jub0bs

perfloop.aiPerfloop · The Performance MachinePerfloop learns your system from code and telemetry, hunts a wide catalog of performance patterns, and delivers a stream of proven pull requests. Software that stays fast.

Perfloop, Tomás Senart's project, identified a subtle bug (due to an oversight about preflight on my part) in the CORS library I maintain for #golang. Pretty impressive! The latest release (v1.1.3) fixes the bug in question. github.com/jub0bs/cors/... perfloop.ai

17 Sept

Happy 40th birthday, Elliot Alderson! 🎂 #MrRobot

jub0bs reposted

Phil Eaton

@eatonphil.bsky.social

24 July

I wrote an article about Go's new Green Tea garbage collector. Paywall has expired, give it a read. theconsensus.dev/p/2026/07/19...

rfc-editor.orgRFC 7519: JSON Web Token (JWT) | RFC EditorJSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object that is used as the payload of a JSON ...

30 June

If "JWT" is meant to be pronounced "jot", is "JWS" meant to be pronounced "jaws"? 🦈 www.rfc-editor.org/info/rfc7519...

pentesterlab.comHow to Securely Design Your JWT Library - PentesterLab's BlogThis article explores best practices for designing a secure JWT library, focusing on making secure implementations the default and minimizing potential vulnerabilities. Key strategies include disablin...

11 June

Security-related libraries (for CORS, JWTs, etc.) should be designed to be, not only easy to use, but hard to misuse: - pentesterlab.com/blog/secure-... by @snyff.pentesterlab.com - jub0bs.com/posts/2023-0...

clickup.comApril 27th - What happened with our feature flag configuration | The ClickUp BlogOn April 27, 2026, a security researcher publicly disclosed that ClickUp’s client-side feature flag configuration exposed personally identifiable information. Specifically, 893 customer email addresse...

3 May

What a fall from grace for HackerOne, once my favourite bug-bounty platform. 😬 "HackerOne triage analyst incorrectly closes the report as a duplicate [...]" clickup.com/blog/april-2...

github.comGitHub - jub0bs/cors: perhaps the best CORS middleware library for Goperhaps the best CORS middleware library for Go. Contribute to jub0bs/cors development by creating an account on GitHub.

1 May

v0.13.3 through v1.0.1 of github.com/jub0bs/cors contain an embarrassing bug that affects functionality (though not security). Thanks to Herman Slatman for reporting it. 🙇 The bug is fixed in v1.0.2. Update when you can.

github.comx/website: explicitly exclude error messages from the Go 1 compatibility promise · Issue #78991 · golang/goThe document that specifies the Go 1 compatibility promise ("go1compat" for short) lists a number of exclusions: Security. A security issue in the specification or implementation may come to light ...

28 Apr

I've just filed a #golang issue aiming to explicitly exclude error messages from the Go 1 compatibility promise: github.com/golang/go/is...

jub0bs reposted

Filippo Valsorda

@filippo.abyssdomain.expert

28 Apr

A bit over two years after starting to work on it... Go is officially FIPS 140-3 certified 💥 csrc.nist.gov/projects/cry... I am pretty confident Go is now one of the most—if not the most—seamless and complete FIPS 140-3 compliance solutions... with a single env var, out of the box.

jub0bs reposted

Marcus Hutchins

@malwaretech.com

21 Apr

Shot: "We were hit by a sophisticated AI-accelerated cyberattack"

golangweekly.comGolang Weekly Issue 596: April 10, 2026#596 — April 10, 2026

11 Apr

Issue 596 of the Golang Weekly newsletter mentions the v1 release of github.com/jub0bs/cors. Nice! #golang golangweekly.com/issues/596

en.wikipedia.orgTherac-25 - WikipediaThe Therac-25 was a computer-controlled radiation therapy machine produced by Atomic Energy of Canada Limited (AECL) in 1982 after the Therac-6 (neptune) and Therac-20 units (the earlier units had been produced in partnership with Compagnie générale de radiologie (CGR) of France).[1]

11 Apr

There are no benign data races. In fact, some are lethal. ☠️ en.wikipedia.org/wiki/Therac-25

jub0bs reposted

@golang.org

7 Apr

🥳 Go 1.26.2 and 1.25.9 are released! 🔐 Security: Includes 10 security fixes for the standard library and the toolchain. 📢 Announcement: https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU/m/7CDdDXqeBwAJ ⬇️ Download: https://go.dev/dl/#go1.26.2 #golang

github.comGitHub - jub0bs/cors: perhaps the best CORS middleware library for Goperhaps the best CORS middleware library for Go. Contribute to jub0bs/cors development by creating an account on GitHub.

7 Apr

🎉 After a few years of refinement and close to 1 >> 9 commits, I'm pleased to announce the v1 release of my CORS middleware library for Go. Let me know whether it patches things up between you and CORS! github.com/jub0bs/cors #golang #CORS

7 Apr

I obviously meant 1 << 9, not 1 >> 9. 😅

27 Mar

I love how the conjunction of #golang's modules system and build constraints lets you have your cake and eat it too! 🍰 You can let users of your library take advantage of the bleeding edge if they so wish without cutting off one of the currently supported Go toolchains.

27 Mar

When something tantalising gets merged at tip, you can put code that relies on it in a file guarded by a //go:build go1.27 build constraint and its pre-1.27 counterpart in a file guarded by a //go:build !go1.27 build constraint. No need to update your go.mod's go directive.

go-review.googlesource.comgo-review.googlesource.comGerrit Code Review

26 Mar

Even when you cannot eliminate all bounds checks within a loop, eliminating most of them may benefit performance. 😉 #golang go-review.googlesource.com/c/go/+/759100

github.comproposal: spec: make bool an ordered type · Issue #78027 · golang/goGo Programming Experience Experienced Other Languages Experience Python, Haskell, JavaScript, C Related Idea Has this idea, or one like it, been proposed before? Does this affect error handling? Is...

9 Mar

I've just filed a proposal to make bool an ordered type (compatible with operators <, <=, >, and >=) in #golang: github.com/golang/go/is...

25 Mar

Unfortunately, this proposal would require a breaking change. Therefore, I've decided to retract it.

23 Mar

Paradoxically (perhaps), as the Go compiler becomes better at eliminating bounds checks, attacker-reachable panics due to incorrect programmer assumptions about indices become easier to find. #golang

go-review.googlesource.comgo-review.googlesource.comGerrit Code Review

19 Mar

Fewer bounds checks in #golang thanks to Youlin Feng: go-review.googlesource.com/c/go/+/719881

jub0bs reposted

Alan Donovan

@adonovan.bsky.social

11 Mar

Find out how the source-level inliner in Go 1.26 can help you with API migrations. go.dev/blog/inliner

go.dev//go:fix inline and the source-level inliner - The Go Programming LanguageHow Go 1.26's source-level inliner works, and how it can help you with self-service API migrations.

2 Mar

#golang quiz: What happens if you try to compile and run the following program? package main import ( "fmt" "math" ) func main() { fmt.Println(int(math.NaN())) } a. It prints 0. b. It prints -1. c. It panics. d. Compilation fails. e. Something else.

github.comspec: generic methods for Go · Issue #77273 · golang/goProposal: Generic Methods for Go A change of view. Background For clarity, in the following we use the term concrete method (or just method when the context is clear) to describe a non-interface me...

26 Feb

🚀 "spec: generic methods for Go" has been accepted! You will soon (1.27?) be able to declare (on concrete types only) methods that introduce type parameters, i.e. type parameters other than the ones (if any) that come from the method's receiver. github.com/golang/go/is... #golang

26 Feb

Since the inception of generics in Go (1.18), methods could not introduce type parameters. You had to resort to declaring package-scoped functions instead; code organisation and ergonomics typically suffered. The proposal lifts this restriction for concrete types (though not for interface types).

go.devGo Playground - The Go Programming Language

25 Feb

A friendly reminder that a Go program doesn't need an import of the "unsafe" package to undermine the language's type system; a synchronisation bug may be enough: go.dev/play/p/L0_Zr... #golang

25 Feb

(If you get a timeout on the playground, try again, or try running the program locally.)

22 Feb

For months (maybe years, even) now, I've been accumulating notes with a view to producing a performance-oriented Go training course. There's just so many techniques and tools to master! I'm hopeful for a release some time in 2026, though. 🤞 #golang

pkg.go.deverrors package - errors - Go Packages

21 Feb

If you've already migrated to Go 1.26, there's no longer any point in relying on github.com/jub0bs/errutil. Simply rely on errors.Astype instead. pkg.go.dev/errors#AsType #golang

github.comGitHub - jub0bs/cors: perhaps the best CORS middleware library for Goperhaps the best CORS middleware library for Go. Contribute to jub0bs/cors development by creating an account on GitHub.

12 Feb

🎉 I've just released v0.12.0 of jub0bs/cors, my CORS middleware library for #golang! - Go 1.25 or above is now required. - Some minor performance improvements. Still guaranteed free of AI slop, of course. github.com/jub0bs/cors

12 Feb

An unfortunate bug snuck in v0.12.0: some middleware would disallow origins that they should have allowed. Fixed in v0.12.1. Apologies. 🙇

jub0bs reposted

@golang.org

10 Feb

🎆 Go 1.26.0 is released! 🗒️ Release notes: https://go.dev/doc/go1.26 ⬇️ Download: https://go.dev/dl/#go1.26.0 #golang

10 Feb

#golang quizz: why is the implementation of the following function naive/incorrect, and how would you fix it? 😉 // opposite returns the opposite of comparator function cmp. func opposite[T any](cmp func(T, T) int) func(T, T) int { return func(x, y T) int { return -cmp(x, y) } }

github.comcmp: add Or · Issue #60204 · golang/goAn extremely common string operation is testing if a string is blank and if so replacing it with a default value. I propose adding First(...strings) string to package strings (and probably an equiv...

9 Feb

I must confess I regret github.com/golang/go/is.... I've since found cmp.Or to be quite useful, esp. for implementing comparator functions for struct types. Thanks to @carlana.net for pushing for its addition to #golang's standard library.

github.comGitHub - jub0bs/cors: perhaps the best CORS middleware library for Goperhaps the best CORS middleware library for Go. Contribute to jub0bs/cors development by creating an account on GitHub.

8 Feb

Well, I might produce a v0.12.0 to accompany Go 1.26, whose release is imminent.

jub0bs@jub0bs.com

🎉 I've just released v0.11.0 of jub0bs/cors, my CORS middleware library for Go! Bar any surprises, this will be the last minor release before v1. github.com/jub0bs/cors

youtube.comCross-App Security: Cross-Origin Resource Sharing (CORS)YouTube video by Ryan Armstrong

3 Feb

Rare enough to be worth sharing: a video about CORS of remarkable precision, courtesy of Digital Boundary Group's Ryan Armstrong: www.youtube.com/watch?v=79Ud...

github.comGitHub - jub0bs/cors: perhaps the best CORS middleware library for Goperhaps the best CORS middleware library for Go. Contribute to jub0bs/cors development by creating an account on GitHub.

🎉 I've just released v0.11.0 of jub0bs/cors, my CORS middleware library for Go! Bar any surprises, this will be the last minor release before v1. github.com/jub0bs/cors

⚡Middleware execution during preflight is now faster and incurs fewer heap allocations.

github.comSponsor @jub0bs on GitHub Sponsorsinfosec enthusiast • Go developer & trainer • minimalist • chaotic good • trying to make sense of the Web • he/him

💸 As always, sponsors are welcome! github.com/sponsors/jub...

github.comGitHub - jub0bs/cors: perhaps the best CORS middleware library for Goperhaps the best CORS middleware library for Go. Contribute to jub0bs/cors development by creating an account on GitHub.

🎉 I've just released v0.11.0 of jub0bs/cors, my CORS middleware library for Go! Bar any surprises, this will be the last minor release before v1. github.com/jub0bs/cors

💣 This release brings a couple of simplifying but potentially breaking changes. None of them is very likely to affect you. github.com/jub0bs/cors/...