roland.zone

wrote a little about the (now old news) security events of last week

The 2026 Go Developer Survey is open! Help set Go’s priorities for next year by telling us how you use Go and where it could be better. ⏱️ 10–20 minutes 📅 Open through November 3 blink.qualtrics.com/jfe/form/SV_... #golang

should’ve just posted 4 smh

If you make HTTPS requests or have other TLS clients and care about MITM attacks, you need to update today. If you run Go: go get go@1.27.3 If you run Homebrew: brew update brew install ca-certificates If you run Linux, maybe stay off the internet for now.

allowing generation of one byte keys is actually a feature, it’s a differentiator that really sets my hsm company apart from everyone else

👩🏽‍🔬 Go 1.27.3 and 1.26.10 are released! 🔐 Security: Includes 1 security fixes to the standard library. 🗣 Announcement: https://groups.google.com/g/golang-announce/c/66pojueaQek/m/tmWX2Pq9AgAJ 📦 Download: https://go.dev/dl/#go1.27.3 #golang

fun day

can someone just break ecc already so we can stop having this annoying fight on the ietf tls wg mailinglist

somewhat ironic that everyone is posting about how perelman is the only human to have solved a millennium prize problem when one of the main reasons he rejected the prize was because it ignored the work done by hamilton

i think all football shirts should be required, by law, to have a proper shirt collar. they just look better. thanks for coming to my ted talk

fifa collapsing the second it even looks in the direction of private equity is just... beautiful, a+ story writing, my compliments to the chef

next time they ask for donations, take a moment and wonder whether they are spending that money on a law firm that specializes in avoiding unionization 🙃 cwa-union.org/news/release...

ietf126 tlswg thunderdome could solve this

wild that this is the last game of the World Cup, definitely no more games after this

the archetypical england fan experience

france playing on bastille day, the fix is in

no football until tuesday, someone should really do something about that

excited to talk about the (mostly) boring vulns we have, with a slight digression about how LLMs have completely turned the way vulns are found upside down 🙃

If Go is memory-safe, where do its vulnerabilities come from? 🔒 Go Security Team Lead @roland.zone shares how the Go team identifies, responds to, and learns from vulnerabilities across the Go ecosystem. Discover what those lessons mean for building more secure Go software. 🎟️ gophercon.com

uuid was a mistake

i'm sorry, i have zero interesting in consuming a "companion podcast", i'd like to watch your slop tv show, derive my own opinions, and then immediately forget everything about it 30 minutes later

did something very silly, may have some at gophercon this year if you ever sent us a vulnerability report or contributed to Go crypto (or are just nice to me) thanks to @ljamesart.bsky.social who did the great art!

genuine question: why are the HTTPS page load numbers so much lower on Linux? is it really just people doing local development, or is there some other weird thing causing this? transparencyreport.google.com/https/overview

excited to see RFC 8738 actually being used! letsencrypt.org/2026/01/15/6...

things can actually maybe be good, it turns out

i have opinions about the ffmpeg security thing but i'm not going to post them, for my own sanity (but i am posting about not posting about it)

trying to come up with a silly toy cryptology problem for something

genuinely confused why people are so interested in this, but hey whatever

Hi folks, it’s survey time! We’d love to learn more about how you use Go and what could be improved. Share your feedback via our annual developer survey at google.qualtrics.com/jfe/form/SV_.... It should take 10 - 20 minutes to complete, and will be open through September 30. Thank you! #golang

we lived

signs you’re having a real normal one

a true rarity

😐

Here's something I am very excited about: Photosynthesis! 🌱☀️ A proposal to have CAs run transparency logs and make X.509 certificates out of Merkle Tree inclusion proofs. This is similar to how CT would have worked in an ideal world, and it solves the problem of PQC sizes in logs and handshakes.

what a successful go tree freeze day looks like