
This show is supported by you. Stick around till the ad break to hear more about that. This is Cup of Go for 07/04/2025. Happy fourth of July, everyone. Keep up to date with the important happenings in the Go community in about fifteen minutes per week. I'm Shay Nehmad.

And I'm Jonathan Hall.

And thanks a lot, Jeremy, for covering last week. Man, I just finished listening to that episode on my bike ride over here. It was really good.

You did a great job. Thanks, Jeremy.

Thanks for covering, man. I was in Seattle. I was having a great time visiting my cousin, but I am itching. I'm itching for some Go news. Lay it on me, gentlemen.

Alright. The first thing up, I'm excited about this. I've been waiting for this for so long. Versus Code Go version 0.48 is finally out. Why do I care about this? I usually don't care, but this one supports Golang cilent v2. So no longer will Versus Code complain about invalid syntax in my Golang cilent configuration. It'll work now. So I'm excited about this. So we had the interview with Eldez a few episodes ago.
Of course, we'll have a link to that in the show notes if you missed it. The maintainer of GoLang CLN. I can finally use all those features we talked about in that episode. I'm really excited.

And what do I need to do to get it?

Just install it?

To upgrade my extensions? Yeah. It's pretty straightforward. Cool. Well, the main thing I I am looking forward to, is, you know, all these extensions working on my Versus Code cursor, fork of the week.
It's actually become a problem, like, managing all the extensions and settings in between all these different instances, but still an improvement. So, Olivia Mengui, one of the listeners of the show, and I'm probably butchering that name, sorry, my man, just published a new, security vulnerability on the Golang issue tracker. And surprise, surprise is about the path, sanitation and, expansion and all that good stuff, but it is, like, subtle and pretty interesting. So you and you should care about this if you try to, like, exec commands using, the look path function. So if you're if you might be running external programs and, you know, if you especially in a security sensitive context, right, if it's a script you're just running, you probably don't care.
We should probably be aware of this issue and audit your code to find it if you're using the, look path function. Now what does the look path function do? So you have OS, right? OS acts like a look path, which is meant to locate an executable. That makes sense, right?

Yep. So it's kinda like the witch command in in bash or something.

Yep. What do you expect to happen if you pass an empty string?

I would expect it to either return an error or probably an error since we're Or maybe nothing, right? Maybe Yeah. If it was bash, would expect nothing. But since it's a programming language, I would expect an error to say that this isn't found or something.

So Olivia found that if you shove an executable into the path environment variable, it will return that executable, which is like crazy behavior, honestly, like super weird. And you can imagine this, like with the the flow, which I think is most reasonable, it's a subtle security issue because you need to control the path environment variable to make it happen. But if you're running on a server which reloads environment variables every now and then, which a lot of them do, especially like in Kubernetes environments, I assume, like the the way I'm seeing this being exploited is you install some Go library in your in your project, right? You use some function, and that function just messes up with path. It's like a supply chain thing where you don't see it in the code, but it's like it it messes up with your path.
And then, you know, once and forever you do look exec because you're you're like exec look path to try to find an executable and it's using external strings. You get an empty string and it runs that executable. I'll push like my, I don't know, my malware into the bin, and then you run look exec, you know, someone sends you a message and you run look exec to find that binary on your server or something before running it, and accidentally you pull that, you know, that my malicious executable. Super cool. You know, you would expect like if the command name is empty, it should fail.
But if you just mess around with a path and you push a malicious program path into it, like an executable, it just gives you that.

That's weird. And it's like and I can completely understand how that bug got put in there because it's not the kind of case you would normally think about, right?

Yeah. I mean, I don't know. Whenever you get a string, you should probably test for empty case, dot case, very long string, Unicode. Like, you should have a bag of tricks.

I can easily see the person writing this code thinking, of course, my path is a list of paths and not executables. So if I append the empty string to it, it'll still do the right thing. Yes. Could I could see that that that reasoning.

So this is a very interesting security vulnerability by Olivia, and I hope to see it get resolved soon other than a pretty good bug report because this is complicated, and I wouldn't have understood it if the bug report was written like worse. Olivia already has a proposal to fix, is just to rule out empty and dot values immediately without like even worrying about it. Just like, just do it. Don't allow the the path to be like empty or dot or dot dot or whatever. Yeah, makes sense.
Which to me makes sense. Like this is clearly not what the function was meant to do, right? So it's okay to special case that out. But whenever I see these, I'm like worried, you know, oh, maybe in some case I'm missing, right? What about dollar? I don't know, whatever, paths are complicated. But yeah, very cool vulnerability. The link is in the show notes if you want to. If your code is like, oh, I have that vulnerability, maybe publicize that in the thread. That'll be a good idea.
Yep. Cool. And thanks a lot, Olivier, for sending it this our way. We appreciate your listening and thanks a lot.

I wanna talk about a proposal. Oh. We don't do a lot of that lately. We're we're in the middle of a freeze to go. 1.25 is about to come out, so there's not a whole lot of activity in the proposal space, but there's one I wanna talk about. I think it's interesting. Do you remember the GoFix subcommand?

I honestly don't. I don't think I've ever used it.

I probably haven't. And if you have, it's probably been so long you would have forgotten anyway. But go fix is a command that will update your Go source code to adopt new idioms as as the Go language evolves. A simple example we could probably worth mentioning before the context package was was added, we had the golang.org/x/net/contextpackage. And if you ever work on really old code bases, you might see that mentioned a few places.
So go fix would update that import path from the old to the new when it was added in go 1.7, if I'm not mistaken. So this is this is old school stuff. But the go fix command would do these sorts of things for us, which is kind of handy. There's a handful. There's a bit like, I don't know, a half dozen or so, maybe 10 things that it can fix for you.
The thing is that most of these things are fairly obsolete or old, like I just mentioned from Go 1.7 and other old versions of Go. It hasn't gotten a lot of love lately. So the proposal is to make the Go fix subcommand do nothing. Literally remove all functionality. Why would you want to remove all functionality from a command like this? Zero bugs. Zero bugs. Yeah. No code, no bugs. The longer term goal here is to remove these old things that aren't necessarily needed anymore.
In a couple of cases, they might still be needed, but they could be handled by other tools. But leave GoFix to handle new functionality. So you may recall we spoke several weeks ago about the ability to add new markup in your Go source to say that this thing now should be this other thing, and it could do some automatic renaming. So that's that's related to this is that this Go fix command could be used to do those sorts of changes for us as well. So anyway, I think it's an interesting proposal just kind of on the face of it to remove all functionality from a subcommand, but not remove the command.
I think, is kind of an interesting thing worth worth looking at. The reasons, of course, do make sense when you when you take the time to understand it all.

I can, like, imagine someone in, like, five years being like, why why what is this command

doing? Like, you know? Yeah. We we remove the functionality that forget to add new stuff, and it's just sitting there empty for five years.

Yeah. Not the worst thing you you can forget about. I wanted to mention a very good blog post. Like blog Last week, with Jeremy filling in for me. You guys tackled, Anton's old new content, right, the interactive show notes and the JSON v two thing. And and you mentioned you have, like, a ton of knowledge about JSON parsing and and all that stuff. You even wrote a book, blah blah blah. I feel like this is the blog post version of your knowledge in a sense.

Oh, okay.

It's from the Trail of Bits blog, and Vesco Franco, I hope I'm saying that correctly, wrote a whole write up about JSON, JSON v two, XML and YAML, about like surprising behaviors and what do you do with them and how do you mitigate them, etcetera, etcetera. With when I say surprising behaviors, I mean things that are related to like serializing and deserializing CVEs, etcetera. With cases like duplicate keys. Right? Like, what does JSON do when you try to parse duplicate keys?
Do you know the answer, like, top of mind?

In JSON v one, you mean?

Versus JSON v two.

So JSON v two is configurable, I believe. In JSON v one, I think it just honors the last one, but I'm not a 100% sure.

It is. That's the case, which is kind of weird. And the cases, you know, these sorts of cases are kind of hard to understand because usually you need to have, like a setup, a server and some parsers and some things going on to actually explain why this is a problem. Right? And the reason I recommend this blog post is because Vasco went through the hard work of actually detailing, you know, with charts and examples, how this will get actually used.
So if you're talking about the parser differences, the trailing garbage data, like all these sorts of things, unknown keys, It shows like the JSON, XML, and YAML versions of it. And, you know, what do you do with the leading garbage data or trailing garbage data? And how does that how could that be used? Right? How do you misuse omit empty by accident?
Or what do you do with case insensitive key matching? Which is very surprising. That was the part I didn't know is that because you can have duplicate fields and the parser is a case insensitive, you could have the a field with two duplicate keys. One of them is wrong with like Unicode characters, uppercase, lowercase. You know, you pass the correct key casing with one value and the incorrect key casing later with a different value.
The proxy service, which is written in Go, you know, parses the second value, but the actual service behind it might not be written in Go or it might have a different version of the parser. So it might take the first one. So you could in the first one, put something benign like user and in the second one, put something horrible like admin, right? The Go and the Python implementations will see different things. So if you're like, it depends on where your decision is, like, where's the proxy for auth and where's the actual server, you could like make them actually confused.
And if that sounds a bit confusing, the charts in the blog post make it very easy to understand. So please do do that. Just go read the blog post, it's super great. And if you wanna skip the entire like understanding of it and just tell me what to do, you can scroll to the last part, which just says mitigations and a list of recommendations like prevent parsing of unknown keys, prevent parsing of duplicate keys, prevent case insensitivity. This one's especially important.
And if you use XML, like trailing data and leading like garbage data, the front and back, prevent them as well. So and the main takeaway is watch out for v two, because in V2, many of these have safer defaults, which is the sort of things I wouldn't think about, but I mean, that's a great reason to start upgrading and maybe even start with the experiment right now. Last week you mentioned all the performance enhancements, but like all these security considerations are

super important. Exactly. Yep. Cool. I'll check it out. I'll read the whole thing.

It's pretty long. It's like a it's not a phone thing. You know what I mean? It's like a coffee cup break in the work 15 sort of thing, which our episode might be for you, and it's coming up on fifteen minutes. So let's jump to the, lightning round.

Alright. Let's do it.

Lightning round.

So first off at the lightning round, we have a blog post from Brander, brander.org. That seems to be his Internet name. Don't know his birth name, but he doesn't seem to want to tell us. So Brander, it is. Go don't name packages common nouns.
Have you ever had that problem where you're trying to use a variable and then this is also a package name? That happens to me all the time with like URL, for example. I want to do URL colon equals URL dot parse and I can't do it. Or server is a good example too.

And then I end up doing like, like, just take out all the all the All the vowels. Vowels. Yeah. All the not the vowels, the other ones, the consonants. Take out only the consonants.

Yeah. Yeah. So anyway, the whole point of this blog post basically is don't name your packages with common nouns. And he offers it's it's not quite that simple. He offers some suggestions on what to do instead. His main suggestion is add words. So if you have a rate limit, call your package rate limit instead of rate. He uses the example of an actual package that's called rate. He doesn't like it. It should be called ratelimit.golang.org/x/time/rate. He thinks it should be called rate limit.

Do you agree?

I think I do.

But can't you solve it by importing it differently in your thing?

You can. So in principle, I agree. Whether I agree this specific example, I'm not sure. I'd have to look more closely at what the package contains. I don't I know I've used it before, but I don't know if it's quite right to call it a rate limit because I think it does more than rate limiting.
But in principle, I agree. And there are several neat characteristics about his his proposal. You may recall that standard advice for Go variable names is to use camel case, right? So if you have a variable called rate limit, the L will be capital. But the same advice says that package names should be all lowercase.
So you won't even have a conflict in that case. Just by simply adding two words, your package names, you never have a conflict if you follow the standard advice when you're naming your variables. So that's kind of neat little trick there for people who follow that advice.

I tend to if my Go package names have two letters, I'll put like a dash. I'll like kebab case them. I hate it when you don't put a space between two words, but you can't put a space in a package name. So I I use

Is it underscore?

Dash. And I don't think dash is cool for variable names. So that's

why I don't think you can use a dash in it. Think you have use under Oh,

maybe. Oh, I don't know. We need to check.

You could then in the path name, but I don't think for the import name. I think the import name, have to use underscores.

That's true. That's true. But I'm mostly interested in the advice for the internal packages, because I'm I I hate, but it's so it makes so much sense. So at the bottom of the blog post, he mentions for internal packages, just like start with the prefix of like your company or your project. So I don't know.
I work at ops and security, so all my internal packages should be like, oh, client, oh, DB, oh, limit, oh, lock. And then it will never like because that doesn't make sense. That's not a word, right? O test. But then, I I don't know. I hate it, but it like makes so much sense.

So I struggle with this Having

a package called server and then I can't

call my variables server. So I struggle with this with things like error and log, where I want to augment the standard library very frequently. Log is a great example. I want to add some constants for common field names. I want to add some helpers and stuff like that.
And I go back and forth between whether I should create a package called log that aliases everything in the center libraries log package. And then I have my linter say always use our custom version. Or if I should do something like PLOG here or whatever. I honestly, I don't know. I go back and forth. There's pros and cons to both both ways. I'd be curious to hear what our our listeners think on our Slack channel.

I would hate it, like, for the first week, and then I'm sure I would be very happy with it, like, in the long term. So we're not adhering to our normal lightning talk, lightning round thing, which is, here's a cool link, review it. We just talked about it in detail, but it's just like such a obvious thing. I wonder if you could even put a linter on it. It'd be like, package is common noun.
a reasonable rule, but it might be a little bit hard to enforce, but it's definitely a good guideline in my opinion. It's like very pragmatic and a good guideline.

Yeah. Yeah.

My lightning round thing is also gonna be a bit controversial. We have to talk about it for a while, is another like super base, Firebase alternative. But luckily it's just a toy project. It's called Pennybase, poorest men's backend as a service, like Pocketbase and Superbase and Firebase. I think we talked about Pocketbase specifically in the past.
It's a 100% written in Go, advertised in Reddit with like zero dependencies. And, you know, it's just like a web app and instead of using Firebase or Superbase, they just built like a toy one and fully in Go, which is really cool. The thing I wanted to highlight is the first, comment in Reddit, which is too late, already using it in production. No big comment goes You

heard it from the official source. It's production ready now.

Used across thousands of production things. Alright. That does it for the, Lightning Round. We have a short ad break, but stick around because we're talking to Mariah and Derek about the Go West Conference. Very cool interview. Alright. We wanna skip the ad break because we wanna get to the interview. So this show is supported by you. You can visit Patreon and give us some money to keep running the show. You understand how we use it for hosting and editing.
You can also buy some swag. We're looking to increase our swag offering, so if there's anything you'd wanna buy, when you listen to the interview, you'll know why, where I suggested some cool new swag ideas. Let us know. Like we use a printer so we could probably set that up if they have the option. Share the episode because we don't pay for advertising.
So just let people know about it. In your Twitters and your whatevers, also rate it on the apps, whatever app you listen, whether it's Spotify or Apple Podcasts or wherever. And we wanna shout out our Patreon subscribers. Thanks a lot for helping support the show. This is a hobby, it's expensive hobby, but we really appreciate you helping us cover all the costs. That's it. That's a minute to the interview. Here we go.

Shai, I've been listening to some music lately and I can't decide which is better, the Pet Shop Boys or the Village People. Who do you prefer?

I guess Village People, if I had to

choose Village People? Yeah. Yeah. I wish we had somebody here who could break the tie because I was thinking Pet Shop Boys. We need somebody to break the tie, especially the song Go West because that's just the the best song that either group has ever done.

So we need Go West experts is what you're Yes.

That's what we need. Oh, hi, Moriah. Hi, Derek.

Hi, Derek and Moriah.
Well, hello.

So which is your favorite rendition of Go West?
Probably the Pet Shop Boys.

Yeah. Alright. We got two for the Pet Shop Boys. How about you, Moriah? Are you gonna make this a tie or are you gonna are you gonna weigh in on the right side of the fist?
No. I'll play Pet Shop Boys. It's the unofficial comfort zone. There we go.

Unofficial. Alright. Once again in the minority, no problem. I'll stick here with my Vime bindings. Mariah Derek, why don't you present yourself, to the to the listeners other than, being, you know, music aficionados apparently?
Yeah. I'm one of the cofounders of the Go West Conference, Mariah Peterson, long time Go user, content creator, and obviously conference organizer. And
Yeah. I'm Derrick I'm one of the, more silent partners, in organizing Go West, kind of introverted side, but

You provide the money. Right?
At least they try to help with that anyway.

I I feel like every or when you organize these sorts of things, end up with like what's the director's name? Like Ocean's 11 heist crew sort of thing where everybody gets their own window in the edit and one gets the money, one gets the pizzas, one gets the but it's good to have like the different roles. So what is for if someone didn't know? Although I think Jonathan, we we must have mentioned it on the show. I I remember we mentioned it last year.

We've mentioned it last year. I think we even had the Pet Shop Boys theme song in

one So what is the Go West Conference?
Derek.
Oh, you want me to do that one?
This is like your job. You do this every year at the conference.
Yeah. So we wanted to create a a conference that's more accessible to a lot of people. Because, you know, a lot of people can't really afford to go spend, you know, $5.06, $700 to attend a conference. Right? So we wanted something that was affordable and local to our area to try and draw in more of the talent we have here and help expand people's knowledge in our area. So that's kind of one of been our main goal is just to have a small affordable local conference for Hargrove community.

How local is it? Like, how how far away do people come in?
We we have people surprisingly come in from, you know, quite a ways. The majority of our attendance does come from the Utah area, but we do have we have had people come from Denver, Nevada, I think California, and maybe Florida or Texas. I think we had a few people come from.
Oh, we did. New York well, Matt Sanabria spoke last year. He flew in from New
York. Okay.
So we get a couple people that fly in, but I would definitely say 70% drive to the conference. They live locally.

Mhmm.

And it's in Yuta. Is it in, like, Salt Lake City or or someplace else? It says it's in Lehi Lehi? Yeah. Am
I presenting the Good job.

Lehi. Thank you.
Yeah. So we're there. Yeah. We're we're in Lehi. It's about twenty minutes south of Salt Lake, maybe less.

Oh, I'm trying to find it on, like, Google Maps. But when you say twenty minutes, I I realize that it's, like, probably an American twenty minutes, which could be, like, really far just because of the way your highways work. No. Just not getting used to.
Lehi is like a a local tech center. Right? So it's got the Adobe, office out here. We've got an ancestry.com office. Like, there's lots of tiny and so most of the software engineers tend to work in the area. So we can get a lot of people who it's their commute, essentially. They don't have to travel any further than they do for work.

Cool. I'm I'm, like, trying to see how far it is from San Jose. Not that far. Like, I can fly over in Nevada and get there in probably, like, an hour and a half.
Yep. Yeah. With, kinda like a Utah's own Silicon Valley. It actually has the nickname Silicon Slopes. That's what we call it.

Alright. So let's say I do, like, wanna I am on the lookout for cool conferences. What's, what's in plan for this one? So it's October 24. We know when it's happening. We know where it's happening. Why should I come?
So this conference I know you two are big meetup fans. You literally talk about meetups every single podcast.

Just about.
And like the goal of this conference is essentially to have a day long meetup. And that's literally everybody's like, this is the best conference ever, at which I totally agree with. I think it's the best conference ever. Because it just feels like a day long meetup. You come, you hang out with people, you may have worked with them in the past, you meet new people.
It's super low key community vibes. It it we definitely try to keep it a little bit more polished than a meetup as far as, like, the presentations and stuff go. But the highlight 100% is the community interaction. And it is we have such a deep surprisingly deep. I every time I go to an event in Utah, I'm just like, how on earth do we have these deep wealth of technology here?
Because we shouldn't. We have such a surprisingly deep wealth of community knowledge, and they you just get to come and interact with them and talk to everybody and just have fun. Like, it's just a party the whole time.

And specifically, I mean, the community aspect sounds great. I assume, like, if I'm looking for a job or if I'm looking to network and, like, get to know more people in the, like, UDAGO scene, it's probably a good place to go. Right?
Yeah. It's a great place. We we actually have people people know, what jobs they actually have or are hiring for. So we try and give people some time to plug those during it. And I think I've actually seen a couple people land, some interviews and jobs, at the conference.

Damn. That's great.
I mean and we have people sponsored just for the intent of recruiting. Like so it's it's 100%. There's a lot of people that use Go, and Go engineers are they they, you know, bounce around all the companies in the area. So it's definitely been used that way more than once.

How many people typically attend?
Oh, good question. So we started this conference during COVID. So we we've been a victim of low numbers for a while. Last year, we hit our high, which was one thirty five. And of that one thirty five, I would say ninety percent was from Utah. So I was like, what the heck is this? Where did all these go people come from? And so yeah, we're that was, like I said, one thirty five all all local. And we we had a couple people like, we just be like, oh, I'm here from Denver. I'm like, you are?
Cool. You run the Denver meetup? Oh, that's awesome. So we would love to have definitely people from, like, the the surrounding states, local area. Like I said, if it's within a one two hour flight, like, that's definitely also kind of who we're targeting. Again, keep it low cost of travel, low cost of stay, low cost of attendance, but super high content.

So, okay, there's cool people, cool community, local devs, whatever, jobs, who cares? We have an exclusive you promised us an exclusive first, you know, in median res view of what are gonna be this year's talk. So so give us that that juice. Who's who's talking this year and about what?
Exactly. Believe it or not, two of the speakers are sitting here on this podcast. I'm giving a talk on an AI system in Go and Jonathan's giving a talk about being a contributor to Go.

Woah, I am? I'll act surprised for the for the audience.
I hope you are. You're

I'm planning to.
Okay. Cool. We have talk called Fundamentals of Memory Management. That's coming from where I have a speaker coming in from Japan for that.
Wow.
We have one about avoiding million dollar mistakes with nil pointer to references, real time data streams with Go, Go channels demystified, and the basics of the Go AST package. One of the things we do with our conference very specifically is we like to have a mix of both local speakers. Like I said, we have a super deep wealth of local speakers and, again, like the world class Go talent to kind of balance that. Look at our awesome Go community we have here of people that can help you and you can grow and learn Go and do like super hard stuff. And then come meet the people that do it everywhere else.
So we've got about a fifty fifty split this year of half local speakers and half people that are coming in to share their wealth of experience with Go.

That's really cool. Are there any open slots or is it all like full up?
We have open slots for Lightning Talks. And Lightning Talks, we have an entire hour scheduled for Lightning Talks, five minutes. And they are everybody's that that is one of those things where it is the favorite part of the conference because more often than not, people show up to the conference, they're like, wait, I can give a lightning talk? And they just throw something together during the conference and it's amazing. I just love when the community does stuff like that.

Like the lightning talks are sign on the spot or can people like submitted the
So so they you have to be there to give it.

Of
course. And we release the sign up beforehand. It's just nobody pays attention until the day of the conference.

Wow. I'm wondering if I'll actually be able to fly out and meet Jonathan there. Maybe we can do a a lightning round lightning talk, lightning round and record it.
That'd be amazing.

Well, let's let's keep that idea on the on the back of our minds because I need to see if I can fly out to you though. But maybe Jonathan could do it for for me, it's a cool idea for sure. I have another question about like the format of the talks. So is the conference more conversational? Like people give a presentation, people can chime in in the middle or whatever, is it more like talks, people talk, it's recorded, you know, questions at the end sort of thing?
Because I've been to both like vibes. And if you're a 100 plus people, I think like the conversational part gets sometimes a bit harder, but people like always wanna ask questions because that's why they came to the conference and they, you know, you know what I mean? So I'm trying to to like gauge the vibe. Is this the sort of conference where I'm mostly gonna be listening or I'm mostly gonna be like asking questions and engaging with people?
Yeah. I I think some of our earlier years, we had kind of the more informal people could ad hoc ask questions during the talks. But we've started trying to record them so they're more accessible to people. So we gotta try and stick with them some time bounds and just have a q and a section at the end that we sometimes add, sometimes don't add to the recording.
We prioritize the recording with questions. But because it is so small, it's really easy to find the speakers after and just chat with them. So

I've always been the the sort of person who will like go to the lecturer after a talk and I could talk to them like for fifteen minutes, not realize

that guy.

Yeah. You know what? You know what? You could be like as cynical as you want. For me, it's been a net positive. Like going to the lecture afterwards and talking to them, getting their phone number, whatever. Yeah. It might be a bit cringe, it might be a bit annoying, but I've learned more doing that and I've like got introduced to some cool people. And as long as you're respectful of the other person's time.

To be honest, I actually love that. As a speaker, I love it when people come up and ask questions. So I don't want anybody listening to think that, like, oh, I'm not gonna go talk to Jonathan afterwards now.
It definitely validates your talk a little bit. Just be like, oh, you actually did pay attention. Exactly.
I was just gonna say it's a great opportunity for people to network doing that. Like, that's kinda how I've gotten to know a lot of great people in the Go community is, like, going to, like, happy hours or different things and, like, going and talking to the different people, which we do also have a little after party after the conference where people hang out, have drinks, and talk about different things, which is probably one of my favorite parts of the conference.

So I'd like to peek behind the curtain a little bit here and talk about some behind the scenes stuff, if you don't mind sharing some of that. Yeah, absolutely. What what is the biggest challenge in putting on this conference for you?
I think a lot of it is just trying to make sure we all have the time set aside to review the talks, find sponsors, try and make sure we have, like, good content, trying to source talks if needed, and then trying to get all of our co organizers and people that volunteer and help us get all of us together and on the same page so we're all working on the same thing. That's one of the big ones. We do try to have, like, a monthly meeting where we get together, go over all the stuff we need to do for the month, or try and prepare for the day of the event. Ryan, do have any extra you wanna add?
You have yeah. If you had a follow-up. I would say, yes. I agree. Anybody who's run a meetup will probably figure find that a lot of these things are very similar. You gotta find the venue. You gotta find the speakers. You gotta get the food. You gotta it's just at a slightly larger scale. So we do have to I would say this conference is different than most.
We run on a very light budget because the building is actually donated to us. So we don't have to pay for a venue, which like or AV or anything like that. So it saves us a ton of overhead and makes it really nice. But other than that, I would definitely agree with Derek because this is 100% volunteer run. We don't have anybody who gets paid to do this.
Making sure that we are all timeline on the same page has always been the biggest challenge. This is our sixth conference, so we have we're kind of in a groove a little bit, Derek and I, of what we have to do, And we can do most of it asynchronous, but sometimes it's just yeah. We still have to make sure that it gets done in a certain time. And but once it literally once it hits the day of the conference, it just feels like this weight's lifted off, and it's just a train that's keep going and nobody can stop it.

How far in advance do you start preparation? So so, I mean, obviously, we're getting close. We're still a few months away, but, like, this conference ends, do you have a break for a while, or do you start immediately planning for for next year? Or have you already started for next year?
No. We usually we start, like, around maybe January, February, start, like, thinking about it and get going on things. And then we just kinda do a little bit every month or so up until the event. And after the event, we just take a nice couple month vacation and forget about it.
I mean, we do we have it in October. So, like, the next two months are holiday months.

Sure.
So we just kinda take the holidays off and we start the new year kind of rolling. I don't think you could do this for larger scale conferences. I know, like, once you get thousands of people, they they take more months of planning and just just for logistical reasons. But as long as we're small, we get the benefit of only requiring, volunteer time and it takes about, I'd say nine months, nine, ten months.

Okay. My experience, when I ran the first Go meetup in, in San Francisco, which we have a live episode from there. I was like certain it's gonna take all of my time. It's gonna be super complicated or whatever, but it turns out if, like you said, someone is willing to give you the venue, in that case, you know, Elastic were nice enough to give us that venue. You can just tell people, hey, we're gonna be talking about Go at this place at this hour.
And magically, some people will show up. And with a conference that's like fully loaded with super interesting content and in a tech hub in in a YUDA, it seems like a no brainer that people will just wanna like join and and network and all that stuff.
Well, people start asking us when we're always every year. So when are you gonna start selling GOES tickets? So that's that's always the good sign to know that people wanna come back.

So when are you gonna start selling GOES tickets?

Soon. That's a great question.
We're hoping to have those out this week.
Yeah. Our our goal was this week.

Alright. Our goal was this week. That sounds very is
this week. It's going to happen. It will happen.
Our goal our goal is this week. It's it's Thursday. And tomorrow's a holiday. It's like, you know, holidays always throw everybody's schedules off because you've got stuff with the kids and parades and fireworks and

Yeah. Someone this is my first July 4 in The in The States And coming from Israel, like last night someone started lighting fireworks in the street and my first response was like, oh, like my whole body tensed up.

Was like,

but no, they were like, lighting all these, very dangerous looking and sounding fireworks just in the middle of our very calm, suburban street. I was like, yes, this is what Americans do. This is fine. I need to adjust to this new situation.
This is what Americans do.

I I appreciate it. So yeah. It might be this week. That's all I'll say to the listeners. What are you most expecting? Like, Derek, I think you mentioned it already, like, just the that there are different aspects of of conferences and that you and Mariah like fill different roles. Right? I'm wondering what are you most not like the the opposite of dreading. What are you most expecting about the conference or what's like your favorite part?
The after party where I get to relax and hang out with everybody and enjoy it. Cool. Yeah. Mean, my side is actually pretty easy. So, like, I deal with, like, updating the website, getting the ticket sales, just through a blank all of a sudden.
You bring the truck that gets the food and you I
I kinda just run around day of the conference just kinda making sure all the stuff's out for people to, like, have snacks, drinks, deals like check ins. So

so just seeing everything running smoothly and Yeah. People being able to enjoy themselves.
Oh, Derek's favorite part is definitely the after party and it's not for the alcohol. It's just like the this is over, Now we get to hang out and just literally talk about software. Like, it's such a nerd moment to just hang out and talk about software without any pressure whatsoever. And how late like, he and Derek stays the whole time. So he's been there about three, four hours with people just hanging out.
Yeah. We're usually there from like 05:30 ish till like nine or so.

That's like the before party.
No. The before party is with donuts and coffee.

Oh. I

don't know how early, people get like wake up in Yuta. What's the is it like break of dawn, we start the talks? No. I hope not.
We're 10AM.

Yep. And Mariah, what what's the part you're expecting the most?
Oh, this year we are printing printing. We have been wanting for years to do custom gopher plushies, and we finally did it this year. We are going to be giving them out as speaker prizes and then selling them for next year's conference costs. So I am so excited to have gopher plushies. You can't see my office because my camera's broken, but I've only got what? 10 already? Like, I

just love Are these Bob Ross themed ones? Like your logo or or what do have
going on? They're not Bob Ross. They are camper gophers. Our original logo was camper gophers. So we've got a little backpacker.
Awesome. You're telling me you already have the plushies and you're you're holding out on me?
I told you August, Derek. They're gonna be driving to my house in August.

Well, plushies are certainly a thing to be excited about.

You'll need you'll need to hook up hook us up with your suppliers so we can get some gopher plushies for

first Oh, Brewster plushies? Yeah. Oh, you know what? My daughter would love those.
So far, the pictures I've seen, they have been adorable. So you see them in person, see if you like them and I'll send them your way.

Awesome. Cool. Cool. Cool. So I'm really curious. You guys have been doing this, you said, I think six years. Right?
Yeah. This is our sixth conference. Started our first one was 2020.

If other folks are listening to this and are inspired to try to do something similar, what advice can you offer for somebody who wants to start their own? I mean, it could just be a meetup, but, you know, I'm thinking more more like a a regional conference.
Well, this is really easy. This is my favorite story. Literally, Derek and I were at a meetup one day and it was probably what, one, two months after GopherCon. And he came up to me. He's like, I've been noticing people have started doing regional conferences.
Should we do it? And I'm like, heck, yes. And, like, I think we started planning it the next day. And we're looking at venues and looking at raising money and trying to do costs, and we had an event planner, and then COVID happened and canceled everything. But it was a good thing because we were really able to tone things down and kind of cut out things and decide what's simple.
I think the most important thing I will always say is find a good team of people to be around you. Right now, we have a team of four people, and that balances the workout really well so that no one person feels super overwhelmed. It also helps with deciding talks because otherwise, you get way too biased to a single single topic field. The other thing I would say that is particularly hard with conferences is getting the word out. It's really hard to just get people aware of it.
And I have found that you have to be totally comfortable with just like sliding into DMs on Twitter. I have DMed everybody and their dog to try and get people to go to the CFPs or sell tickets. I go to meet up organizers and I'm like, hey, if I give you guys a 25% discount code, will you announce your conference at your meet up? And so I I would say with conferences, personally, I find that the hardest part, like the the biggest thing to overcome and the logistics are kind of easy. But I think the way you get started is you just find a group of people that also want to do the same thing.
And it honestly, it feels like a freight train. So if you have everybody and you wanna do it and you pick a date, it happens no matter what. Eric, this was your idea. It's your conference. You have to have an anecdote for us.
I I got nothing. You really covered it all right there.

So it sounds like your advice, Derek, is to tell your idea to Moriah.
That that's really how it happened. I was like, she runs the meetups right now and I just had this little idea of starting a conference. Like, I'm gonna go pitch this to her. And she's like, yeah, that sounds great. And I was like, uh-oh, what did I get myself into? Now I actually have to do this thing. You know, I'm I assume mostly probably like most developers, I'm quiet and introverted and every year getting up to talk at the conference is like, oh, boy, here we go.

Mhmm. Yeah. You continue doing it, so it must not be that bad.
Yeah. It is. It's one of those things where like, I wanna do this, get myself out of my comfort zone and try new things, which is partially why I agreed to even come on the podcast is where I was like, hey, you're doing this. I was like, oh, I am? Okay.
Did not public speaking. He hates public speaking. It's the best.
I think she just does it to watch me suffer in silence.

The well, I hope you're feeling adequately uncomfortable just to make you put yourself out there even more and step even more out of your comfort zone. Derek Mara, where can people find you? What are you working on that you want people to know other than Go West? Obviously, you've heard about Go West for the last, like, whatever minutes we've been talking about it, but the link is in the show notes, and the tickets will be out this week. They will

be. It's also gowestconf.com, just to be gowestconf.com. If you're if you can't check the show notes, gowestconf.com is easy to remember.

Yeah. If you're, like, listening to us while paragliding right now, don't take out your phone. You just remember gowestconf.com. But other than that link, where can people find you?
I don't have anything all that interesting. I have a Twitter. You can follow me on Twitter, d laird underscore dev.

I'll go do that right now. And I know that, Jonathan won't because he doesn't, use, x anymore.

I x ed the x.
Oh, yeah. I used the wrong the old name, the old form.

No. No. You used the correct name. Everybody thinks that's the name.
Oh, there's still tweets. Right? Like you send tweets on it. So it's like anyway, that's the thing I'm trying to figure out. The easiest way to reach Derek is on the Forge Slack. So Forge Utah is a nonprofit. We started four meetups and also at about the same time we started this conference. It's basically we do I'm a cofounder of that too. And we do local tech events. That website's forgeutah.tech.
We do have a lot of non Utah people in our Slack, but that's we also run the conference Slack out of there with the GoestComp channel. That's the best way to get a hold of Derek, honestly, is on Slack. We love forge. It's been super fun to just have a whole bunch of just like it definitely the go meetup was our biggest meetup for a long time. And now they are the AI meetups that I run that are just killing it.
What else do we have? Mariah does. So and then I do my soy peak tech stuff, which is blogs and I do Twitch streams. We've talked about that before, Jonathan, on the podcast. How I do go Twitch streams on and it's super fun and people are like, wait, you don't do video games on Twitch? I'm like, nope. No video games on Twitch. Just software. Just Go and AI. And then, yeah, I'm also on all the socials and I post about Go and Go West and AI stuff all the time and it's super fun.
Yeah. I don't that that's 100% how you can find us.

Awesome. And all the links are obviously in the show notes.
I hope so.

Well, I think that leads us to what's our final question. We'll ask it twice since there's two of you today. When you were learning Go or starting out with Go, who was your biggest influence? We'll go with Derek first.
The whole reason I got into Go is I was a huge Linux Unix fan And I was looking into, like, kind of the history of Unix stuff and saw things with Ken Thompson. And I was like, man, I wonder what he's dubbed to these days. So I was kinda looking and it's like, he's working on this new language Go. I was like, oh, I'll see what Go is all about. And because at the time, I only did front end and a little bit of PHP back end.
And I saw went and tried this Go language and I was like, something where that just clicked with my brain to where, like, I felt like I could as code as quick as, like, the ideas came to me in my head and could understand the language quickly. So he was probably the the main reason I even got into Go is because of him for looking at more where I was already writing Go and was inspired to do more is actually Brian Kettleson and Eric St. Martin. I was listening to them do the Go Time podcast. And this is where the story with Moriah comes into play where I had a long commute, I listened to the podcast every day and let's heard them talk about regional conferences being spun up.
And they were asked, like, do you do you feel like people are treading on your territory doing smaller conferences and things like that? Because they ran and I can still do run GopherCon. And they're like, no, that's great. We think everyone should have a regional conference. I
was like,
that's a great idea. We should have one here in Utah. So that's when I went and pitched it to Moriah that we spin one up.

Cool. How about you, Moriah? Who was your biggest influence while learning Go?
That would be Frances Campoy. I would say I went to my first GopherCon, he gave a talk on Go and AI, and I found him immediately after. I followed Shay's advice and immediately went and found the speaker and made sure he could not leave the podium until we had chatted. And I that's when he was doing Just For Funk. I watched all of those videos.
I started doing speaking and stuff because he did it. I got him to come out to fly out to we flew him out to a meetup in Utah, and then he came again to meetup in Utah. And then I would run into him at conferences where I was speaking at. It was just really fun there for a while. And, like, he was so excited about the language and I got so excited about the language and I haven't stopped being excited about it since.

Cool. Yeah. I've watched some of his, Just for funk videos as well. So unfortunately, he stopped doing those, I guess, but, can't expect somebody to do a pet project like that forever.
Yeah. I think they were some of the best quality videos for a while, in my opinion.

Mhmm. Cool. Cool. Cool.

Well, thanks a lot, Mara and Derek, for coming on the show. Call to action is, of course, go get, Goest, tickets if you're in the Utah area. I'll definitely check like how much the flight costs because I'm very, very interested in coming to see Jonathan's talk. Been trying to contribute to Go, but all my proposals got rejected. Maybe if I listen to Jonathan's talk, finally, I'll be able to land one in.

There you go. Maybe.

But for all the other great talks, the community, the after party, the plushies, and all the rest of the goodies, goestconf.com.

Great. Thanks, guys.

And again, thanks a lot guys for coming on.
Yeah. Thank you for having us.

See you in a few months, Rocco and and Lehi.
Yeah. Looking forward to

Program exit open. Goodbye.