dominikh

@honnef.co

Staticcheck 2026.2 has just been released, and unfortunately there is already a 2026.2.1 on its way to fix a false positive. Now would be a great time to give 2026.2 a spin and report any bugs and false positives of your own so they can be part of 2026.2.1.

I'm sorry, what? In writing my first monograph, I spent six weeks trying to track down a citation in TWO languages I didn't know. And good thing too, because the citation was wrong. That's scholarship. That's research. You know, the thing we're trained to do?!?

The reactions of some researchers on Twitter finally being held responsible for not having read the very paper they submitted are... something. Mainly, they don't think they should have to check every citation or make sure the data is real and accurate. Because it's too hard, I guess.

On Linux, the "tuna" utility lets you isolate CPUs so that no processes or IRQs get scheduled on them. taskset still lets you use those CPUs, making this a great combo for running benchmarks with less noise. There are also isolcpus and cgroups, but those are more involved to set up.

Anthropic's "Claude for Open Source" program has been an awful experience for me. I applied and got invited a couple days later. When I used the promo link to get free Max, it charged me $200, anyway. It has been 17 days of me trying to talk to a human to rectify that.

Dependabot security alerts have terrible signal-to-noise ratio, especially for Go vulns. That hurts security! Just turn it off and set up a pair of scheduled GitHub Actions, one running govulncheck and the other running CI with the latest version of your deps. Less work, less risk, better results!

Turn Dependabot Off

I recommend turning Dependabot off and replacing it with a pair of scheduled GitHub Actions, one running govulncheck, and the other running CI against the latest version of your dependencies.

words.filippo.io

What if I told you that the building the torment nexus is an extremely interesting challenge from an engineering perspective

we all use “luddite” these days to describe someone who is reflexively anti-technology. but the original luddites were specifically against technology eliminating jobs and reducing pay in exchange for cheaper, inferior goods

weak.Pointer (Go 1.24+), runtime.AddCleanup (Go 1.24+), and sync.Map combine wonderfully into a 20-lines weak map. #golang It associates values to keys, with automatic garbage collection once the key becomes unreachable. Using it to tie precomputed FIPS keys to PrivateKey values we can't modify.

type Cache[K, V any] struct {
	m sync.Map
}

// Get returns the result of new.
//
// If Get was called on k before and didn't return an error, Get will return the
// same value it returned from the previous call.
//
// If Get is called concurrently on the same k value, new might get called
// multiple times. All calls will return the same value or an error from new.
//
// The cache is evicted some time after k becomes unreachable.
func (c *Cache[K, V]) Get(k *K, new func() (*V, error)) (*V, error) {
	p := weak.Make(k)
	if cached, ok := c.m.Load(p); ok {
		return cached.(*V), nil
	}
	v, err := new()
	if err != nil {
		return nil, err
	}
	if cached, loaded := c.m.LoadOrStore(p, v); loaded {
		// We lost the race, return the cached value and discard ours.
		return cached.(*V), nil
	}
	runtime.AddCleanup(k, c.evict, p)
	return v, nil
}

func (c *Cache[K, V]) evict(p weak.Pointer[K]) {
	c.m.Delete(p)
}

Programming with the help of an AI-powered coding assistant (like GitHub Copilot) is akin to pair programming with someone eager to impress, not particularly bright, and who won't shut up. Count me out. 🙅

"Can you write this complex data transformation script to hit several different APIs and generate this really particular csv?" Sure "Can you automatically import it into a Google sheet?" Never going to happen, literally impossible

Since I haven't been writing code full time professionally, I sometimes worry that I've lost a step. Then someone comments about how they don't like #golang at a wedding reception and I instinctively reply "Oh yea? What do you use? Rust? Fuck off." and I know I've still got it.

In 2022, I left Google in search of a sustainable approach to open source maintenance. A year later, I was a full-time independent maintainer. Today I’m announcing the natural progression of that experiment: Geomys, a small firm of professional maintainers with a portfolio of critical Go projects.

Geomys, a blueprint for a sustainable open source maintenance firm

Announcing Geomys, a small firm of professional maintainers with a portfolio of critical Go projects.

words.filippo.io