program exited. Goodbye.