Post

Russ Cox
@swtch.com

“There’s a tidal wave coming. You can see it. We can all see it. Are you going to lay down and die, or are you going to do something about it?” Be ready to patch your systems, repeatedly, for at least the next 12 months.

This post is unavailable.
Josh Bleecher Snyder
@commaok.xyz

As Brad never tires of pointing out, the cost of productivity is bugs. This is not a case in which you acted negligently or maliciously; I politely decline the apology.

Caleb Spare
@cespare.bsky.social

Oof, does this mean I've got to get my colleagues to upgrade their Go installs? Once we got to Go 1.21, we stopped ever upgrading because of automatic toolchain selection.

Russ Cox
@swtch.com

That said, if they don’t set GOPROXY to sketchy other values and don’t worry about TLS MITM attacks generally and trust Google to run proxy.golang.org honestly, then they are still okay.

Caleb Spare
@cespare.bsky.social

Ah well, after this upgrade, at least I can delete the workaround for go.dev/issue/69051 that I'd left in place for a few years. We're done finding toolchain selection bugs, right?

github.comcmd/go: GOTOOLCHAIN=version+auto doesn't use the named version in go install package@version · Issue #69051 · golang/goGo version go1.21.13 linux/amd64 Output of go env in your module/workspace: GO111MODULE='' GOARCH='amd64' GOBIN='/home/caleb/bin' GOCACHE='/home/caleb/.cache/go-build' GOENV='/home/caleb/.config/go...