12 ms·
Go 1.12 Released
- FiloSottile 8y ago_o/ hello HN, this release ships with seamless opt-in support for TLS 1.3 in crypto/tls. (Gated by the GODEBUG=tls13=1 environment variable.) I'd be happy to answer any questions about it, or about the rest of the Go cryptography libraries!
- tonymet 8y agoI was curious about new features in tls1.3 and this doc was a good breakdown https://www.cloudflare.com/learning-resources/tls-1-3/ https://www.cloudflare.com/learning-resources/tls-1-3/
- crawshaw 8y agoAny concerns exposing Go tls1.3 directly to the internet today? Is 0-RTT on the roadmap for Go 1.13?
- FiloSottile 8y agocrypto/tls is designed and developed to be fit to be exposed directly to the Internet. The advice I wrote here is mostly dated (I really need to write a follow-up), but it's still indicative: https://blog.gopheracademy.com/advent-2016/exposing-go-on-the-internet/ https://blog.gopheracademy.com/advent-2016/exposing-go-on-th... [Updated to add] TLS 1.3 is opt-in because despite years of improvements, it can still hit compatibility issues with broken or legacy peers. (Search for "TLS 1.3" on the Go issue tracker if you are curious.) 0-RTT is blocked on figuring out good, safe APIs for it. I feel like I am 80% of the way there for servers (just have to figure out how to make it opt-in per http.Handler instead of opt-out), while for clients I have no idea how to fit resending in io.Writer.
- kodablah 8y ago> just have to figure out how to make it opt-in per http.Handler instead of opt-out Hrmm, I can think of a few ways (assuming I'm understanding the problem). One is a ZeroRTTHandler iface w/ a single ServeHTTPZeroRTT function and if Server.Handler impls that iface in addition to Handler, then that function is called instead. Another way is just to have a ZeroRTTAllowed property in the Server struct of type "func(Request) bool" w/ nil as an assumption of false. If it has to be on the handler instead of on the server, do something similar to the context package and have a "func WithZeroRTT(h Handler, allowed func(Request) bool) Handler" that returns the new handler w/ the internal check. Just spitballing, I may not understand the problem (can't escape asterisks here, but Request is meant to be a ptr). > for clients I have no idea how to fit resending in io.Writer This is tougher (assuming I understand the problem). Maybe a TLS config or http.Request option that the entire byte slice of first write can be resent as a whole. The other option being a tls.Conn.ZeroRTTFirstWrite method that the http req's Write can use if a setting is present before falling back to regular write, I dunno.
- deleted 8y ago[deleted]
- mholt 8y agoI'll add, too, that anyone who wants to try TLS 1.3 right now can do so with the latest source builds of the Caddy web server. We just merged support for TLS 1.3 a few minutes after the Go 1.12 release: https://github.com/mholt/caddy/pull/2399 https://github.com/mholt/caddy/pull/2399 If you have a domain name pointed at your machine: $ caddy -host example.com (Roughly equivalent to python -m SimpleHTTPServer but with HTTPS, and production-ready.) Or if you just want to try things out: $ caddy "tls self_signed"
- mappu 8y agoI'm glad to see setting the env var in init() is enough to trigger this on - I'll be doing the same at $DAYJOB.
- kodablah 8y agoI know and understand the philosophy behind limited exposure/customization of the handshake process. However, there is a lot of value in implementing TLS extensions, adding early data on client hello, etc. I saw [0] but didn't see any details. Is it possible/reasonable to extract some of the internals to /x/crypto/tls or similar? Or is it either too hard to maintain or is there just too much fear about misuse? 0 - https://github.com/golang/go/issues/25807 https://github.com/golang/go/issues/25807
- FiloSottile 8y agoMost of it is that it's harder to come up with useful, safe, not overfitting APIs the deeper you go into internals. For example, registering extensions is rarely useful on its own as extensions are allowed to change literally anything else in the protocol, and without hooks for everything else you did not get much value. But! Hearing about what people would like to do and then putting together an API if it makes sense is my job! So please do open an issue saying what you'd like to do but can't. For example, I mean to extract Client Hello parsing and a capturing middleware net.Conn, as a lot of passive things can be implemented that way.
- kodablah 8y agoMy use case recently was [0]. I might open an issue if that spec comes further along. > I mean to extract Client Hello parsing Something like that could have helped when I was toying w/ DTLS, though [1] did a great job on their impl. 0 - https://tools.ietf.org/html/draft-krawczyk-cfrg-opaque-01#section-4 https://tools.ietf.org/html/draft-krawczyk-cfrg-opaque-01#se... 1 - https://github.com/pions/dtls https://github.com/pions/dtls
- yesenadam 8y agoOK thanks, basic question, but.. What is TLS?
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- wereHamster 8y agoThe S in HTTPS. The technology that is securing your HTTP connections, but also used by other protocols. https://en.wikipedia.org/wiki/Transport_Layer_Security https://en.wikipedia.org/wiki/Transport_Layer_Security
- yesenadam 8y agoOh ok.. thank you! (Somehow I'd never heard of that.)
- mholt 8y agoCool, that means that browser developers and web server developers are doing their jobs halfway right :)
- yesenadam 8y agohehe I guess so. Was a bit shocked to read SSL is deprecated! Still had that on my "Things to learn about one day" list! ...Ah, I did get this error trying to curl something earlier today "error:1407742E:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert protocol version" - seems my computer hasn't heard of it either.
- mcpherrinm 8y agoSSL and TLS are really the same protocol, except that newer versions are called TLS. Many software stacks still refer to both as SSL, but these days we only use TLS. My understanding is that the renaming was mostly politics between Microsoft, Netscape, and the IETF in the 90s. See more details here: http://tim.dierks.org/2014/05/security-standards-and-name-changes-in.html http://tim.dierks.org/2014/05/security-standards-and-name-ch...
- giovannibajo1 8y agoIs there any performance issue that we should be aware of when turning on TLS 1.3? Go's standard library has many assembly implementations (to leverage CPU special opcodes). What is the speed of the TLS 1.3 crypto stack in Go?
- lazard 8y agoHow can we help with getting support for Ed25519 in crypto/x509 and crypto/tls?
- sodpoisadfio 8y agohttps://github.com/golang/go/issues/25355 https://github.com/golang/go/issues/25355
- mspecter 8y agoWhat's the plan for pairing based curves now that the Extended Tower Number Field Sieve has made BN256 unusable for many applications[1]? Do you plan on integrating BLS curves any time soon? [1] see https://godoc.org/golang.org/x/crypto/bn256 https://godoc.org/golang.org/x/crypto/bn256
- bithavoc 8y agoThis is so great, although I tried to update my docker container and the official docker container is still in rc.
- bradfitz 8y agoThe Go team doesn't own the official Docker containers and we don't notify the maintainers when we do a release. We probably should.
- pythonist 8y agoMaybe they can use https://NewReleases.io https://NewReleases.io to track Go releases.
- entity345 8y agoGolang has an announcements mail list. I'm sure than projects that depend on the language already subscribe to it. Surely.
- pythonist 8y agoBut sometimes golang docker images are late for a few days which is very annoying if your ci build pipeline depend on them. It would be great if Go team would be able to update docker images as well. And I am sure that this automation would not be so hard to do.
- entity345 8y agoWhat requirement do you have to update Go's version on the very day it is released? If you rely on such docker image then upgrade only after it is released.
- masklinn 8y ago> What requirement do you have to update Go's version on the very day it is released? The ability to test / CI that your library works properly?
- saagarjha 8y ago> libSystem is now used when making syscalls on Darwin, ensuring forward-compatibility with future versions of macOS and iOS. The switch to libSystem triggered additional App Store checks for private API usage. Since it is considered private, syscall.Getdirentries now always fails with ENOSYS on iOS. Hooray! I'm surprised it took as long as it did, since IIRC this was something that broke constantly…
- weberc2 8y agoI’ve only heard of one or two breakages...
- sodpoisadfio 8y agoYour sample size of 1 sounds significant.
- geodel 8y agoWell, in internet parlance its broken every single time. On the other hand if I like something then broken thing will always work flawlessly for me
- boyter 8y agoPerfect timing for me. I was just about to push out a new release for my code counter https://github.com/boyter/scc https://github.com/boyter/scc It appears to be ~3-4 ms faster when counting repositories like redis which is rather nice for me as a free speed boost. Probably related to the changes to GC listed here https://golang.org/doc/go1.12#runtime https://golang.org/doc/go1.12#runtime
- scottlamb 8y agoI'm impressed every release by Go's GC improvements. IIRC, they started with a terrible conservative GC. It was slow and (particularly on 32-bit platforms) ineffective. But then they made it increasingly precise, then targeted 10 ms pause times, then sub-millisecond, and so on. All with far fewer knobs than the Oracle JVM. I understand there's still a cost compared to non-GCed languages, but I think it's mostly RAM usage (perhaps affecting CPU cache effectiveness and thus efficiency) rather than tail latency.
- bpye 8y agoI feel that Go really excells in getting out of your way. I rarely find myself fighting with the language or runtime. The few occasions I have have been related to native interop and generally mean I'm having to look at the internal fields of slices or strings to modify data effeciently, and even that isn't too diffit.
- kasey_junk 8y agoI often find myself fighting with the language but the runtime more than makes up for it. In particular the GC & thread scheduler are great. The fact that they are accessible and digestible by the average go dev is so impressive a testament to their authors and their focus.
- kasey_junk 8y agoI haven’t checked since 1.10 but at that time you could definitely see what I presume was the impact of lack of compaction on heap allocations over time. That is allocations would take longer as your program ran longer. This is mitigated quite a bit by how much gets stack allocated but I imagine there are workloads that this hampers a lot, in particular large in memory data sets. That’s not to disagree with your point the GC improvements are great for my workloads but only to point out there is a cost to them.
- networkimprov 8y agoGo 1.12 fixes a bug in os.File.Sync() on MacOS, which didn't actually fsync() properly. This affects several popular database libraries. https://github.com/golang/go/issues/26650 https://github.com/golang/go/issues/26650
- tjpnz 8y agoIs iOS a thing for Go?
- angott 8y agoYou might be interested in this, although support is extremely limited and restricted to specific areas: https://github.com/golang/go/wiki/Mobile#building-and-deploying-to-ios https://github.com/golang/go/wiki/Mobile#building-and-deploy...
- rhodysurf 8y agoSort of... it works with GoMobile but because it doesnt use LLVM there is no support for bitcode which means WatchOS and tvOS are off limits and maybe iOS someday.
- steeleduncan 8y agoWould this be solveable with go-llvm?
- sandov 8y agoSomething I consider off-putting about Go is that you need a Google account to contribute. https://golang.org/doc/contribute.html https://golang.org/doc/contribute.html > A contribution to Go is made through a Google account [...]. Google accounts can either be Gmail e-mail accounts, G Suite organization accounts, or accounts associated with an external e-mail address. [...] Does anybody else feel the same way?
- FiloSottile 8y agoYou can now use plain GitHub PRs.
- bradfitz 8y agoYes and no. You can't agree to the CLA with just GitHub, IIRC.
- bpye 8y agoCan you not register a Google account with false data just for that purpose
- cflewis 8y agoPlease don't do this. All code has to have a CLA signed legitimately. Many many projects do this, and all Google projects do. You're basically going to poison the project you are trying to improve. Disclaimer: Used to work in Google's Open Source office, which administers the CLA.
- bpye 8y agoSorry, I didn't intend that you'd use false data filling the CLA. Didn't realise you relied upon the Google Account data in the CLA. If that's the case then yes, don't do that.
- FiloSottile 8y ago
- bouncycastle 8y agoFmt will print maps out in sorted order? I guess that will confuse many newcomers even more
- dx034 8y agoWhy should that confuse?
- katnegermis 8y agoI think he's referring to the fact that maps are iterated in random order. Now if you print them directly, you may be lead to believe that the order is _not_ random.
- kbd 8y agoGiven Python's success with its insertion-order-retaining "compact dict" implementation[1], I've wondered why more languages aren't adopting that design into their maps/hashtables. [1] https://docs.python.org/3/whatsnew/3.6.html#whatsnew36-compactdict https://docs.python.org/3/whatsnew/3.6.html#whatsnew36-compa...
- latch 8y ago"The order-preserving aspect of this new implementation is considered an implementation detail and should not be relied upon" Early in Go's development, they intentionally randomized the iteration offset to make sure developers didn't become dependent on a behaviour they didn't want to be tied to. You see this in Erlang also, where iteration order is deterministic (though not based on insertion order), but documentation makes sure to say iteration is arbitrary. So, the answer to your question is that most people don't want their dictionaries implementation to be tied down due to this feature.
- kbd 8y ago> "The order-preserving aspect of this new implementation is considered an implementation detail and should not be relied upon" Except it worked so well in Python and PyPy that in Python 3.7 it was blessed into an official part of the language spec.
- deleted 8y ago[deleted]
- denormalfloat 8y agoGlad to see syscall/js is still seeing updates. This seems like a excellent chance to share server and client code by being able to cross compile to wasm. Go team: please reduce the binary size of wasm files!
- agnivade 8y agoThe large binary size is mainly due to the Go runtime being packed into the binary itself. You can compile with "-ldflags -s" to make it slightly smaller. But it will almost never be comparable to Rust/Emscripten binary sizes. OTOH, there is a new project called TinyGo (https://tinygo.org https://tinygo.org) which generates LLVM byte code from Go. This allows a subset of the Go spec, sans any GC or runtime, and generates binaries comparable to Rust/Emscripten.
- deleted 8y ago[deleted]
- fastbmk 8y agoSo Go has Generics now or not yet?
- doh 8y agoNot yet
- fastbmk 8y agoOh, what a pity. Poor Go fanboys.
- networkimprov 8y agoSatire, I presume! Cue polite laughter They've been preoccupied with "Error Values" https://github.com/golang/go/issues/29934 https://github.com/golang/go/issues/29934
- fastbmk 8y agoLooks like they try to invent exceptions.
- fastbmk 8y agoGo is a new Visual Basic. But with concurrency. Mediocre language for mediocre minds.
- Tecuane 8y agoThis is a rather unique take on Go that I haven't seen before. A quick scan of your post history indicates you feel quite strongly (negatively) about Go. May I ask what inspired this particular take, and what language background you have?
- deleted 8y ago[deleted]
- _Chief 8y agoJust checked his comments, for someone that despises the language and its developers, he sure has a lot of interest in it. Bizarre
- dang 8y agoCan you please not do programming language flamewars on HN (or any flamewars)? We're hoping for somewhat better discussion quality than that here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- 1_000_000 8y agoHonest question for core devs: why do you need my phone number and address to accept any code and pull requests?
- fastbmk 8y agoBecause Go is owned and controlled by Google, the company famous for personal data collection and misuse.
- atonse 8y agoProbably to keep a file of all contributors' contact information to get your permission if they ever wanted to do a license change?
- bradfitz 8y agoI was the one who converted Google's CLA system from "Please fax us this form" to a web form. At the time (2007, 2008?) I added all the fields from the fax template to the web form. But we dropped the phone number & physical address years ago. And they were optional even before that. Nowadays we ask for your name, email address, and optional GitHub username.
- lsllc 8y agoWow, AIX support! nice!
- clinta 8y agoVery happy to read about the improvements in releasing memory back to the OS. Hopefully this will help prevent our go apps in containers from getting OOM killed.
- fastbmk 8y agoGo is not intended for any serious development. It's a concurrent Visual Basic for sysadmins. To avoid OOM just avoid Go.
- arleny 8y agoBeen meaning to make the dive into learning Go for a while now. My semester is finally slowing down so about to make the jump. I'll be doing a lot of digging on my own, but please link any resources that you feel were helpful for you.
- fastbmk 8y agohttps://www.rust-lang.org/ https://www.rust-lang.org/