Anyone run any real-world performance comparisons on what this defer change did to the performance of their application?
Go 1.14 release notes
11–20 of 42 posts
Re: Go 1.14 release notes
#12Maybe link the changelog instead? https://tip.golang.org/doc/go1.14 Selected changes: - This release improves the performance of most uses of defer to incur almost zero overhead compared to calling the deferred function directly. As a result, defer can now be used in performance-critical code without overhead concerns. - Goroutines are now asynchronously preemptible. As a result, loops without function calls no longe…
As far as I understand, I don't think it is officially released as of this moment. (It is getting close, though).
For example, as of now, the standard release note url for 1.14 currently 404s: https://golang.org/doc/go1.14
Re: Go 1.14 release notes
#13It just struck me that the Go team does not provide PGP or other cryptographic signing/verification of releases.
What assurances does that give you beyond the https certificate on their official website which contains the binary downloads and hashes?
Re: Go 1.14 release notes
#14Maybe link the changelog instead? https://tip.golang.org/doc/go1.14 Selected changes: - This release improves the performance of most uses of defer to incur almost zero overhead compared to calling the deferred function directly. As a result, defer can now be used in performance-critical code without overhead concerns. - Goroutines are now asynchronously preemptible. As a result, loops without function calls no longe…
[deleted]
Re: Go 1.14 release notes
#15It just struck me that the Go team does not provide PGP or other cryptographic signing/verification of releases.
What assurances does that give you beyond the https certificate on their official website which contains the binary downloads and hashes?
If a hosting server is compromised the hash and download can be changed with something nefarious. crypto signing/verification will catch that case. hash checking will not.
This is a legitimate case as it's happened to other projects in the past.
Re: Go 1.14 release notes
#16It just struck me that the Go team does not provide PGP or other cryptographic signing/verification of releases.
Re: Go 1.14 release notes
#17It just struck me that the Go team does not provide PGP or other cryptographic signing/verification of releases.
What assurances does that give you beyond the https certificate on their official website which contains the binary downloads and hashes?
Defense in depth, essentially. But yes, checking site X to see if site X gave you Y correctly is rather weak confidence.
To argue in its favor tho, file-hosting and site-serving may be handled by different systems with different security characteristics, and potentially even different datacenters (e.g. a CDN). If you only have to compromise one system, it's generally easier to do so than when you have to compromise N and make them all agree with each other.
Re: Go 1.14 release notes
#18Buried in the notes is a small, but useful addition to the testing package that allows your test helpers to register their own cleanup functions (testing.(*T).Cleanup). I wrote a blog post discussing it in depth here: https://www.gopherguides.com/articles/test-cleanup-in-go-1-1...
Re: Go 1.14 release notes
#19Earlier quoted context omitted.
What assurances does that give you beyond the https certificate on their official website which contains the binary downloads and hashes?
If a hosting server is compromised the hash and download can be changed with something nefarious. crypto signing/verification will catch that case. hash checking will not. This is a legitimate case as it's happened to other projects in the past.
The download comes from dl.google.com while the checksum is published on golang.org.
FWIW the macOS pkg you download is signed.
Re: Go 1.14 release notes
#20Maybe link the changelog instead? https://tip.golang.org/doc/go1.14 Selected changes: - This release improves the performance of most uses of defer to incur almost zero overhead compared to calling the deferred function directly. As a result, defer can now be used in performance-critical code without overhead concerns. - Goroutines are now asynchronously preemptible. As a result, loops without function calls no longe…
As far as I understand, I don't think it is officially released as of this moment. (It is getting close, though). For example, as of now, the standard release note url for 1.14 currently 404s: https://golang.org/doc/go1.14
The download page (https://golang.org/dl/) shows 1.14 as the current version.