Go 1.12 Released

[FiloSottile]

_o/ hello HN, this release ships with seamless opt-in support for TLS 1.3 in crypto/tls. (Gated by the GODEBUG=tls13=1 environment variable.)

I'd be happy to answer any questions about it, or about the rest of the Go cryptography libraries!

[mholt]

I'll add, too, that anyone who wants to try TLS 1.3 right now can do so with the latest source builds of the Caddy web server. We just merged support for TLS 1.3 a few minutes after the Go 1.12 release: https://github.com/mholt/caddy/pull/2399

If you have a domain name pointed at your machine:

    $ caddy -host example.com

(Roughly equivalent to python -m SimpleHTTPServer but with HTTPS, and production-ready.)

Or if you just want to try things out:

    $ caddy "tls self_signed"

[tonymet]

I was curious about new features in tls1.3 and this doc was a good breakdown

https://www.cloudflare.com/learning-resources/tls-1-3/

[crawshaw]

Any concerns exposing Go tls1.3 directly to the internet today?

Is 0-RTT on the roadmap for Go 1.13?

[kodablah]

I know and understand the philosophy behind limited exposure/customization of the handshake process. However, there is a lot of value in implementing TLS extensions, adding early data on client hello, etc. I saw [0] but didn't see any details. Is it possible/reasonable to extract some of the internals to /x/crypto/tls or similar? Or is it either too hard to maintain or is there just too much fear about misuse?

0 - https://github.com/golang/go/issues/25807

[giovannibajo1]

Is there any performance issue that we should be aware of when turning on TLS 1.3? Go's standard library has many assembly implementations (to leverage CPU special opcodes). What is the speed of the TLS 1.3 crypto stack in Go?

[mspecter]

What's the plan for pairing based curves now that the Extended Tower Number Field Sieve has made BN256 unusable for many applications[1]? Do you plan on integrating BLS curves any time soon?

[1] see https://godoc.org/golang.org/x/crypto/bn256

[lazard]

How can we help with getting support for Ed25519 in crypto/x509 and crypto/tls?

[yesenadam]

OK thanks, basic question, but.. What is TLS?

[networkimprov]

Go 1.12 fixes a bug in os.File.Sync() on MacOS, which didn't actually fsync() properly.

This affects several popular database libraries.

https://github.com/golang/go/issues/26650

[saagarjha]

> libSystem is now used when making syscalls on Darwin, ensuring forward-compatibility with future versions of macOS and iOS. The switch to libSystem triggered additional App Store checks for private API usage. Since it is considered private, syscall.Getdirentries now always fails with ENOSYS on iOS.

Hooray! I'm surprised it took as long as it did, since IIRC this was something that broke constantly…

[weberc2]

I’ve only heard of one or two breakages...

[boyter]

Perfect timing for me. I was just about to push out a new release for my code counter https://github.com/boyter/scc

It appears to be ~3-4 ms faster when counting repositories like redis which is rather nice for me as a free speed boost. Probably related to the changes to GC listed here https://golang.org/doc/go1.12#runtime

[scottlamb]

I'm impressed every release by Go's GC improvements. IIRC, they started with a terrible conservative GC. It was slow and (particularly on 32-bit platforms) ineffective. But then they made it increasingly precise, then targeted 10 ms pause times, then sub-millisecond, and so on. All with far fewer knobs than the Oracle JVM.

I understand there's still a cost compared to non-GCed languages, but I think it's mostly RAM usage (perhaps affecting CPU cache effectiveness and thus efficiency) rather than tail latency.

[vanderZwan]

> It appears to be ~3-4 ms faster when counting repositories like redis which is rather nice for me as a free speed boost.

Nice! Out of curiosity: what is the total running time? Or in other words: what is the average performance improvement in percentages?

[denormalfloat]

Glad to see syscall/js is still seeing updates. This seems like a excellent chance to share server and client code by being able to cross compile to wasm.

Go team: please reduce the binary size of wasm files!

[agnivade]

The large binary size is mainly due to the Go runtime being packed into the binary itself. You can compile with "-ldflags -s" to make it slightly smaller. But it will almost never be comparable to Rust/Emscripten binary sizes.

OTOH, there is a new project called TinyGo (https://tinygo.org) which generates LLVM byte code from Go. This allows a subset of the Go spec, sans any GC or runtime, and generates binaries comparable to Rust/Emscripten.

[1_000_000]

Honest question for core devs: why do you need my phone number and address to accept any code and pull requests?

[bradfitz]

I was the one who converted Google's CLA system from "Please fax us this form" to a web form. At the time (2007, 2008?) I added all the fields from the fax template to the web form. But we dropped the phone number & physical address years ago. And they were optional even before that.

Nowadays we ask for your name, email address, and optional GitHub username.

[atonse]

Probably to keep a file of all contributors' contact information to get your permission if they ever wanted to do a license change?

[fastbmk]

Because Go is owned and controlled by Google, the company famous for personal data collection and misuse.

[bouncycastle]

Fmt will print maps out in sorted order? I guess that will confuse many newcomers even more

[jxub]

This FOSDEM Francesc explained the rationale behind this change, and namely in order to have an easier time comparing maps while debugging.

[tapirl]

The outputs of examples in many tutorials need to be corrected. :)

What not add a new format verb instead?

[dilap]

Definitely a trade-off here between being handy for people that know what's gong on and confusing for beginners...

[dx034]

Why should that confuse?

[entity345]

To me it's a deeper issue that this and breaches the single responsibility principle.

fmt should only print, not manipulate the data it is asked to print.

I believe that the spec says that maps iterate over keys effectively at random and so that should be the result of any operation that iterates over keys.

[bithavoc]

This is so great, although I tried to update my docker container and the official docker container is still in rc.

[bradfitz]

The Go team doesn't own the official Docker containers and we don't notify the maintainers when we do a release. We probably should.

[mrweasel]

I had to check what the Go docker image does.... It does NOTHING, it just builds and installs Go, why would you even need a container for this?

[arleny]

Been meaning to make the dive into learning Go for a while now. My semester is finally slowing down so about to make the jump. I'll be doing a lot of digging on my own, but please link any resources that you feel were helpful for you.

[clinta]

Very happy to read about the improvements in releasing memory back to the OS. Hopefully this will help prevent our go apps in containers from getting OOM killed.

[sandov]

Something I consider off-putting about Go is that you need a Google account to contribute.

https://golang.org/doc/contribute.html

> A contribution to Go is made through a Google account [...]. Google accounts can either be Gmail e-mail accounts, G Suite organization accounts, or accounts associated with an external e-mail address. [...]

Does anybody else feel the same way?

[wmf]

The fact that Go is mostly controlled by Google doesn't bother you, but that does?

(I consciously avoided getting a Gmail account for years until I bought an Android phone which requires such an account, so I understand where you're coming from but this issue seems meh to me.)

[FiloSottile]

You can now use plain GitHub PRs.

[lsllc]

Wow, AIX support! nice!

[tjpnz]

Is iOS a thing for Go?

[angott]

You might be interested in this, although support is extremely limited and restricted to specific areas: https://github.com/golang/go/wiki/Mobile#building-and-deploy...

[rhodysurf]

Sort of... it works with GoMobile but because it doesnt use LLVM there is no support for bitcode which means WatchOS and tvOS are off limits and maybe iOS someday.

[networkimprov]

Satire, I presume! Cue polite laughter

They've been preoccupied with "Error Values"

https://github.com/golang/go/issues/29934

[doh]

Not yet

[dang]

Can you please not do programming language flamewars on HN (or any flamewars)? We're hoping for somewhat better discussion quality than that here.

https://news.ycombinator.com/newsguidelines.html

[Tecuane]

This is a rather unique take on Go that I haven't seen before. A quick scan of your post history indicates you feel quite strongly (negatively) about Go. May I ask what inspired this particular take, and what language background you have?