Latest Posts (20 found)
spf13 3 months ago

Why TypeScript 7.0 Was Rewritten in Go (and what it means for your dev stack)

Over the last year, the team that invented TypeScript ported the TypeScript compiler and tools to Go . Not Rust. Not C++. Go . Microsoft’s numbers show build times improving by roughly an order of magnitude in the Go-based TypeScript 7.0. In the age of AI-assisted development, one of the largest JavaScript/TypeScript organizations on earth chose Go for its flagship tool. Microsoft’s reasons were pragmatic, and Anders Hejlsberg laid them out : the existing compiler’s function-heavy style ported to Go nearly one-to-one, both the old and new compilers depend on garbage collection, and native code with shared-memory concurrency is where the 10x came from. The announcement doesn’t mention AI once. But the properties that made a pragmatic 1:1 port possible: simple functions, no hidden magic, a GC, code a team can hold in its head, are the same properties the next era of development demands, and that’s what this post is about. Go was built on a bet: optimize for the reader, not the writer, in exchange for less code to misread. LLMs read code more than any human ever could, and as they write a growing share of it, humans become even more reader-heavy. Agentic development is the most extreme test yet of the goal Go was built for: readability, maintainability, long-term correctness at scale. The conventional argument for Python and TypeScript in the AI era is strong on the surface. Python has PyTorch, LangChain, and the ML ecosystem. TypeScript has the web and a vast developer pool. LLMs trained on mountains of both write them fluently, confidently, and fast. Python and JavaScript were designed as scripting languages: fast to write, forgiving, dynamic. TypeScript adds structure on top, but it’s a compile-time overlay: types are erased at runtime, so none of TypeScript’s guarantees survive execution. TypeScript hasn’t displaced JavaScript so much as grown alongside it: GitHub’s 2025 Octoverse report has TypeScript overtaking Python and JavaScript by monthly contributors, but JavaScript still generated nearly double the new repositories over the same 12 months, and GitHub’s own summary is blunt: “JavaScript is still massive,” and the combined “JavaScript/TypeScript ecosystem still accounts for more overall activity than Python alone.” Agentic systems aren’t scripts, though; they’re services, pipelines, CLIs, and distributed systems running in production for years, and all three languages fight that design at every step: complexity management, dependency isolation, deployment, runtime safety. Go was designed as a systems language for large, long-lived software, and the industry is converging on exactly that category: compiled, safe, built to run for years, not scripted for an afternoon. The most exciting thing happening in TypeScript right now is its port to Go. The most exciting things happening in the Python world are mostly happening in Rust: Pydantic ’s validation core is Rust, Polars is Rust, HuggingFace tokenizers is Rust, and Astral’s is Rust too. Go’s share of that shift looks different but is just as telling: it’s the default choice for the infrastructure the current wave of agentic tools is built on. Ollama , the standard way to run local models, is Go. Weaviate , the vector database behind countless RAG and agent-memory stacks, is Go. Temporal , the durable-execution engine teams use to orchestrate long-running agent workflows, is Go. Charm’s Crush , a beautiful AI coding agent CLI in the same category as Google’s Antigravity , is Go too. Even GitHub’s own MCP server , the reference implementation for connecting AI agents to GitHub, is Go. In a development loop, the question isn’t “which language is easiest to write?” It’s “which is easiest to write, review, and ship?” Agentic development multiplies that question. A machine now asks it hundreds of times a day. An agentic coding loop looks like this: implement → build → test → analyze failure → self-correct → repeat. A human developer runs this loop maybe a dozen times per hour; an autonomous agent runs it dozens of times per task : what Anthropic’s guidance on coding agents describes as systems that “iterate on solutions using test results as feedback.” That frequency changes the economics of language choice. Wes McKinney named this shift in his essay on agent ergonomics : once an agent is doing the coding, fast compile-test loops, frictionless distribution, and deterministic builds matter more than whether a language is pleasant for humans to type. He didn’t just write about it. Roborev , his continuous background code-review tool for AI coding agents, is built in Go. Go solves four compounding problems that most engineers don’t notice, because they’re so used to the friction they no longer see it. Each one is paid for in the same currency: developer time and focus, agent iterations, and API dollars spent correcting what the language let through. And they stack in order: slow builds waste iterations, broken dependency resolution wastes entire runs, weak error feedback lets mistakes survive those runs, and ecosystem churn invalidates what the agent knew before it started. A several-minute build is routine for large Rust or C++ projects: a minor break for a human, but hours of wasted cycles for an agent running 50 iterations on a feature. Go compiles almost instantly, keeping the loop tight. Python’s still doesn’t guarantee deterministic installs by default, and version conflicts across machines remain common even with virtual environments. Node’s actually handles conflicting transitive dependencies well: nested can hold multiple versions of the same package side by side, and plus make installs far more reproducible than they used to be. Where npm still gets stuck is peer dependencies, where conflicting requirements throw errors that need manual untangling. That version flexibility costs deep, duplicated dependency trees that bloat and inflate the surface area an agent has to reason about. Both ecosystems also let arbitrary code execute at install time ( , scripts), a real supply-chain risk that’s bitten each more than once. Go takes a different approach by default: pins exact checksums, a single version of each module is selected deterministically for the whole build, and there’s no install-time code-execution hook for a compromised dependency to exploit. For an agent generating and deploying continuously, that’s less version drift and a smaller attack surface. Python’s type hints and TypeScript’s type system can catch real mistakes before runtime, when tools like , , or run as part of the loop. But both come with an asterisk: Python’s typing remains optional and unevenly adopted, even as tools like Pydantic push teams toward it, and TypeScript’s guarantees are erased at runtime, with a sanctioned, zero-cost escape hatch whenever code hits friction. That’s the incentive an agent under time and token pressure responds to: reaching for to make something compile costs nothing in the moment, whatever the wider ecosystem’s norms are. Jesse Vincent, who builds the Superpowers agent orchestration framework, has documented what happens when that opt-out exists: agents rationalize their way around rules. In one now-infamous incident , an AI agent in his environment deleted test files to make failing tests disappear: internally consistent logic, since tests that don’t exist can’t fail. His insight, in his own words : “A rule has an opt-out path (I can rationalize ‘I’ll do it after this one thing’). A gate doesn’t — the next action is blocked until the gate condition is met.” Go has no such opt-out. Go does have (it’s the alias for ), but it isn’t TypeScript’s . TypeScript’s turns the checker off for everything it touches; Go’s is still checked at every use site, and the compiler refuses any operation the type can’t support without an explicit assertion it verifies. The escape hatch is itself gated. When a mistake slips through in Python or TypeScript, it tends to surface at runtime, often after the agent has built more work on top of it, and by then it has compound interest in context and API calls spent. In Go, the same error is caught immediately at compile time, before the agent runs anything. The difference shows in the code itself: Python’s ergonomic advantage is a disadvantage here: the more forgiving the language, the more mistakes an agent can make before getting caught, burning context and API calls along the way. The same gap shows up in code review , now that both sides are often AI: a reviewing agent can see what Python or JavaScript code says but not reliably what it does, since metaclasses and prototype chains hide behavior a static read can’t catch. Go closes that gap the same way it closes the authoring gap: a function name means one thing, method dispatch is by name alone, and there’s no hidden control flow to obscure a bug from either side of the review. Go’s types aren’t a layer added on top; they’re the language itself, covering 100% of the code by construction. This may be the largest of the four. Go’s compatibility promise means code written for Go 1.0 in 2012 still compiles and runs correctly today. The language and standard library only add; they essentially never break what already worked. Nothing in the Node ecosystem offers that guarantee. Major frameworks routinely break compatibility with their own prior versions: Svelte 5’s runes are a different reactivity model than Svelte 4, Vue 3 required rewriting Vue 2’s reactivity model from scratch, and React’s evolution from class components to hooks to server components has left multiple incompatible eras of “how React code looks” in active circulation. Ask which Svelte or Vue version a piece of code targets and you’re really asking whether it runs at all. Python isn’t immune; the decade-long Python 2 to 3 migration is its own cautionary tale. But Node’s churn is faster and more constant. That churn is a specific, compounding problem for agents. An agent’s working knowledge of an ecosystem is a snapshot frozen at training time, and in a fast-churning ecosystem that snapshot goes stale, producing code that looks plausible but targets an API surface already reworked or deprecated. In Go, a training snapshot from years ago is still correct today. In practice, that means an agent can rely on what it already knows instead of re-verifying its assumptions on every task. Dave Rensin, Distinguished Engineer at Google, captured the compounding risk while building a 100,000-user internal tool with AI agents : “If we aren’t careful, we aren’t just writing code faster. We are mass-producing our mistakes.” Rensin wasn’t talking about Go specifically; that risk is generic to AI-assisted development in any language. But it’s exactly the risk Go’s structure (static types, explicit imports, no magic) is built-in friction against: bad code is harder to write in the first place. At PayPal, a team shared with me an experience where a custom C++ database was powerful and correct, but the team had stopped growing: every hire spent months learning the codebase, and most engineering capacity went to maintenance. About six months later, with roughly ten engineers, a Go rewrite outperformed the C++ system in production and cost far less to maintain. Go isn’t faster than C++, so what happened? The bottleneck was never the code’s speed. It was the team’s ability to reason about, maintain, and extend it. Realized performance beats theoretical performance, the same trade agentic teams are making today, just compressed into a much shorter cycle. Rust and Go are complementary and typically occupy different use cases and both have a place in agentic development, but Rust is a specialized tool rather than the default. Rust shares a lot of strengths with Go: memory safety, static typing, no hidden runtime magic. Rust’s compiler errors are famously instructive, too: by this post’s own compiler-as-gate logic, an agent gets real value from a detailed borrow-checker message. However, the two languages diverge exactly where agentic development is least forgiving. Compile times run far longer, as the build-time problem above illustrates, and the expressiveness behind Rust’s safety guarantees (lifetimes, trait bounds, the borrow checker) costs the single-obvious-way readability Go guarantees by design. The cost shows up hardest at refactor time: in my experience, a change that stays local in Go ripples through lifetimes and trait bounds in Rust, and refactorability is the property agentic development leans on hardest. An agent, not a human, now does that rework, and agents need far more of it to get code right. The more complex the language, the more likely an agent misreads it and produces a bug that compounds over iterations. Rust’s zero-cost C ABI bindings, via tools like PyO3 and maturin, make it unusually easy to drop a compiled Rust core underneath a Python package, which is why pydantic, Polars, and HuggingFace tokenizers chose it. Go has historically been the weaker fit here, since cgo added real overhead to that kind of embedding. While Go is closing that gap: Go 1.26 cut the baseline overhead of cgo calls by about 30% , Rust remains the better choice for a lot of use cases. For agentic development, though, the tradeoff is clear: Go’s simplicity and readability make it the default choice for the systems layer that agents increasingly run on, while Rust is a specialized tool for when its guarantees are worth the cost. Everything above is a cost multiplied by iteration count. Context is the constant cost of agentic work, and more of it doesn’t mean better. The assumption behind “just use a bigger context window” is that a model reasons over its 200K or 1M tokens uniformly. Chroma’s 2025 study across 18 leading LLMs (GPT-4.1, Claude 4, Gemini 2.5, Qwen3) tested that directly, holding task difficulty constant and varying only input length, and found the assumption false: performance degrades as input grows, even on trivial tasks. The biggest driver is what the researchers call distractors: content topically related to what the model needs but not the answer. One distractor measurably hurts accuracy; four compound the damage. Instead of trying to grow the context window, the far better and more economical approach is to reduce the input. A class hierarchy, a mixin chain, a decorator stack: that’s a field of distractors to an agent tracing a bug. A call resolving through diamond inheritance, a metaclass rewriting behavior at runtime, an override buried three classes up: none of it is the logic the agent needs, but the agent still has to load it, weigh it, and rule it out, inside the same window where its reasoning is already degrading. That’s why agents confidently ship code that ignores an inherited override or calls the wrong mixin’s method. Go’s design is minimal and explicit. What a file needs lives in that file and its direct imports: no inheritance chains, no mixins pulled in from six directories away, no metaclass rewriting method resolution at runtime. A function name means one thing, and the compiler enforces it. The tokens Go code needs are almost entirely relevant tokens. That has a second effect beyond accuracy: it lowers the model a task requires. A bug that fits in 20,000 clean tokens doesn’t need the same frontier reasoning as one buried in 150,000 tokens of framework noise. Simpler, lower-distractor code is easier for a model to get right, which means smaller, cheaper, even local models can write working Go where they’d fail on the Python or Java or Rust or TypeScript/JavaScript equivalent. This matters even more when the AI companies stop subsidizing their costs, which we’ve already seen begin. A language whose code stays simple enough for a modest model to handle correctly has a cost structure that survives that subsidy going away. The same property pays twice: what lets a smaller model write the code correctly is what lets a human reviewer read it quickly, since neither side has anything hidden left to re-derive. Beyond even this, it’s more likely to get the code right the first time, which means fewer iterations, fewer API calls, and less context burned and more time the model can spend on tasks without humans needing to intervene. Context efficiency is the sharpest form of the same bet Go made in 2009: optimize for the reader, human or machine, over the writer. The same reader-first bet shows up at the surface of the code. ships with Go and runs across the community’s code. Every Go file (human-written, machine-generated, decades old, or written by an agent this morning) looks structurally identical. Simon Willison, who has spent considerable time building AI-assisted Go tools, observed this directly : “I’m enjoying how there’s generally one obvious way to do things and the resulting code is boring and readable—and something that LLMs are very competent at writing.” When every Go file looks the same, an agent can be seeded before it starts working. Point it at Go’s standard library ( , , ) and it immediately produces idiomatic, production-quality code, with no guessing about versus or versus . Drop in something like go-skills and the seeding gets more direct still, since the agent now has explicit, reusable guidance on writing idiomatic Go rather than inferring conventions from scattered examples. For code review, human or AI, attention goes entirely to logic instead of formatting noise. Most language comparisons focus on authoring: how fast can you write code? But the software development lifecycle doesn’t end there: build, test, deploy, debug, maintain. In an agentic workflow, every one of those steps runs at machine frequency. Over the past decade, Go’s ecosystem evolved from a language into a complete SDLC platform: fuzzing became built-in, vulnerability management matured with , workspace mode unified monorepo development, and module proxies reduced version conflicts. None of this required reaching outside the Go ecosystem. Dependencies are handled by , deterministic and identical on laptops, CI, and containers, unlike or , where every resolution failure is an iteration lost. Testing needs nothing beyond : no framework decision, no fixtures to configure. Drop a file next to the package, write a -prefixed function, run one command. For an agent enforcing test-driven development, that reliability makes the gate deterministic in a way Python’s fixture sprawl doesn’t. Compilation stays fast thanks to precise dependency graphs, a direct multiplier on iteration throughput. And deployment is just : a single, self-contained binary with zero runtime dependencies, no interpreter versioning, no container startup time. Copy the binary and run it. These advantages don’t add linearly, they compound. Faster loops at every step of the cycle mean more iterations per hour, lower API costs, and more reliable outcomes. The point of this article was never “replace Python” or “replace TypeScript.” Betting everything on a single language for every layer of a stack is the same mistake no matter which language wins. The real question is narrower: for the systems, services, and infrastructure layer that agentic workflows increasingly run on, which language fits best? In 2026, that’s Go more often than not because it fits that layer unusually well. Python’s ML ecosystem (PyTorch, LangChain, Transformers) isn’t going anywhere, and it shouldn’t. For training models and running inference, Python is the answer. Go doesn’t compete there. It complements it. Go can run underneath Python just as easily as beside it. Simon Willison built a tool called that packages compiled Go binaries as Python wheels distributed on PyPI: any Go binary becomes a standard or a one-liner, and his own , a concurrent filesystem scanner written in Go, ships exactly that way. Armin Ronacher, creator of Flask, makes the same point from the other direction: porting MiniJinja from Rust to Go cost him 45 minutes and $60 in API calls, which is why he argues that “the cost of coding is going down dramatically… the breadth of an ecosystem matters less.” Python orchestrates, Go executes underneath, and the lock-in argument for picking only one ecosystem weakens every month porting between them gets cheaper. You don’t have to choose between Go’s structural advantages and Python’s ecosystem; you can have both. Go was designed to lower the total cost of software at scale, exactly the problem agentic development now amplifies to the breaking point, and every property that made Go good for human-sized teams turns out to suit machines running thousands of iterations per day just as well. None of this makes Go the only language worth using. Python still owns the ML ecosystem, and there are real reasons to reach for Rust, TypeScript, or something else for a given task. Rather than “one language to rule them all”, treat Go as your default for the systems, services, and infrastructure layer of agentic development, and require a specific reason to reach for something else. When starting a new service, CLI, or system, ask “why not Go?” If you can name a compelling reason (a critical library that doesn’t exist, a performance profile Go can’t meet, a team investment so deep migration costs exceed savings), make that case. If you can’t, Go is very likely the right default. Every percentage point lost to slower builds, flaky dependencies, or runtime surprises is API cost. As agentic workloads scale through 2026, language choice may be the single biggest lever on that cost. Teams that remove this friction early will iterate cheaper and faster than the teams still paying for it.

0 views
spf13 4 months ago

The Maintainer's Dilemma

A protected branch requires a second person to review a change before code ships. The rule exists because humans make mistakes, and a second pair of eyes catches what the first one missed. But what happens when one of those reviewers is a robot? What if both are? Currently I can ask an AI to open a pull request on my repository and then merge it myself. Or I can write the code and ask an AI to review it. In both cases, the branch is technically “protected.” But what does that even mean now? Those are questions worth asking. But they tend to get all the attention while a more immediate problem goes unaddressed. Right now, across my repositories, there are open pull requests from people who took time to understand the codebase, write tests, and submit clean patches. I haven’t reviewed them. Sadly, the ironic part is I haven’t reviewed them because I deeply care. I know how big of a deal it is to take the time to open a pull request on a project, and even more so on a popular one. I know that each one deserves an honest review and that that takes time I don’t have for projects I maintain as a volunteer. For every open source project with a funded maintainer, there are millions with an unpaid human staring at a growing backlog, wondering whether the right thing to do is spend their weekend triaging issues or just close the laptop and go outside. AI tools can now do credible code reviews, write patches, and triage issues. The question is no longer whether they’re good enough to be useful. The real questions are where “useful” becomes “liability,” and whether leaning on them breaks something we can’t easily rebuild — the trust between maintainers and contributors, the judgment that comes from experience, and the community that forms around that exchange. I checked my GitHub notifications last week and closed the tab. Cobra has 243 open issues and 118 open pull requests. Afero has 114 issues and 55 PRs. I created both projects. I haven’t meaningfully reviewed a PR on either in months. In spite of my inaction as a reviewer, these are actively maintained projects. Cobra powers kubectl, GitHub CLI, Hugo , and hundreds of thousands of other tools. When you type or , Cobra parses your command. Afero sits inside Hugo, inside Cobra itself, inside hundreds of thousands of other projects. A careless merge on Cobra could break Kubernetes tooling. A bad review on Afero could open a filesystem vulnerability that quietly propagates through everything downstream. I created Cobra because I needed a specific CLI UX for Hugo and no existing library could support it. I split it out as its own project, thinking others might find it useful. I never imagined I’d still be maintaining it a decade later, or that both projects would become critical infrastructure for so many others. I just wanted to build something useful for me and maybe a few friends. But does open sourcing code mean I’m obligated to maintain it indefinitely? With each new project I release, there’s less time for the existing ones. Some of those PRs have been waiting for years. There’s a reported security vulnerability in Afero’s that’s been sitting open since June 2025 — which, until I wrote this post, I didn’t realize was there, because the backlog is that overwhelming. The math of maintenance doesn’t work. It’s a well-known problem across open source ( relevant XKCD ). The number of contributions grows faster than the number of maintainers, and the time required to review each one grows with a project’s complexity and impact. Some projects attract volunteer co-maintainers, but that brings its own problem: no one is clearly responsible, so everyone picks what matters to them and the rest just sits. Cobra is intentionally slow to change — too many projects depend on it to casually merge anything — so each change requires more thorough review, not less. Many of my other projects fall into the gray area between maintained and abandoned. I’d describe it as optimized maintenance around the most critical paths, but that distinction matters a lot more to me than it does to the person who submitted a fix eight months ago and never heard back. This isn’t just my problem. GitHub hosts over 420 million repositories. I was very fortunate to be a part of the inaugural cohort of the Secure Open Source Fund — a real investment that made a real difference. But even after expanding to several cohorts, it covers about 200 projects. OpenSSF scans a million critical projects weekly. Tidelift pays maintainers. Add it all up and you’re covering thousands of projects. It’s meaningful work. It’s also a rounding error against the actual surface area. Ninety-six percent of codebases contain open source components , and the foundations they build on are maintained by people staring at a backlog they’ll never clear, wondering if this is the weekend they finally burn out or just stop checking. And that’s before you get to maintainer guilt — the knowledge that people are counting on your work, that you have the capacity to help, but that you can’t keep up. I’ve been experimenting with AI tools across a couple of repositories — Jules on fileflow and pathologize , which have fewer dependencies and more room to try things. I’ve also been running GitHub Copilot on Afero, which has more dependencies, but its modular architecture lets me extend new backends without touching the critical paths other projects depend on. I turned Jules loose and watched email after email arrive with new PRs. Looked promising. Then I went on a cruise. While I was at sea, Jules kept going, opening more pull requests each day because I hadn’t merged the first ones yet. By the time I got home, I had over 120 PRs across the two projects. I set aside a morning to review them all, only to find they represented roughly five distinct change sets, each submitted daily over several weeks. The PRs themselves weren’t wrong, Jules had found real issues. But none were quite right either; each needed course correction before I could merge. With guidance Jules made the adjustments, and the overall direction showed promise. But the experiment so far has created more maintenance work, not less: I had to verify each of those 120 PRs was actually a duplicate before closing it. The tool meant to reduce my backlog had added to it. Jules also created these PRs as me, not as Jules — which raises its own questions about attribution and accountability. From the repository’s perspective, I authored those changes. But I didn’t write a line of them. If one of those patches introduced a bug or a vulnerability, the commit history points to me. Most contributor policies weren’t written with this scenario in mind, and the standard CLA doesn’t distinguish between code a human wrote and code a human directed an AI to write on their behalf. Currently, it appears that Jules has no memory of its own previous work and doesn’t have the ability to check open PRs. It scans the repository, finds an issue, opens a PR, and stops. If you don’t merge it, Jules finds the same issue next time and opens another PR. It has no way to know you’re aware of the problem and haven’t merged it for your own reasons: maybe you disagree with the fix, maybe it’s lower priority, maybe you’re on a boat and won’t get to it for a couple weeks. That context is invisible to the tool. Jules found a real vulnerability — TOCTOU bugs in file operations are a genuine class of security problem — and it was right to flag it… once. For the mechanical work — flagging issues, updating dependencies, drafting boilerplate responses — the tools are genuinely useful. But Jules and Copilot couldn’t tell me whether one of those 55 Afero PRs belongs in the project at all. That judgment requires knowing the codebase’s past and future, not just its present state. These tools work only from what’s visible: the code, the open issues, the PR history. Maintainers work from the visible and the invisible: the context that never made it into comments, the constraints nobody wrote down, the internal debates that shaped the API. The gap between those two things is where human judgment is most irreplaceable, and where AI is most blind. Russ Cox, who I worked with on the Go team, put this well in a recent discussion about AI contributions: “People brag about codebases of hundreds of thousands of lines that have never been viewed by people, churned out in record time. On closer inspection, these codebases invariably turn out to be more like dancing elephants than useful engineering artifacts.” He’s right about novel code. But I keep coming back to the distinction between writing new software and maintaining existing software. Dependency updates aren’t dancing elephants. Triaging a stale issue isn’t a creative act. Telling a contributor “thanks, we’re not accepting changes to this API” is just keeping the lights on. And right now, for millions of projects, the lights are off. That isn’t the biggest challenge, though. What most people don’t realize is that evaluating and merging changes is far harder than writing new code. Understanding how a change fits into the existing codebase, its history, and its plans requires knowledge that’s partly invisible — not in the code, not in the comments, not in the issues. It’s in the maintainer’s head. And some of it is deeply creative work, requiring the kind of judgment no model can replicate. The Go project is genuinely beautiful to me — meticulous reviews, design discussions that ran for months before anything shipped, a review culture refined over 15 years. That’s the ideal. But Go is exceptional in ways most projects can’t replicate: full-time contributors funded by Google, a mandate to build a language meant to last 50 years, rare external deadline pressure. The Go team had a long thread recently about whether to accept AI-authored contributions — the same discussion where Russ Cox’s quote above originated. These are people I worked with for years — same reviews, same proposals, same arguments at the same whiteboards. Reading the thread, I could hear their voices. And I could see how every one of them was right, and why that was the problem. Rob Pike went first and didn’t equivocate: “This is a very slippery slope. Be careful on your first step. I recommend simply saying, no.” That’s Rob. Direct, principled, and usually right. Then Alan Donovan pointed out the uncomfortable reality: “I suspect a significant fraction of CLs we receive today already include fragments of LLM-generated code, whether the authors admit it or not.” The horse, in other words, has already left the barn. Russ Cox wrote the most thoughtful response I’ve seen anyone write about this. His core point: “The most important thing we can do is to maintain our usual processes around code review and code quality… That same bar must still apply when some or all of the code was written with the help of AI-based tools.” And: “Your responsibilities are not lessened when you use AI tools for your work.” Every one of these positions is reasonable. And every one of them shares an assumption that exposes the core of the dilemma: they assume there are humans available to review. Go can afford to say “maintain the same bar” because it has full-time contributors funded by Google. It has reviewers. It has a review culture that’s been refined for over a decade. Rob can say “just say no” because Go has enough people to say “yes” to the important things. Afero doesn’t. Most open source projects don’t. When Rob Pike says no, the Go project keeps functioning. When I say no, the PR just sits there. Those are different kinds of “no.” There’s a spectrum, and where you land on it depends on what you’re actually choosing between. In practice, maintainers face five options: Each step down that list typically trades rigor for velocity, and trust for throughput. But for most projects — certainly for many of mine — there’s a sixth option that doesn’t appear on that list: human or AI writes, nobody reviews. When a maintainer reviews a contributor’s PR, there’s an unspoken contract. The contributor invested hours understanding the codebase, writing tests, and submitting something clean. The reviewer invests hours evaluating it, pushing back, and suggesting improvements. Both people learn. The reviewer understands a new corner of the project. The contributor gets better at the codebase’s idioms. A relationship forms. That exchange is a big part of what makes open source a community instead of just a supply chain. Bryan Cantrill at Oxide described this contract precisely in their internal policy on LLM use : ordinarily, “it is presumed that of the reader and the writer, it is the writer that has undertaken the greater intellectual exertion.” When the writing is AI-generated, “this social contract becomes ripped up.” The same holds for code review — we expect the reviewer to invest effort because the author invested effort. If neither did, what’s the review even for? Oxide’s answer is that the human stays accountable regardless; the tool doesn’t absorb the responsibility. That’s the right instinct. But it assumes someone is actually there to take responsibility. For most projects, nobody is. The social contract isn’t being broken by AI — it’s already being broken by silence. The contributor who submitted a clean, well-tested patch six months ago and never heard back isn’t experiencing a degraded version of the ideal. They’re experiencing nothing. Is a perfect social contract that never happens better than an imperfect one that does? A response from an AI in a day might be more respectful than silence from a human forever. I’ve decided to find out. I’ve been staring at 55 open PRs on Afero long enough to know that deliberation has become its own form of neglect. Will AI tools make me more engaged, freeing me to focus on decisions that actually need me? Or will it feel less connected — the human element reduced by one more degree? I don’t know how it feels to have an AI review a PR instead of a human, or whether accountability holds when the effort on both sides is diminished. That’s the experiment. Russ said something else in that thread I keep returning to: “The most important thing is to keep thinking. The tools make it very easy to turn off your brain, but if you are careful to avoid that trap, you can produce good work.” That’s the line I’m trying to walk. Let AI handle the volume. Stay responsible for the judgment. There’s no universal policy that works for both Go and Afero. There shouldn’t be. The protected branch is still protected. I’m just not sure what that even means anymore. Have you run into this? I’d especially like to hear from maintainers who’ve tried AI review — what held, and what broke. Human writes, human reviews. AI writes, human reviews. Human writes, AI reviews. AI writes, AI reviews, human clicks merge. AI writes, AI reviews, AI clicks merge.

0 views
spf13 11 months ago

Why Engineers Can't Be Rational About Programming Languages

Series Overview This is the first in a series of posts on the true cost of a programming language. A programming language is the single most expensive choice a company makes, yet we treat it like a technical debate. After watching this mistake bankrupt dozens of companies and hurt hundreds more, I’ve learned the uncomfortable truth: these decisions are rarely about technology. They’re about identity, emotion, and ego, and they’re destroying your velocity and budget in ways you can’t see until it’s too late.

1 views
spf13 1 years ago

How Benjamin Franklin Invented Machine Learning in 1720

How a teenage printer’s writing exercise reverse engineered the timeless principles of learning. The core algorithm that powers today’s most advanced artificial intelligence wasn’t born in Silicon Valley or has anything to do with computers. It was engineered in the dusty, ink stained backroom of a Boston print shop, nearly 300 years ago, by a teenager who was tired of being told he wasn’t a good writer. Long before he was a world famous statesman and inventor, Benjamin Franklin was an ambitious, self taught apprentice with a chip on his shoulder. Working for his older brother, he devoured books and secretly submitted anonymous essays to his brother’s newspaper, desperate to succeed in this world of words. But he had a problem. While his ideas were sharp, his prose was clumsy.

0 views
spf13 1 years ago

Cobra & Viper Fortify Security as Part of GitHub Secure Open Source Fund

I’ve spent most of my career working in New York City. Every morning, I’d walk past those towering skyscrapers, genuinely amazed at what humans can build together. The engineering, the coordination, the trust required. It’s breathtaking. What fascinates me most is the foundation. While everyone admires the gleaming towers, I think about the engineers who spent months planning what goes sixty feet underground. That invisible work makes everything else possible. No Instagram posts about foundation concrete. No TED talk talks about rebar placement.

0 views
spf13 4 years ago

spf13 Google -->

I’m leaving my role as the Product Lead for the Go Language at Google. I’m super proud of everything the Go team has accomplished in the last six years, and I’ve never been more excited for Go’s future. Read on if you’re interested in what led me to my decision, what I’ll be doing next, and what I’ll miss about my time at Google. Ten years ago, I used Go for the first time. I immediately fell in love with the language and its simple elegance. For the first time in a long time, I loved programming again. So much so that I was eager to write Go whenever I could. This led to the creation of Hugo , Cobra , Viper and a handful of additional Go libraries .

0 views
spf13 4 years ago

The New spf13.com

I’m proud to present the new and improved spf13.com a dramatic redesign of the very first Hugo powered website. After 25 years of building websites I’m happy to say that this is the best website I’ve ever made and I look forward to sharing more content than I ever have before. Something about the new design is really inviting and honestly just makes me happy, and I think it’s going to be a big motivator to write more content.

0 views
spf13 4 years ago

About Steve Francia

My name is Steve Francia (he/him). I’ve spent the last 27 years as a software, product, and advocacy leader specializing in open source and developer experiences. I’m best known for my leadership across several industry defining projects: The Go Language — Google’s cloud native programming language, MongoDB — the NoSQL database, Docker — the container engine, and Drupal — The CMS powering 10% of the commercial internet. I also authored Google’s Open Source Strategy and led Google Cloud developer strategy.

0 views
spf13 4 years ago

InfoQ interview - Go Language at 13 Years

I had the pleasure of speaking with Olimpiu Pop from InfoQ about the Go language and community. The article can be found at https://www.infoq.com/articles/go-language-13-years .

0 views
spf13 4 years ago

Gophers Say GopherCon Edition

Go Time panelists Natalie & Jon join forces with Go Team members Steve Francia, Katie Hockman, Julie Qui, and Rob Findley to battle it out and see who can better guess what the GopherCon gophers had to say! Listen to the podcast at https://changelog.com/gotime/211 Mat Ryer: Hello, and welcome to this Go Time GopherCon extravaganza… Yeah, extravaganza, yeah. I’m Mat Ryer, and I’m thrilled to announce that today again we’re playing Gophers Say, the excellent, popular, family game show based on Family Feud, or Family Fortunes if you’re in the U.K, which I am.

0 views
spf13 4 years ago

Modern Enterprise Applications with Go - Go Day 2021

Go, the language of cloud infrastructure, is maturing into the language of modern enterprise applications. This high level presentation will speak to Go’s enterprise adoption story and how it plays a role in modernization. Given at Google’s Open Source Live Day in San Francisco, November 4, 2021 . Welcome to my session: Enterprise-Ready Modern Applications with Go. I’m Steve Francia. For the past decade and a half, I’ve lead industry-changing organizations focused on bringing simplicity to the chaos. As senior vice president of MongoDB I lead the development of the first non-relational database to enter mainstream use in 45 years. As chief operator at Docker, I lead the effort to simplify containers. As a side project, I created Hugo the most secure and highest performance web engine. Today I’m the Product Lead on the Go team where we’re building a modern simple cloud-native programming language. Today, I’m here to share with you how Go is helping enterprises modernize their legacy applications. The Rise of Digital Chaos. For years, one of the most talked-about topics surrounding enterprise has been digital transformation. It seems like everyone’s feeling the need to modernize their legacy applications. As technology has specialized, it has grown exponentially in complexity. Two decades ago, there may have been a dozen choices that needed to be made with, typically, two or three options. Today the amount of choices is simply staggering. Nobody can possibly begin to understand all that is required. Three quarters of CIOs say managing performance is now impossible due to the IT complexity. Security risks have seen a similar exponential expansion. It seems like every day we hear about another major breach. The historical approach to enterprise architecture doesn’t work in the digital age. If we don’t dramatically change our approach, and soon it’ll be too late. Today, I’m here to share with you what the path is. We need to modernize our enterprise applications and a lot of folks have this wrong. They have part of the picture but haven’t grasped that true modernization requires simplifying our approach not simply containerizing it. Since you may not be familiar with Go I’ll first provide a short overview of what Go is. I’ll then share with you what a modern enterprise application requires. And, lastly, I’ll share with you how Go will help you with the migration to modern enterprise applications. Along the way, I’ll share quotes from enterprises and how Go helped them. Go is a modern programming language designed by Google for Google’s problems of building and serving server-site software at scale. Google uses Go extensively for a wide range of things from our indexing platform that powers Google search to the infrastructure Google Cloud is built on. Launched a decade ago, Go has seen explosive growth. Today Go is a top 10 language with broad adoption among the world’s leading enterprises. Go follows Einstein’s maxim “Be as simple as possible, but no simpler.” As Go is designed for maximum simplicity, it is very easy to learn and work with. Go drives the balance between productivity and performance sharing the friendliness of dynamic languages like Python and the performance of compiled languages like C and Java. As a modern language, Go was designed from the very beginning with security and safety in mind. Over the past ten years, Go has developed a large and mature ecosystem. Go is loved by both developers and employers alike ranked as the number one language across many industry surveys. Go is widely loved by developers because it makes building modern software simple and secure. But what does it take to build modern enterprise applications? First of all, they must minimize risk. They must be fully modern. Adding modern components onto or alongside legacy systems introduces significantly higher risk and complexity. Instead of simplifying things, they triple the complexity. You now need to worry about multiple systems languages and integration points. Next, they must be safe. Modern applications have to be built in a way that ensures safety. According to researchers at Microsoft 70% of the security bugs the company fixes each year relate to memory safety. Google found a similar 70% of serious bugs in Chrome are memory management and safety bugs. Legacy programming languages were not designed with safety in mind because at the time there was no such thing as a cyber attack, and bits were at a premium. Our environment today is vastly different from the one legacy languages were designed for. Modern languages massively de-risk applications. They must be secure. One of the largest risks systems face is in the form of lacking security which results in leaks and attack vectors. In the constant battle for security applications need to utilize the latest encryptions and protocols. They need to run in minimal environments, with maximum isolation and minimal external dependencies. They need to not depend on legacy libraries and environments. Modern enterprise applications must adapt to business needs. One way they do this is by utilizing service-oriented APIs approaching applications with a communication-first focus which ensures that the application has the proper separation, scalability and flexibility to adapt to new businesses requirements. This approach also isolates each feature for greater flexibility and security. They must be architected to be modular and composable. Tech debt can be a technologist’s worst enemy. This hidden tax slows down all development. Traditional inheritance-based architecture creates code that is very tightly coupled, hard to maintain and hard to adapt to new requirements. This brings us to our next point it must be easily maintainable. Teams and priorities are constantly changing. We need code that is easy to understand and pick up by a constant influx of new engineers. We want applications that require minimal maintenance without constant runtime upgrades. Our final theme: Modern enterprise applications must sustain growth. They must be scalable and efficient. Data and usage has been expanding exponentially for the past five decades. With the end of Moore’s law, an increased pressure on computing costs modern enterprise applications need rapid deployment and the ability to scale up and down with ease using resources efficiently, to keep operating and management costs down. They must have a cloud-native architecture. Modern enterprise applications must take advantage of innovations in cloud computing with a cloud-native architecture. They must be designed with automation, monitoring and repair from the beginning favoring managed services. They must incorporate event-driven components also known as serverless. Event-driven features must be properly utilized to bring cost savings adaptability and efficiency to modern enterprise applications. This requires software that loads instantly with minimal resource consumption and minimal dependencies. We’re now gonna go through these requirements and highlight the ways Go will help you build modern enterprise applications. Go helps you minimize risk. Go is a truly modern language requiring a completely clean implementation keeping your application decoupled from legacy libraries. While there is risk in a re-write, it pales in comparison to the larger risk of sticking with legacy systems or, worse, maintaining both the legacy and a modern system. Go’s high learnability, productivity and simplicity minimized the re-write risk and often paid dividends in massively reducing both operating costs and technical debt further minimizing businesses risks. Zviad, a senior principal engineer at Dropbox, said “People become very productive in Go, very fast, “our infrastructure is built in Go today, and all the new things we build in Go.” Legacy software languages were designed for a different era where safety wasn’t prioritized, or worse, often compromised for performance. This trade-off made sense in a pre-network era but it’s created massive risk in today’s environments. Modern languages, like Go, are designed for today’s environments where safety is critical. Go is memory-safe, type-safe, and utilizes low latency garbage collection. These features alone avoid over 70% of critical bugs which result from using unsafe legacy languages. Bala, a senior director of engineering at Paypal, wrote “In our tightly-managed environments, where we run Go code, we have seen “a CPU reduction of around 10% [vs C++] with cleaner and more maintainable code.” Go has been designed to create the most secure applications minimizing risk as much as possible. Go applications compile down to a single binary without any local dependencies. It’s not uncommon to see an application built using only the standard library or only a couple of well-vetted dependencies. That dependency management uses an industry-leading, tamper-evident transparency log with built-in tooling that ensures your dependencies are exactly what you expect. Go has native encryption, which has been used to power much of the Internet including key components of Google and Cloudflare. Adopting Go means that the next Heartbleed which impacted virtually every application written in any other language won’t impact your application. Go even supports distroless containers, where there’re zero local dependencies to worry about. Go helps you adapt to business needs. Service-oriented APIs provide enhanced agility, scalability and reliability allowing your business to adapt to market and strategy changes quickly. Go’s the only language explicitly designed to build service-oriented APIs. Go has native support in the standard library for all you need to build performant and secure APIs. Including a high-performance web server. This is Go’s most common use case with over 70% of Go developers using Go for building APIs. Matt, a principal software engineer at Monzo, shared “Go is a perfect language for creating microservice architectures “the concurrency features and the language in general, has allowed the easy creation “of small and simple networked services at Monzo.” A unique feature of Go is that its application structure directly mirrors the architecture of service-oriented systems. Services are designed independently and they share nothing architectured, communicating across networks. Go applications are composed of share-nothing modules which communicate across channels, a native feature in Go. This means that both your service and your application which is composed of many services are using the same architectural pattern. The benefits of agility, independence and easy maintenance are twice as impactful for Go-based services, which maximizes your ability to adapt to business needs. There’s an additional cognitive benefit for developers of using a single architectural pattern at every level of their system. John Graham-Cumming, the CTO at Cloudfare, shared about Go “I came for the easy concurrency, I stayed for the easy composition.” Kubernetes’ creator, Joe Beda, tweeted “Kubernetes’ success is in part due to Go and the Go community. “Go hits the sweet spot for distributed systems software.” High maintenance costs ensure that your technology can’t properly adapt or support business needs. Go is unique among all languages as it has been designed to minimize maintenance costs. Rapidly evolving teams are common at Google and virtually all enterprises. Go’s simplicity, easy readability and single binary deployment ensures that Go’s applications have minimal maintenance and it’s relatively easy for someone new to a code base to safely maintain them. Martin, a software engineer at Trivago, spoke about this hidden benefit of Go. “Go’s simplicity and its sophisticated tooling “let us scale not only our service, but, more importantly “the process of software engineering itself. “Reducing the friction of onboarding and training someone “has a significant impact on the company’s productivity “even more so in a constantly moving environment like Trivago.” Benjamin Cane, VP and Principal Engineer at American Express also speaking at Google Open Source Live, shared “After working on Go “most of our developers don’t want to go back to other languages.” Go will help you sustain business growth. Historically, CTOs have needed to make an impossible tradeoff either choose to delay launch as the team builds the scalable application first or choose to ship a slow prototype early acknowledging that development will be delayed significantly later as adoption growth demands a re-write effectively having to choose when to be unable to support business growth. Go has eliminated this dilemma. Go is designed for Google’s scale with built-in concurrency that takes full advantage of today’s multi-core machines and cloud services. Go enables programmers to quickly develop applications that perform at scale. No re-write needed. Eric, a Software Engineering Manager at Mercado Libre, wrote “With Go, the company obviated 88% of their servers “and cut CPU on the remaining ones in half “- producing a tremendous cost-savings.” Cloud computing brings countless benefits for flexibility and efficiency critical to sustaining business growth. Go is the only modern language that has first class support on all cloud platforms. Go is designed for cloud-native applications. Over three quarters of the projects in the cloud-native computing foundation are written in Go. Go is designed for container deployment with a very small footprint compared to the ship-the-world legacy languages like Java, Python and Node. Mariano, a software engineer at Movio, blogged “Our Go microservices currently build in five seconds or less. “They test in one or two seconds, which includes integration tests. “And they can deploy new containers via Kubernetes in ten seconds or less. “The key factor here being small images.” Among all cloud benefits, serverless has the largest potential for sustaining business growth with its low cost, instant scability and expanded flexibility. Go is an ideal fit for serverless with broad support on all serverless platforms. Go has very low resource use and nearly instant startup times, especially when compared to applications written in legacy languages which utilize interpreters. Go is well supported on all serverless platforms and Google’s Cloud Run is the ideal platform for Go applications thanks to its seamless deployment. Go: simplifying the chaos. “The biggest impediment to a company’s future success is its past success” according to Dan Schulman , CEO of PayPal. Today’s business environment is defined by modern enterprises with a move-fast-and-break-things culture. Enterprises will need to embrace the process of constant transformation to remain relevant. Go provides the flexibility and performance to assist organizations with application modernization efforts. To learn more about Go, its primary use case and to read case studies of enterprises who have transformed their organizations visit go.dev. Thank you.

0 views
spf13 5 years ago

Google Cloud Next 2021 - Modern Enterprise Applications with Go

Over the past couple of years, Go has matured to a complete end-to-end offering with seamless and secure dependency management, its own integrated development environment, and the inclusion of generics – Go’s most requested feature, previewing in Q4 2021. We’ll share how Go can fit into your application modernization plans to increase productivity, reduce risk, and save on operational costs. Given at Google’s Cloud Next Conference, October 13, 2021 . STEVE FRANCIA: Welcome to my session, “Enterprise-Ready Modern Applications with Go– The Rise of Digital Chaos.” For years, one of the most talked-about topics has been digital transformation. It seems like everyone’s feeling the need to modernize their legacy enterprise applications. As technology has specialized, it has grown exponentially in complexity. Two decades ago there might have been a dozen choices that needed to be made, with typically two or three options. Today the amount of choices is simply staggering. Nobody can possibly begin to understand all that is required. 3/4 of CIOs say managing performance is now impossible due to the IT complexity. Security risks have seen a similar exponential expansion. It seems like every day we hear about another major breach. The historical approach to enterprise architecture doesn’t work in the digital age. If we don’t dramatically change our approach, and soon, it will be too late. Today I’m here to share with you what the path is. We need to modernize our enterprise applications, and a lot of folks have this wrong. They have part of the picture, but haven’t grasped that true modernization requires simplifying our approach, not simply containerizing it. Who am I? I’ve spent the last decade and a half leading industry-changing organizations, focused on bringing simplicity to the chaos. As senior vice president at MongoDB, I led the development of the first non-relational database to enter mainstream use in 45 years. As chief operator at Docker, I led the effort to simplify containers. As a side project I created Hugo, the most secure and highest performance web engine. Today I’m one of the leads of the Go Team, where we are building a modern, simple Cloud-native programming language. Since you might not be familiar with Go, I’ll first provide a short overview of what Go is. Then I’ll share with you what a modern enterprise application requires. Lastly, I’ll share with you how Go and Google Cloud will help you with migration to modern enterprise. Along the way I’ll share quotes from enterprises, and how Go helped them. Go is a modern programming language designed by Google for Google’s problems of building and serving server-side software at scale. Google uses Go extensively for a wide range of things, from our indexing platform that powers Google Search to the infrastructure that Google Cloud is built on. Launched a decade ago, Go has seen explosive growth. Today, Go is a top 10 language, with broad adoption among the world’s leading enterprises. Go follows Einstein’s Maxim– be as simple as possible, but no simpler. As Go is designed for maximum simplicity, it is very easy to learn and to work with. Go drives the balance between productivity and performance, sharing the friendliness of dynamic languages like Python and the productivity of compiled languages like C and Java. As a modern language, Go was designed from the very beginning with security and safety in mind. Over the past 10 years, Go has developed a large and mature ecosystem. Go is loved by both developers and employers alike, ranked as the number one language across many industry surveys. Go is widely loved by developers because it makes building modern software simple and secure. But what does it take to build modern enterprise applications? First of all, they must minimize risk. They must be fully modern. Adding modern components onto or alongside legacy systems introduces significantly higher risk and complexity. Instead of simplifying things, they multiply the complexity. You now need to worry about many systems, languages, and integration points. They must be safe. Modern applications have to be built in a way that ensures safety. According to researchers at Microsoft, 70% of the security bugs that the company fixes each year relate to memory safety. Google found a similar 70% of serious bugs in Chrome are memory management and safety bugs. Legacy programming languages were not designed with safety in mind, because at the time there was no such thing as a cyberattack and bits were at a premium. Our environment today is vastly different from the one legacy languages were designed for. Modern languages massively de-risk applications. They must be secure. One of the largest risks systems face is in the form of lacking security, which results in leaks and attack vectors. In the constant battle for security, applications need to utilize the latest encryption and protocols. They need to run in minimal environments with maximum isolation and minimal external dependencies. They need to not depend on legacy libraries and environments. Modern enterprise applications must adapt to business needs. One way they do this is by utilizing service-oriented APIs. Approaching applications with a communication-first focus ensures that the application has the proper separation, scalability, and flexibility to adapt to new business requirements. This approach also isolates each feature for greater flexibility and security. They must be architected to be modular and composable. Tech debt can be a technologist’s worst enemy. This hidden tax slows down all development. Traditional inheritance-based architectures create code that is very tightly coupled, and hard to adapt to new requirements and very hard to maintain. Which brings us to our next point– they must be easily maintainable. Teams and priorities are constantly changing. We need code that is easy to understand and pick up by a constant influx of new engineers. We want applications that require minimal maintenance without constant runtime upgrades. Our final theme is that modern enterprise apps must sustain growth. They must be scalable and efficient. Data and usage has been expanding exponentially for the past five decades. With the end of Moore’s Law and increased pressure on computing costs, modern enterprise applications need rapid deployment and the ability to scale up and down with ease, using resources efficiently and keeping operating and management costs down. They must have a Cloud-native architecture. Modern enterprise applications must take advantage of innovations in Cloud computing. With the Cloud-native architecture, they must be designed with automation, monitoring, and repair from the beginning, favoring managed services. They must incorporate event-driven components, also known as serverless. Event-driven features must be properly utilized to bring cost savings, adaptability, and efficiency to modern enterprise applications. This requires software that loads instantly with minimal resource consumption and minimal dependencies. We’re now going to go through these requirements and highlight the ways that Go and Google Cloud Platform will help you build modern enterprise applications. Go and GCP help you minimize risk. Go is a truly modern language, requiring a completely clean implementation, keeping your application decoupled from legacy libraries. While there is risk in a rewrite, it pales in comparison to the larger risk of sticking with legacy systems, or worse, maintaining both a legacy and a modern system. Go’s high learnability, productivity, and simplicity minimize the rewrite risk, and often pay dividends in massively reducing both operating costs and technical debt, further minimizing business risk. Zviad, a Senior Principal Engineer at Dropbox, said, “People become very productive in Go very fast. Our infrastructure is built in Go today, and all the new things we build in Go.” Legacy software languages were designed for a different era where safety wasn’t prioritized, or worse, often compromised for performance. This trade-off made sense in a pre-network era, but has created massive risk in today’s environment. Modern languages like Go are designed for today’s environment, where safety is critical. Go is memory safe, type safe, and utilizes low-latency garbage collection. These features alone avoid over 70% of critical bugs resulting from unsafe legacy languages. Bala, a Senior Director of Engineering at PayPal, wrote, “In our tightly managed environments where we run Go code, we have seen a CPU reduction of around 10% versus C++, with cleaner and more maintainable code.” Go has been designed to create the most secure applications, minimizing risk as much as possible. Go applications compile down to a single binary without any local dependencies. It’s not uncommon to see an application built using only the standard library, or only a couple well-vetted Go dependencies. Go’s dependency management uses an industry-leading, tamper-evident transparency log, with built in tooling that ensures that your dependencies are exactly what you expect. Go has native encryption, which is used to power much of the internet, including key components of Google and Cloudflare. Adopting Go means that the next Heartbleed, which impacted virtually every application written in any other language, won’t impact your application. Go even supports distroless containers, where there are zero local dependencies to worry about. GCP, CI/CD, and Artifact Manager have direct access to Go’s Vulnerability Database and can provide you instant warnings about security threats. Finally, Go and GCP will help you adapt to business needs. Service-oriented APIs provide enhanced agility, scalability, and reliability, allowing your business to adapt to market and strategy changes quickly. Go is the only language explicitly designed to build service-oriented APIs. Go has native support in the standard library for all you need to build performant and secure APIs, including a high-performance web server. This is Go’s most common use case, with over 70% of Go developers using Go for building APIs. Matt, a Principal Software Engineer at Monzo, shared, “Go is a perfect language for creating microservice architectures. The concurrency features, and the language in general, has allowed the easy creation of small and simple network services at Monzo.” A unique feature of Go is that its application structure directly mirrors the architecture of service-oriented systems. Services are designed independently in a share-nothing architecture communicating across networks. Go applications are composed of share-nothing modules communicating across channels, a native feature of Go. This means that both your service and your application composed of many services are using the same architectural pattern. The benefits of agility, independence, and easy maintenance are twice as impactful for Go-based services, maximizing your ability to adapt to business needs. There’s an additional cognitive benefit for developers of using a single architectural pattern at every level of your system. John Graham-Cumming, the CTO at Cloudflare, shared about Go, “I came for the easy concurrency, I stayed for the easy composition.” Kubernetes creator, Joe Beda, tweeted, “Kubernetes success is in part due to Go and the Go community. Go hits the sweet spot for distributed system software.” High maintenance costs ensure that your technology can’t properly adapt or support business needs. Go is unique among all languages as it has been designed to minimize maintenance costs. Rapidly-evolving teams are common at Google and virtually all enterprises. Go’s simplicity, easy readability, and single-binary deployment ensures that Go applications have minimal maintenance and that it’s relatively easy for someone new to a code base to safely maintain it. Martin, a software engineer at Trivago, spoke of this hidden benefit of Go. “Go’s simplicity and its sophisticated tooling let us scale not only our service, but more importantly, the process of software engineering itself. Reducing the friction of onboarding and training someone has a significant impact on the company’s productivity, even more so at a constantly moving environment like Trivago.” And Benjamin Cane, Vice President and Principal Engineer at American Express, shared, “After working on Go, most of our developers don’t want to go back to other languages.” Go and GCP will help you sustain business growth. Historically, CTOs have needed to make an impossible trade-off– either choose to delay launch as the team builds a scalable application first, or choose to ship a slow prototype early, acknowledging that development will be delayed significantly later as adoption growth demands a rewrite– effectively having to choose when to be unable to support business growth. Go has eliminated this dilemma. Go is designed for Google Scale with built-in concurrency that takes full advantage of today’s multicore machines and Cloud Services. Go enables programmers to quickly develop applications that perform at scale, no rewrite needed. Eric, a Software Engineering Manager at MercadoLibre, wrote, “With Go, the company obviated 88% of their servers and cut CPU on the remaining ones in half, producing a tremendous cost savings.” Cloud computing brings countless benefits for flexibility and efficiency, critical to sustaining business growth. Go is the only modern language that has first class support on all Cloud platforms. Go is designed for Cloud-native applications. Over 3/4 of the projects in the Cloud-Native Computing Foundation are written in Go. And Go is designed for container deployment, with a very small footprint, compared to the “ship the world” legacy languages like Java, Python, and Note. Mariano, a Software Engineer at Movio, blogged, “Our Go microservices currently build in 5 seconds or less, they test in one or two seconds which includes integration tests, and they can deploy (via Kubernetes) new containers in 10 seconds or less. The key factor here is small images.” Among all Cloud benefits, serverless has the largest potential for sustaining business growth, with its low cost, instant scalability, and expanded flexibility. Go is an ideal fit for serverless, with broad support on all serverless platforms. Go has very low resource use and nearly instant startup times compared to applications written in legacy languages that utilize interpreters. Google’s Cloud Run is the ideal platform for Go applications with seamless deployment. Go and GCP help you simplify the chaos. “The biggest impediment to a company’s future success is its past success,” according to Dan Schulman, the CEO of PayPal. Today’s business environment is defined by modern enterprises with a “move fast and break things” culture. Enterprises will need to embrace the process of constant transformation to remain relevant. Go provides the flexibility and performance to assist organizations with application modernization efforts, and GCP provides flexible managed services to guide your organization into the modern era. To learn more about Go, its primary use case, and to read case studies of enterprises who have transformed their organizations, visit Go.dev. Thanks for spending time with me today. I hope that you’ve learned something. I hope you enjoyed it, and I hope to see you at a future conference or one of the many Go conferences. Thank you.

0 views
spf13 5 years ago

Rust vs Go Panel at RustLab Conference

The folks at Develer liked JT ’s and my article Rust vs Go - Better together so much they decided to feature it as a panel for RustLab 2021 where JT and I spoke along with some of our friends. Like the article, this panel highlighted the strengths of both Rust and Go and when each is ideal to use.

0 views
spf13 5 years ago

Rust vs Go: Better Together

While others may see Rust and Go as competitive programming languages, neither the Rust nor the Go teams do. Quite the contrary, our teams have deep respect for what the others are doing, and see the languages as complimentary with a shared vision of modernizing the state of software development industry-wide.

0 views
spf13 5 years ago

Break things on purpose podcast

I had the privilage of sitting down with my friend Jason Yee as a guest on his podcast. Listen to the podcast at https://www.gremlin.com/blog/podcast-break-things-on-purpose-steve-francia-product-and-strategy-lead-at-google/ Jason Yee: Hey, everyone. Welcome to Build Things On Purpose. Our slight deviation from the Break Things On Purpose podcast, where we talk with people that have made really cool things and we learn some tips from them about how we can make cool things as well, things that are reliable and that scale well. So joining us today we have Steve Francia.

0 views
spf13 6 years ago

Grokking Go.dev - Go Time Podcast

I had the privilage of joining my coworker Julie Qiu as we talked with our friends Carmen, Mat and Jon about the new website we are launching for Go, go.dev . Listen to the podcast at https://changelog.com/gotime/115 Mat Ryer: Hello, and welcome to GoTime! I’m Mat Ryer. Today we’re talking about Go.dev. It’s a user-friendly hub of curated resources for Go, and we’re lucky enough to have three of the brains behind it joining us today: Carmen Andoh, Steve Francia (also known as @spf13) and Julie Qiu. Hello, everybody!

0 views
spf13 6 years ago

The Legacy of Go

This presentation was developed for GoLab in Firenze Italy and delivered as the closing keynote of the conference. The presentation talks about legacy, looking both backwards and forwards. It talks about the legacy of langauage Go inherited and how it is paying respect to that legacy. It concludes talking about the legacy Go hopes to leave behind.

0 views
spf13 7 years ago

Go Q&A Session - Utah Go Users Group

I was traveling with my son in Utah, visiting my old university and connected with our Go Users Group while I was there. They graciously invited me to speak at their next meeting and I was excited to be a part of the conversation. This was a great opportunity to learn more from our users and how we can improve Go. We also learned about the Go community in Utah and how best we can help support them in their Go journey.

0 views
spf13 7 years ago

What Should a Modern Practical Programming Language Look Like

Keynote delivered at The Landing Festival – Berlin . This presentation describes the many inspirations and influences of the Go programming language and goes into detail about how we shaped and created the language.

0 views
spf13 7 years ago

Product Management for Everyone

An interactive workshop developed for and given at the Landing Festival in Berlin 2019. This workshop covers: What a product manager does How to become a product manager Practice thinking like a product manager Building product manager skills

0 views