The World Is An Experiment

Hi ,

Academic theories and models are a fundamental part of scientific research, but failing to test a theory against reality can become outright dangerous. Real-world experiments can be guardrails and booster rockets for theories.

That's why the Go team frequently releases new ideas as Go Experiments before deciding whether to add them to Go or toss them in the trashcan.

That's why it's so much more effective to pprof a slow app rather than theorize about possible causes.

And that's why tracing HTTP requests is 100 times better than insisting that they should work because the code is definitely, undoubtedly correct.

So this issue is dedicated to exploring, analyzing, inspecting, evaluating, and observing.

Happy experimenting!

–Christoph

Featured articles

Go Experiments Explained

The Go team is very cautious about introducing new features to the language or toolchain. Often, a new (possible) feature becomes a Go Experiment for one or more versions. Disabled by default at first, then enabled by default, then moved out of experimental status (if all goes well). Alex Edwards took a closer look at the typical lifecycle of a Go Experiment.

Optimizing a Go TUI: A Real-World pprof Case Study

Another field report on pprof helping to speed up a Go app. Many success stories about pprof describe how a gnarly performance bug deep down the code was eventually uncovered, but this one is about four different optimizations done with pprof. So, there is more than one takeaway to take away.

Tracing HTTP Requests with Go's net/http/httptrace

net/http/httptrace helps to troubleshoot slow or failing HTTP requests. An interesting aspect is how a tracer gets injected into request handling. No interface anywhere; instead, injection happens via context.Context.

[security] Go 1.26.4 and Go 1.25.11 are released

Three security fixes come with the latest minor releases. My govulncheck GitHub Action (thank you, Filippo Valsorda) already bugged me to update my go.mod.

To learn more about the release, hop over to the Podcast section, where Jonathan and Shay discuss a few details of the fixed issues. My favorite one is the textproto issue where an attacker could inject "misleading content" (from terminal control codes to AI prompts) into textproto's error handling. Morale: always sanitize input from 3rd parties.

Podcast corner

go podcast() 088: Just listen to Dom

Git worktrees seem to have become quite popular in the AI context recently. Dominic and Morten discuss the usefulness of worktrees for multi-branch development, moving on with exploring LLMs for generating UIs, examining Datastar's FatMorph strategy for real-time UI updates, and discussing deployment strategies such as Caddy's retries for zero downtime.

Cup o' Go: Quantum MIME, Eurovision, and lots of MONEY

Preslav Rachev is on the show this time, talking to Jonathan and Shay about his journey from Delphi to Go, AI-assisted coding and how Go fits into agentic workflows, and his book on generative art with Go.

Quote of the Week: It works so well

Anyone who says AI generated code is terrible has not tried it with Go. It works so well.

– Darren Shepherd

Who said that the choice of programming language doesn't matter anymore in times of AI?

More articles, videos, talks

Self-calling executables

Ok, so a process spawns a copy of itself. Doesn't sound exciting, does it? Surely quite useless.

Well, not quite.

Golang code review notes II - elttam

What happens if a login process blocks direct logins as "admin" and someone passes admin\x00 (where \x00 represents a null byte) as a username?

Zoltan Madarassy and Alex Brown collected a few subtle (and not-so-subtle) coding faults, including this one.

Web compression in 2026: brotli, zstd, and compression patterns

Brotli, zstd, gzip, deflate: Which tool is better? (Spoiler: it depends)

Thoughts on starting new projects with LLM agents

How can you benefit from AI assistance in your Go projects without blindly trusting AI? Eli Bendersky shares a few insights from a recent project he built with the help of AI agents. (Hint: Eli talks about "CLs", which is Google-internal terminology and means "changelist", roughly the equivalent of pull requests (PRs) in GitHub lingo.)

Pro tip: If you frequently review AI-assisted PRs, modem-dev/hunk: Review-first terminal diff viewer for agentic coders could check off some boxes. (I discovered it via a tweet from Mitchell Hashimoto (founder of Hashicorp).)

Projects

Libraries

SennovE/qrafter: Qrafter forges dialect-aware SQL queries directly from your Go structs.

A SQL query builder, not too low-level, not too close to an ORM, and soon supporting automatic migration from Go structures.

Tools and applications

subwaycookiecrunch/zentorrent: just a cli torrent downloader. no ui, no bs.

While the main goal is being minimalistic without UI bloat, Zentorrent still has some not-so-minimalistic features, such as streaming download, a search function, a bookmarks system, and, well, a plain download mode.

bruin-data/ingestr: ingestr is a CLI tool to copy data between any databases with a single command seamlessly.

Another tool that switched from Python to Go. A full rewrite to reap the obvious benefits: speed, compiled & self-sufficient binaries, effortless cross-compilation.

ingestr copies database tables from one DB to another, irrespective of the DB type: MongoDB to PostgreSQL? Here you go. It supports a ton of source database brands and half a ton of destinations.

i-got-this-faa/fbs-core: Fast Blob Storage (FBS) is a s3 compatible blob storage and CDN solution primarly for self hosting

With Minio being archived and other S3 projects being either too sophisticated or of questionable quality, FBS looks like a viable S3 solution especially for home labs.

jR4dh3y/BoxBox: A modern, self-hosted file manager for your homelab. Built in SvelteKit & Go

Upload, download, copy, move, and delete files on your homelab server easily.

altgit.git — files

What does a Git hosting server need? Issues? PRs? Discussions? Online editors? Actions?

Paolo Lulli decided that he needs none of this when he just wants to share repos online and created altgit, a minimalist repo server for self-hosting.

Completely unrelated to Go

If you won't carry the pager, maybe don't push to mainline

AI makes it easy to work on code without understanding the context, but the lack of human expertise will come back to haunt the whole project.

rsync and outrage | by Andrew Tridgell

In the previous issue, I featured "How my minimal, memory-safe Go rsync steers clear of vulnerabilities". The article was inspired by a recent flood of security reports flowing towards the original rsync project.

Andrew Tridgell, co-author of rsync, soon found out that increasing the security levels involves a large amount of work, so he reached out to AI assistance. (As we know since Anthropic's "Mythos" model, LLMs are getting frighteningly good at spotting security holes, and project maintainers increasingly use AI to fix security issues.)

Now he's faced with waves of anti-AI rage, and he decided to publish a response.