Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Go 1.15 Released

golang.org

Post reply on HN
Print view View original

41–50 of 74 posts

Re: Go 1.15 Released

#41

Post by temp667 »

sagichmal wrote: post #27
mholt wrote: post #24

Caddy binaries on Linux shrink by ~2.5 MB with Go 1.15! (~33 MB down to ~31 MB) 3 MB savings on Mac, and 2 MB on Windows: https://github.com/caddyserver/caddy/pull/3642#issuecomment-... So about 8-10% reduction.

I'm so confused by this. Given the context that Go primarily targets, which is daemon services running on server class machines, binary size, so long as it's not totally absurd, is almost completely irrelevant. Is it like a code golf thing? Why do you care?

It targets a broader set of items then that (I'd describe as static type, GC, fast to compile / run language?).

I've noticed the issue of big deploy sizes with docker including with interpreted and other big package languages (Java can haul around a ton + JVM etc). It's somewhat hard to get small container sizes even for a simple hello world program with these approaches.

Folks are doing 15MB docker images for Go. Google likes really stripped down things (low attack surface etc) - see their distroless initiative.

Re: Go 1.15 Released

#42

Post by pansa2 »

> There are no changes to the language.

Are there other mainstream languages that are as conservative as Go when it comes to adding new features?

I don't love Go as a language, but coming from C++ and Python, both of which have non-stop accumulation of features (and complexity), Go's philosophy is a breath of fresh air.

Re: Go 1.15 Released

#43

Post by wokwokwok »

cle wrote: post #40
sagichmal wrote: post #27

Earlier quoted context omitted.

I'm so confused by this. Given the context that Go primarily targets, which is daemon services running on server class machines, binary size, so long as it's not totally absurd, is almost completely irrelevant. Is it like a code golf thing? Why do you care?

These days, server-class machines are often ephemeral and spun up-and-down based on demand. At work, I operate services that have 2 GB of Java code packages, and others that use a single 10 MB Go binary. Guess which one can scale up much more quickly to handle increased demand?

Obviously.

...but the point being made is at 10% reduction, a 9MB and a 10MB binary are indistinguishable.

They scale almost identically.

so... it seems a bit like premature optimisation to devote such a large amount of effort to what appears to be a win that affects virtually no one except those few (FANG) who deploy to thousands of services daily.

Re: Go 1.15 Released

#44

Post by closeparen »

taywrobel wrote: post #30
sagichmal wrote: post #27

Earlier quoted context omitted.

I'm so confused by this. Given the context that Go primarily targets, which is daemon services running on server class machines, binary size, so long as it's not totally absurd, is almost completely irrelevant. Is it like a code golf thing? Why do you care?

Given that modern systems include containerization and dozens or hundreds of instances of applications bouncing continually as changes are made or network conditions change, deployment has gotten a lot more “chatty” than tossing a binary on a server and running it. Reducing binary size makes a difference when the app is deployed to remote servers thousands of times under normal operation. Storage and bandwidth is che…

My company runs Go and Java programs that locally compile in seconds to binaries / JARs that weigh tens of megabytes. But for production, we insist on spending tens of minutes building and copying around Docker containers that weigh gigabytes.

Re: Go 1.15 Released

#45

Post by mdasen »

pansa2 wrote: post #42

> There are no changes to the language. Are there other mainstream languages that are as conservative as Go when it comes to adding new features? I don't love Go as a language, but coming from C++ and Python, both of which have non-stop accumulation of features (and complexity), Go's philosophy is a breath of fresh air.

Possibly Scheme or Racket? S-expression, functional languages don't seem to accumulate language features at an incredible rate (but I don't use them frequently so someone might correctly contradict me).

I too like Go's restraint. It really doesn't want to give you a tool to make a one-liner that is easy to conceal a bug. For example, Go's increment (eg, i++) is a statement, not an expression. You can't do list[++i] or anything.

There are parts of Go that I'm less a fan of, but they keep a nice eye toward making sure that the code is understandable and reviewable.

Re: Go 1.15 Released

#46

Post by maxioatic »

> When the flag package sees -h or -help, and those flags are not defined, it now prints a usage message. If the FlagSet was created with ExitOnError, FlagSet.Parse would then exit with a status of 2. In this release, the exit status for -h or -help has been changed to 0.

This is nice. I basically only write small CLIs with Go and don't explicitly define help flags. I always wondered why it returned an exit code of 2.

Re: Go 1.15 Released

#47

Post by psanford »

pansa2 wrote: post #42

> There are no changes to the language. Are there other mainstream languages that are as conservative as Go when it comes to adding new features? I don't love Go as a language, but coming from C++ and Python, both of which have non-stop accumulation of features (and complexity), Go's philosophy is a breath of fresh air.

The Go 1.x compatibility promise is one of Go's best features.

Re: Go 1.15 Released

#48

Post by snazz »

Foxboron wrote: post #25
jaytaylor wrote: post #22

Earlier quoted context omitted.

I'm curious which package managers / repositories allow you to update to the latest version of go as soon as it's released * ? * In any remotely trustable and reliable way; random PPAs relying on somebody's free time don't count, IMHO. I've noticed Ubuntu, Debian, Centos, and Oracle Enterprise Linux are always trailing by quite a clip. Often years. The strategy I've been using is to just manually install it on the ma…

> I'm curious which package managers / repositories allow you to update to the latest version of go as soon as it's released * ? Arch Linux. I just saw the release when I was checking for updated versions of packages I maintain, and built it before users started bugging me about outdated go binaries. https://www.archlinux.org/packages/community/x86_64/go/

I continue to love how this works out with security updates too. I usually get new browser and kernel versions after particularly bad CVEs within a few hours from the upstream release.

Re: Go 1.15 Released

#49

Post by cesarb »

throwaway43234 wrote: post #8
xorcist wrote: post #2

Where are signatures for these binaries published?

I've always been a bit confused as to what the attack vector those protect against is for self-hosted packages (i.e. not torrents, third party hosting services, etc.). If the attacker is able to coerce the web server into sending a compromised package when you `GET https://dl.google.com/go/go1.15.src.tar.gz` , couldn't they just as easily send a compromised checksum when you `GET https://golang.org/dl/` ?

Notice that, in your example, they are different servers. Not only that, but "dl.google.com" is most probably a cluster of servers spread all over the world. If an attacker somehow compromises one of the servers behind "dl.google.com", those unlucky to use that particular server could receive a malicious package; but if they compare the hash or signature with what "golang.org" says should be the correct one, they will notice that something's not right (and can warn others, and/or compare the malicious package with a legitimate one obtained elsewhere). The main server ("golang.org" in this case) is usually considered more trusted than the download mirrors (and is often in a single location, not mirrored all over the world).

Re: Go 1.15 Released

#50

Post by wyoh »

jaytaylor wrote: post #22
gautamcgoel wrote: post #17

Earlier quoted context omitted.

Yes, I agree. No point on linking to the download page, most people use their package manager to update their Go installation.

I'm curious which package managers / repositories allow you to update to the latest version of go as soon as it's released * ? * In any remotely trustable and reliable way; random PPAs relying on somebody's free time don't count, IMHO. I've noticed Ubuntu, Debian, Centos, and Oracle Enterprise Linux are always trailing by quite a clip. Often years. The strategy I've been using is to just manually install it on the ma…

Fedora rawhide packages the latest even beta and rc. We often are the first to report new bugs introduced by the latest release.
Post reply on HN