Builds, Validation, Web3, CORS, Typescript-- wait this is a Go show?! with Paweł Zaremba

This show is supported by you. Cup This o' Go for 04/24/2026. Keep up to date with the important happenings in the Go community in about twenty minutes per week. I'm Pawel. I'm a Go developer, and, I've been listening to this show for a while.

And I'm Shay, and you're not John. What's going on? Give me my Jonathan back.

I'm not John. Yeah. I was supposed to actually be doing this with John, but I was at a conference, so I couldn't. And I moved to next week, and that's why we are here.

Awesome. Well, welcome on the show. You know, if you watch Frasier, that, old sitcom, not a lot of people watch it. So first of all, you should watch it. It's really good.

I know it. I haven't watched it.

Kelsey Grammer is a star, but it's like he's a radio psychologist. A lot of people call him and are like, well, first time caller, long time listener. This is basically you. So welcome, welcome, welcome. We have tons of news to get through actually. We have a lot of links, but let's start with this new proposal about the build version build flag. I actually don't know what it is, but it sounds exciting. What what's what's up with that?

So, there's a proposal, to add another build flag into into the Go build stack, let's say. And, it's about adding a a build version, during the for package managers, so that they could add a globally defined version into into the build. So to say the truth, I'm not really a big fan of this proposal because we already have the build VCS flag.

So it's actually Filippo Valvassori Bolg, which we had on the show in the past, the crypto open source person. I'm Filippo Valvassori Bolg. I've been, maintaining the Go Cryptography Standard Library since 2018. I've done that first at Google as the lead of the Go security team, and these days I'm doing it as an independent open source maintainer.

Okay, so Filippo Valvassori has proposed to add this build version flag to let the build process that know the version provided to the CMD go. I am not necessarily a fan of this because, like, I am a proponent of limiting the scope of an of the Go Build Builder, as much as possible.

Like, the more flags there are, the more complicated it is to use, is what you're saying?

Yes. Exactly. And it's like, we have ways to introduce the version inside the Go binaries, and we have done it for a long time. I've been doing Go since 2018, and, like, there are so many ways to do that that I don't think we we need another one.

So what's the scenario for me even wanting the build version? Like, why would I want it? Because I just go go install from like the the URL, and if I want the version, do like at and the git version. What's the what's the reason of sort like to have this, you know, version like stamping or or whatever? Is it just I don't want the build to be based on the version control system because the tag can move? Good question.

Yeah. That's that's true. But I'm I'm thinking that if you had a naming convention or, like, a versioning convention that, is different from what you have in your repository, then maybe that would work and maybe that would be useful. But to say the truth, I'm I'm not really sure. Interesting.

But the the generally, there is a freeze coming up pretty soon for 01/27. It's like April. So if we wanna get 01/27 out in, like, August normally

Mhmm.

It's gonna be tough to get this reviewed in time. So it was actually pinged to, like, hey, let's review this quickly. So if you have any thoughts about making this happen, because this is not a new proposal. This is from 2025, but it's, like, in the active column now. So actually looking at this, you know, if it affects you in any way, like using the the Go Build version or whatever, you should jump on this discussion.

Yeah. Definitely. So

you are familiar, of course, with the concept of validating input. Right? Yep. You get a request like an HTTP request or whatever, and you need to validate it to make sure it's correct. Like, might be a string, but the string might not be in the correct format, and it might be a number, but the number might be too small or too big or whatever.

Yeah.

How do you, do, like, the data validation? Do use a library? Do you just implement it ad hoc?

Yeah. I usually implement it ad hoc. There was little use for me to have a defined interface to do that. Although, I heard you don't use generics too much, but I'm starting to use generics more and more, and that would actually work for me to have interfaces being implemented by the types I am using in a generic setting. So this I don't

know what what is it that Jonathan was able to do to my public image as, like, public enemy number one of generics? It's just I don't use them that much.

Yeah. Yeah. I can understand. I can completely understand that sometimes it might be that they are not really needed. But I think for mundane tasks and the ones that we can generalise something around the type and we shove everything inside the same structure that is generic, and we don't have to worry about implementing all of the types. That's that's quite useful.

So I I agree. For validation specifically, there is a pretty nice idea where you because it's so simple, you might want to just implement, you know, a low validation code yourself instead of bringing in a heavy library or whatever, which is normally what I do. I either I use a data transfer language that has validation built in. So let's say I use ProtoBuff, then I'll use PGV, like the ProtoGenValidate thing. But as long as I'm not using anything too complicated, I do just want to have pretty simple validation.

Mhmm.

And it has a few fields. You're like one of the task fields is like interval or deadline, and you check that the interval is positive and you check that the deadline is positive, and you make sure that the deadline is after the interval. Right? Or something like that. And then you whenever you fail one of these conditions, you just like, oh, problems dot add, add a problem Mhmm.

So, actually, if I can, I prefer to to not create objects that are not, yeah, objects that are not valid? So the constructor is usually the place I try to do all my validation. And if for some reason the user input would be modifying this data type, I I would prefer to actually create a new one, not mutate the existing one. This has saved me quite a lot of times, already, and it fails quickly and very loudly. So So, like, in the new that's interesting.

And you prepare you modify it or you create new versions of it, every time you call new, you call validate?

Yeah. Basically, that's that's how it would work. So, there is little little use for me to mutate the the objects, and there is a little overhead if, if I just create a new one. Although, with pointers, there is an issue with pointers, of course, because then you'd have to either instantiate everything from the top and if it is a high frequency, low latency application, then that might not work actually.

Mhmm. And also, you don't really know. Right? You hold the pointer and then it might get mutated and you wouldn't know because you hold the address.

Exactly.

So I I I don't bake it into the, like, object life cycle or anything like that. I used to do it in the controller input. Mhmm. Like, you get an HTTP request, that's where you validate, and then inside your software, you assume that validation has passed for this specific field. This is a string, but if your validation rules say it's a email Mhmm.

Hello, everyone. My name is Quobix, and I'm the founder of, a company called Princess Beef Heavy Industries or PB three three F for short. It's actually it's shorter when you say it, you know, versus typing out. Anyway.

Yeah. So we had, Dave Kobix on the show, and he's working on various API tools that'll help you do that. But I thought it would make sense to validate on output as well, and maybe not crash the software, but just, you know, put a warning or whatever, so you know. But then I got a a lot of pushback on that on that design. People didn't really didn't like it. They were like, oh, this is the function is returning. Why do you need to validate that as well?

Yeah. So I would think that, it would be useful in a situation where you, you have a contract on the API, meaning that you should be very strict and deliberate in what you return. And if there's a chance that, this might not be, the correct type or, like, not a valid output, then do not break your clients for the API. It's better to just check it and and verify. But I'm I'm also thinking that we usually when we create APIs and the outputs are usually based on, something very specific, a specific type, and there's usually one way to render that type into a response, let's say JSON.

Yeah. There there are a lot of, like, there's a lot of, argument to be had on both sides, but definitely, you know, Filippo knows what he's talking about with this very simple interface, I feel. And before you incorporate any library or any framework or any whatever, just start with this, design pattern and then see how it goes. Let's do a little bit of meetups. You wanted to share about this community that, y'all have over, at Poland.

Oh, yeah. So, we've got a community in, Warsaw called ETH Warsaw, which stands for Energy Technology and Hackathons, and actually it's for Ethereum. It means, we are we have a blockchain, centered community that is that was created four years ago right now. And we started doing a conference and meetups, and this has been really a wild ride, I was I must say. And we meet from time to time in our new hub because we also created a hub called called Collective three.

Yeah. We will have that link in the show notes as well, but it's luma.com/eatwarso. Exactly. Not eat warso, which is the foodie community.

That would be the foodie community. ETH Warsso. Actually, we had very great reviews about the food, our at our conferences. I, myself, am a vegetarian, and we had very good vegetarian food. And, yes, we sometimes jokingly say it's eat Warsaw. Nice.

Actually, some ever since moving to America, food food and meetups has been, like, either a complete disaster. These like brands that you've heard of Mhmm. Living outside of The US, like Papa John's or whatever. I don't wanna name any ones that actually suck. So maybe Beep, the name I just said, Filippo.

Yes. Of course, what I realized a while ago is that we are not doing a catering meetup. So we want to provide some something, some sustenance as one would call it, but it's better to have less, food but good quality than, like, a lot of junk food.

Same for code, but for some reason, are still running 20 agents at the same time, Turning out slop. Exactly. At the topic of meetups, there is a Go meetup in San Francisco as well with the Go SF community that I usually host. This time, I won't, yeah, because I won't be there. But there are already 30 attendees, so you should really, really sign up. It's hosted by METER in San Francisco, May 13. I will not be there, but you can if you ever wanna enjoy the meetups without me. Alright.

Yeah. So we are in the middle of the show. So let's cut to the outbreak and we'll do the next section here because it is about middleware. So Jubobs has created CORS library middleware, for Go that is, easier to use and harder to misuse than existing alternatives.

Nice. And we'll talk about that right after the ad break. As Pablo mentioned at the top of the show, this show is supported by you, our listeners. This is a hobby. We do it for fun and to learn. I don't know how much you've learned this week, Pablo, but I've certainly learned quite a lot. But it does cost a little bit of money. It takes a little bit of time. So the best way to support us is to hop over to our Patreon and sign up. Just a few bucks a month, and it really shows your support.

Yes. I'm a lurker. Yes.

At the gopher slag, hashtag cup o go, kabob case with hyphens, or email us at news@cupogo.dev, find past episodes, find our swag store. You can find all of that at cupo'go.dev. That is our website. Another way to support the show is, to help us, like, spread it out. We recently crossed 200,000 listens.

Woah.

Oh, yes. This is crazy. That's great. It's a crazy number. And we never paid to advertise or anything like that.

Yeah. It's big. That's what she said. This

That's what she said. This is a a pretty cool month because we I was supposed to be on vacation, so we got all these guest co hosts, Paweva, of course, you Yeah. And two other co hosts that filled in for me in the this last month. And it's been really cool to have, like, a a month of what feels like community appreciation or community participation. Mhmm.

It's just organic growth, like my food, so I like it.

Yeah. Organic non GMO podcast listening. Exactly. Farm to Table podcast episodes. Alright, I want to talk about CORS, so let's get back to that.

Alright, so CORS. What is CORS? Cross Origin Resource Sharing. That's what the definition says. It's mainly about a situation where you need to source data from different domains and you need to just control the access to that so you don't allow phishing through your website.

Yeah. I, I really like this library. It also, comes along with, a blog post, he wrote called, they wrote, I guess, called, Fearless Course. I definitely feel like there's a lot of possible mistakes when you're trying to configure this stuff.

Oh, yeah.

And normally, like, it doesn't work for a client and then someone who's maybe less informed about what it does, let's say your coding agent is like, oh, let's just add, you know, star as allowed, domains. Yeah. Always. Star. Basically, meaning this is this is completely useless. Exactly.

Yeah. It's it's hard it's it's hard

to do. Opinionated yeah. Opinionated libraries are are good if they're coming from people whose opinion I respect.

Yeah. That's true. Yeah. It's always hard with, with this, CRS because it sometimes get very gets very cumbersome to configure it. And if you have dynamic domains for some reason that change all the time, then you need to do dynamic course as well. So, yeah, a good thing.

Yeah. So a cool library. It is pretty new, already 200 and whatever stars. I don't know if that's a metric that's worth anything. But definitely next time I need course in a in a web app, that's the that's the library I'm gonna reach, towards because it seems very simple to use, and with a lot of thought behind it.

I actually prefer convention, over configuration. So if someone has an opinion and I deem it worthy, then I prefer to use that than being able to configure everything because, there's a lot of things that can go wrong if you have too many, dials to

Yeah. Too many foot guns that are possible, especially with security. Exactly. In what will, I think, be the last item of the day, because we've been talking for a while, there is a new blog post from Microsoft announcing TypeScript seven dot zero beta. Wait. Why am I talking about TypeScript? This is a Go program. What the hell?

Why? Why would you do that that to us?

So, two things can be true. There are two wolves inside you. You know? One of them is dynamic programming. Anyway, so TypeScript seven is the new TypeScript, like, transpiler slash compiler.

I love that. I love that, for TypeScript. I'm happy for them very much.

Yeah. It's like, how anybody who's been working with the Python ecosystem doesn't realize, but almost a 100% of their tooling is in Rust now, like UV and Tye and all the linters, whatever, they're actually all implemented in Rust. I think it's a similar sort of situation where it's time to move to a native, language. And I tested Unlike a lot of blog posts and whatever that we share and are like, oh, test it and let us know how it goes. I actually tested it and I wanna share my recipe on how to have like a successful Yeah.

It's a feature.

Sounds great. You're forcing me to and it is faster. So if you are like me, unfortunately, stuck in TypeScript land to make money, you can still inject some Go into your life by upgrading to TypeScript seven. And I highly recommend not upgrading yet because there are some sharp edges, but I do think it's time to put it in your CI. So in two or three weeks time, the upgrade is like very obvious and everybody already has it on their machine and, you know, in your team and whatever.

But did you know that you can compile TypeScript with TinyGo. You can you can I did not? You can use TinyGo, the latest version 0.41, compile TypeScript in into JavaScript, but they the the both both teams have worked together apparently. It's possible to to use TypeScript to to use TinyGo to work with this compiler.

If you got to I don't know. TinyGo is for, like, embedded or whatever. Why not just write the normal Go? But I understand it. If you have one piece of like TypeScript and you just want to use, you know, somehow compile it into Wasm or whatever, that that makes a lot of sense.

Would you wait one minor version, like someone proposing Go? They tried to force it on us.

I don't know. It's just so fast. It's really fast. It's really fast. Alright. I think that does a show. We've been talking for a while. Pavel, thank you so much for joining, and co hosting with me. If people wanna find you, like, online other than the Cup o' Go Slack channel, where where can they find you? Where can they follow you?

That might be an an unpopular opinion, but I deleted my LinkedIn a few years ago. But now everyone is, around me is trying to force me to subscribe again, so maybe I will. But you can find me on Twitter. My handle is complicated, so probably it's better that it's linked in the show notes. It's t e g h n e t, which means t e g h h o t. If someone knows what that is, hit me up. I would be glad to hear from you, even if you don't. Wait. T e g t e g h net, n e t. No, no hyphens, no anything.

Alright. Link is in the show notes. Although, you know, Twitter is relatively divisive. I'll send you

oh, that's me. Exactly. Okay. The the picture shows exactly why. It's T. L. Greyhai T. I'm an engineer, and Star Trek I I was Star Trek is a big part of my life, actually.

Well, I will, say I want to cap off the show with live long and prosper, but there is a specific way there is a specific way we cap off the show, which is program exited. Thank you a lot, Pablo, for coming. Goodbye.