What's new in Go's cryptography libraries: Part 3
The 3 Musketeers return! Filippo Valsorda, Roland Shoemaker & Nicola Murino continue their deep-dive conversation with Natalie about Go’s crypto libraries.
Also listen to Part 1 and Part 2!
Join the discussion
Changelog++ members save 9 minutes on this episode because they made the ads disappear. Join today!
Sponsors:
FireHydrant – The alerting and on-call tool designed for humans, not systems. Signals puts teams at the center, giving you ultimate control over rules, policies, and schedules. No need to configure your services or do wonky work-arounds. Signals filters out the noise, alerting you only on what matters. Manage coverage requests and on-call notifications effortlessly within Slack. But here’s the game-changer…Signals natively integrates with FireHydrant’s full incident management suite, so as soon as you’re alerted you can seamlessly kickoff and manage your entire incident inside a single platform. Learn more or switch today at firehydrant.com/signals
Speakeasy – Instantly create SDKs that make API integration easy for your users. Create your first SDK for free! today.
Ladder Life Insurance – 100% digital — no doctors, no needles, no paperwork. Don’t put it off until the very last minute to get term coverage life insurance through Ladder. Find out if you’re instantly approved. They’re rated A and A plus. Life insurance costs more as you age, now’s the time to cross it off your list.
Fly.io – The home of Changelog.com — Deploy your apps and databases close to your users. In minutes you can run your Ruby, Go, Node, Deno, Python, or Elixir app (and databases!) all over the world. No ops required. Learn more at fly.io/changelog and check out the speedrun in their docs.
Featuring:
Filippo Valsorda – Website, GitHub, Mastodon, X
Roland Shoemaker – Website, GitHub, X
Nicola Murino – GitHub
Natalie Pistunovich – GitHub, X
Show Notes:
What’s new in Go’s cryptography libraries: Part 1
What’s new in Go’s cryptography libraries: Part 2
ssh: add AlgorithmNegotiationError
ssh: validate key type in SSH_MSG_USERAUTH_PK_OK response
BoGo
Project Wycheproof
The Password Game
Filippo’s open source maintenance policy
Something missing or broken? PRs welcome!
What's new in Go's cryptography libraries: Part 2
Filippo Valsorda & Roland Shoemaker from the Go Team return & bring Nicola Murino with them to continue catching us up on what’s new in Go’s crypto libraries.
This is everything we didn’t cover + deep dives from Part 1!
Join the discussion
Changelog++ members save 3 minutes on this episode because they made the ads disappear. Join today!
Sponsors:
Changelog News – A podcast+newsletter combo that’s brief, entertaining & always on-point. Subscribe today.
Fastly – Our bandwidth partner. Fastly powers fast, secure, and scalable digital experiences. Move beyond your content delivery network to their powerful edge cloud platform. Learn more at fastly.com
Fly.io – The home of Changelog.com — Deploy your apps and databases close to your users. In minutes you can run your Ruby, Go, Node, Deno, Python, or Elixir app (and databases!) all over the world. No ops required. Learn more at fly.io/changelog and check out the speedrun in their docs.
Featuring:
Filippo Valsorda – Website, GitHub, Mastodon, X
Roland Shoemaker – Website, GitHub, X
Nicola Murino – GitHub
Natalie Pistunovich – GitHub, X
Show Notes:
What’s new in Go’s cryptography libraries: Part 1
NIST
FIPS
Diffie–Hellman key exchange
FIPS standard 140
github.com/quic-go/quic-go
tip.golang.org/src/crypto/tls/quic.go
pkg.go.dev/crypto/x509
MultiAlgorithmSigner
OpenSSH format keys
Kerberos edge case, use the correct token from the client
defer channel window adjustment
Improved test cases (removed t.Fatal calls from goroutines), added test against SSH CLI
Agent compatibility
github.com/drakkan/sftpgo
Something missing or broken? PRs welcome!
What's new in Go's cryptography libraries: Part 1
Filippo Valsorda & Roland Shoemaker from the Go Team sit down with Natalie to catch us up on what’s new in Go’s crypto libraries. No, not that crypto… good ol’ cryptography! Don’t miss Part 2!
Join the discussion
Changelog++ members support our work, get closer to the metal, and make the ads disappear. Join today!
Sponsors:
Fastly – Our bandwidth partner. Fastly powers fast, secure, and scalable digital experiences. Move beyond your content delivery network to their powerful edge cloud platform. Learn more at fastly.com
Fly.io – The home of Changelog.com — Deploy your apps and databases close to your users. In minutes you can run your Ruby, Go, Node, Deno, Python, or Elixir app (and databases!) all over the world. No ops required. Learn more at fly.io/changelog and check out the speedrun in their docs.
Typesense – Lightning fast, globally distributed Search-as-a-Service that runs in memory. You literally can’t get any faster!
Featuring:
Filippo Valsorda – Website, GitHub, Mastodon, X
Roland Shoemaker – Website, GitHub, X
Natalie Pistunovich – GitHub, X
Show Notes:
What’s new in Go’s cryptography libraries: Part 2
MultiAlgorithmSigner
OpenSSH format keys
Something missing or broken? PRs welcome!
A new path to full-time open source (Interview)
After years of working for Google on the Go Team, Filippo Valsorda quit last year to experiment with more sustainable paths for open source maintainers. Good news, it worked! Filippo is now a full-time open source maintainer and he joins Jerod on this episode to tell everyone exactly how he’s making the equivalent to his total compensation package at Google in open source.
Join the discussion
Changelog++ members get a bonus 7 minutes at the end of this episode and zero ads. Join today!
Sponsors:
Postman – Build APIs together — More than 20 million developers use Postman for building and using APIs. Postman simplifies each step of the API lifecycle and streamlines collaboration so you can create better APIs—faster.
Sentry – Session Replay! Rewind and replay every step of the user’s journey before and after they encountered an issue. Eliminate the guesswork and get to the root cause of an issue, faster. Use the code CHANGELOG and get the team plan free for three months.
Typesense – Lightning fast, globally distributed Search-as-a-Service that runs in memory. You literally can’t get any faster!
Featuring:
Filippo Valsorda – Website, GitHub, Mastodon, X
Jerod Santo – Website, GitHub, LinkedIn, Mastodon, X
Show Notes:
Filippo on Go Time talking fuzzing
Filippo on Go Time talking security
I’m now a full-time professional open source maintainer
age file encryption
mkcert
yubikey-agent
Lemonade Stand
Something missing or broken? PRs welcome!
Security for Gophers
Mat, Filippo, Johan, and Roberto discuss security in Go. Does Go make it easy to secure your code? What common mistakes are Gophers making? What is fuzzing? How can attackers abuse your code if you use the default http mux?
Join the discussion
Changelog++ members support our work, get closer to the metal, and make the ads disappear. Join today!
Sponsors:
KubeCon + CloudNativeCon – The Cloud Native Computing Foundation’s flagship Kubernetes community conference which gathers adopters and technologists from leading open source and cloud native communities. Learn more and register — get 10% off with the code KCNACHANGELOG19 Feel free to use the Convince Your Boss letter in part or in full so you can your team can attend.
TeamCity by JetBrains – Build and release your software faster with TeamCity — a self-hosted continuous integration and delivery server developed by JetBrains. TeamCity is super-smart at running incremental builds, reusing artifacts, and building only what needs to be built, which can save over 30% of the daily build time. Learn more at teamcity.com/gotime.
Linode – Our cloud server of choice. Deploy a fast, efficient, native SSD cloud server for only $5/month. Get 4 months free using the code changelog2019. Start your server - head to linode.com/changelog.
Fastly – Our bandwidth partner. Fastly powers fast, secure, and scalable digital experiences. Move beyond your content delivery network to their powerful edge cloud platform. Learn more at fastly.com.
Featuring:
Filippo Valsorda – Website, GitHub, Mastodon, X
Johan Brandhorst – Website, GitHub, X
Roberto Clapis – GitHub, X
Mat Ryer – Website, GitHub, LinkedIn, X
Show Notes:
Go Playground example #1 - this demonstrates the sql safety pattern that Roberto mentions in the episode.
Go Playground example #2 - this demonstrates the stringer pattern mentioned by Roberto to avoid printing passwords out in logs.
go-fuzz package - a package for generating random inputs for your code.
So you want to expose Go on the Internet - although this needs updating, it was written by Filippo to help others tackle the challenge of securely exposing Go services to the internet.
Something missing or broken? PRs welcome!
Hellogopher, whosthere?
Filippo Valsorda joined the show to talk about his project Hellogopher, whosthere (whoami.filippo.io), $GOPATH, TLS 1.3, Cloudflare’s secret reverse proxy, and more.
Join the discussion
Changelog++ members support our work, get closer to the metal, and make the ads disappear. Join today!
Sponsors:
Linode – Our cloud server of choice. Get one of the fastest, most efficient SSD cloud servers for only $5/mo. Use the code changelog2017 to get 4 months free!
Fastly – Our bandwidth partner. Fastly powers fast, secure, and scalable digital experiences. Move beyond your content delivery network to their powerful edge cloud platform.
StackImpact – StackImpact is all about profiling and monitoring for Go. Laser focus on the performance of your Go applications.
Ultimate Go – Ardan Labs offers some of the best training classes for Go, Web and Data Science. They offer two and three full day intensive courses that literally takes any developer, even at different experience levels, to a whole new level. Get in touch and tell them you heard about their classes on Go Time!
Featuring:
Filippo Valsorda – Website, GitHub, Mastodon, X
Erik St. Martin – GitHub, X
Carlisia Thompson – GitHub, LinkedIn, X
Brian Ketelsen – GitHub, X
Show Notes:
hellogopher - “just clone and make”
TLS 1.3 (TLS-tris)
Exposing Go on the Internet
Interesting Go Projects and News
gopherize.me (this is Brian’s fault!)
chromedp - Package chromedp is a faster, simpler way to drive browsers in Go using the Chrome Debugging Protocol (for Chrome, Edge, Safari, etc) without external dependencies (ie, Selenium, PhantomJS, etc).
nlp - General purpose any-lang Natural Language Processor that parses the data inside a text and returns a filled model
dep - Go dependency tool
Mate - Mate manages AWS Route53 and Google CloudDNS records for your Kubernetes services and ingresses
Go code intelligence on Sourcegraph
How to write Go code - This document demonstrates the development of a simple Go package and introduces the go tool, the standard way to fetch, build, and install Go packages and commands.
Free Software Friday
Erik - ZIM - Zsh IMproved from Matt Hamilton
Fillippo - go-tools - A collection of tools and libraries for working with Go code, including linters and static analysis from Dominik Honnef
Something missing or broken? PRs welcome!