I wrote an article about Go's new Green Tea garbage collector. Paywall has expired, give it a read. theconsensus.dev/p/2026/07/19...

If "JWT" is meant to be pronounced "jot", is "JWS" meant to be pronounced "jaws"? 🦈 www.rfc-editor.org/info/rfc7519...

RFC 7519: JSON Web Token (JWT) | RFC Editor

JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object that is used as the payload of a JSON ...

rfc-editor.org

Security-related libraries (for CORS, JWTs, etc.) should be designed to be, not only easy to use, but hard to misuse: - pentesterlab.com/blog/secure-... by @snyff.pentesterlab.com - jub0bs.com/posts/2023-0...

How to Securely Design Your JWT Library - PentesterLab's Blog

This article explores best practices for designing a secure JWT library, focusing on making secure implementations the default and minimizing potential vulnerabilities. Key strategies include disablin...

pentesterlab.com

What a fall from grace for HackerOne, once my favourite bug-bounty platform. 😬 "HackerOne triage analyst incorrectly closes the report as a duplicate [...]" clickup.com/blog/april-2...

April 27th - What happened with our feature flag configuration | The ClickUp Blog

On April 27, 2026, a security researcher publicly disclosed that ClickUp’s client-side feature flag configuration exposed personally identifiable information. Specifically, 893 customer email addresse...

clickup.com

v0.13.3 through v1.0.1 of github.com/jub0bs/cors contain an embarrassing bug that affects functionality (though not security). Thanks to Herman Slatman for reporting it. 🙇 The bug is fixed in v1.0.2. Update when you can.

GitHub - jub0bs/cors: perhaps the best CORS middleware library for Go

perhaps the best CORS middleware library for Go. Contribute to jub0bs/cors development by creating an account on GitHub.

github.com

I've just filed a #golang issue aiming to explicitly exclude error messages from the Go 1 compatibility promise: github.com/golang/go/is...

x/website: explicitly exclude error messages from the Go 1 compatibility promise · Issue #78991 · golang/go

The document that specifies the Go 1 compatibility promise ("go1compat" for short) lists a number of exclusions: Security. A security issue in the specification or implementation may come to light ...

github.com

A bit over two years after starting to work on it... Go is officially FIPS 140-3 certified 💥 csrc.nist.gov/projects/cry... I am pretty confident Go is now one of the most—if not the most—seamless and complete FIPS 140-3 compliance solutions... with a single env var, out of the box.

I wrote about why I quit my job, and how weird and tiring tech feels these days.

Do I belong in tech anymore?

On quitting, the spread of AI, and the loss of an ideal.

ky.fyi

Shot: "We were hit by a sophisticated AI-accelerated cyberattack"

Issue 596 of the Golang Weekly newsletter mentions the v1 release of github.com/jub0bs/cors. Nice! #golang golangweekly.com/issues/596

There are no benign data races. In fact, some are lethal. ☠️ en.wikipedia.org/wiki/Therac-25

Therac-25 - Wikipedia

The Therac-25 was a computer-controlled radiation therapy machine produced by Atomic Energy of Canada Limited (AECL) in 1982 after the Therac-6 (neptune) and Therac-20 units (the earlier units had been produced in partnership with Compagnie générale de radiologie (CGR) of France).[1]

en.wikipedia.org

🥳 Go 1.26.2 and 1.25.9 are released! 🔐 Security: Includes 10 security fixes for the standard library and the toolchain. 📢 Announcement: https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU/m/7CDdDXqeBwAJ ⬇️ Download: https://go.dev/dl/#go1.26.2 #golang

🎉 After a few years of refinement and close to 1 >> 9 commits, I'm pleased to announce the v1 release of my CORS middleware library for Go. Let me know whether it patches things up between you and CORS! github.com/jub0bs/cors #golang #CORS

GitHub - jub0bs/cors: perhaps the best CORS middleware library for Go

perhaps the best CORS middleware library for Go. Contribute to jub0bs/cors development by creating an account on GitHub.

github.com

I love how the conjunction of #golang's modules system and build constraints lets you have your cake and eat it too! 🍰 You can let users of your library take advantage of the bleeding edge if they so wish without cutting off one of the currently supported Go toolchains.

Even when you cannot eliminate all bounds checks within a loop, eliminating most of them may benefit performance. 😉 #golang go-review.googlesource.com/c/go/+/759100

Paradoxically (perhaps), as the Go compiler becomes better at eliminating bounds checks, attacker-reachable panics due to incorrect programmer assumptions about indices become easier to find. #golang

Fewer bounds checks in #golang thanks to Youlin Feng: go-review.googlesource.com/c/go/+/719881

Find out how the source-level inliner in Go 1.26 can help you with API migrations. go.dev/blog/inliner

//go:fix inline and the source-level inliner - The Go Programming Language

How Go 1.26's source-level inliner works, and how it can help you with self-service API migrations.

go.dev

I've just filed a proposal to make bool an ordered type (compatible with operators <, <=, >, and >=) in #golang: github.com/golang/go/is...

proposal: spec: make bool an ordered type · Issue #78027 · golang/go

Go Programming Experience Experienced Other Languages Experience Python, Haskell, JavaScript, C Related Idea Has this idea, or one like it, been proposed before? Does this affect error handling? Is...

github.com

#golang quiz: What happens if you try to compile and run the following program? package main import ( "fmt" "math" ) func main() { fmt.Println(int(math.NaN())) } a. It prints 0. b. It prints -1. c. It panics. d. Compilation fails. e. Something else.

🚀 "spec: generic methods for Go" has been accepted! You will soon (1.27?) be able to declare (on concrete types only) methods that introduce type parameters, i.e. type parameters other than the ones (if any) that come from the method's receiver. github.com/golang/go/is... #golang

spec: generic methods for Go · Issue #77273 · golang/go

Proposal: Generic Methods for Go A change of view. Background For clarity, in the following we use the term concrete method (or just method when the context is clear) to describe a non-interface me...

github.com

A friendly reminder that a Go program doesn't need an import of the "unsafe" package to undermine the language's type system; a synchronisation bug may be enough: go.dev/play/p/L0_Zr... #golang

Go Playground - The Go Programming Language

go.dev

For months (maybe years, even) now, I've been accumulating notes with a view to producing a performance-oriented Go training course. There's just so many techniques and tools to master! I'm hopeful for a release some time in 2026, though. 🤞 #golang

If you've already migrated to Go 1.26, there's no longer any point in relying on github.com/jub0bs/errutil. Simply rely on errors.Astype instead. pkg.go.dev/errors#AsType #golang

🎉 I've just released v0.12.0 of jub0bs/cors, my CORS middleware library for #golang! - Go 1.25 or above is now required. - Some minor performance improvements. Still guaranteed free of AI slop, of course. github.com/jub0bs/cors

GitHub - jub0bs/cors: perhaps the best CORS middleware library for Go

perhaps the best CORS middleware library for Go. Contribute to jub0bs/cors development by creating an account on GitHub.

github.com

🎆 Go 1.26.0 is released! 🗒️ Release notes: https://go.dev/doc/go1.26 ⬇️ Download: https://go.dev/dl/#go1.26.0 #golang

#golang quizz: why is the implementation of the following function naive/incorrect, and how would you fix it? 😉 // opposite returns the opposite of comparator function cmp. func opposite[T any](cmp func(T, T) int) func(T, T) int { return func(x, y T) int { return -cmp(x, y) } }

I must confess I regret github.com/golang/go/is.... I've since found cmp.Or to be quite useful, esp. for implementing comparator functions for struct types. Thanks to @carlana.net for pushing for its addition to #golang's standard library.

cmp: add Or · Issue #60204 · golang/go

An extremely common string operation is testing if a string is blank and if so replacing it with a default value. I propose adding First(...strings) string to package strings (and probably an equiv...

github.com

Well, I might produce a v0.12.0 to accompany Go 1.26, whose release is imminent.

jub0bs@jub0bs.com · 6mo ago

🎉 I've just released v0.11.0 of jub0bs/cors, my CORS middleware library for Go! Bar any surprises, this will be the last minor release before v1. github.com/jub0bs/cors

Rare enough to be worth sharing: a video about CORS of remarkable precision, courtesy of Digital Boundary Group's Ryan Armstrong: www.youtube.com/watch?v=79Ud...

Cross-App Security: Cross-Origin Resource Sharing (CORS)

YouTube video by Ryan Armstrong

youtube.com