Cup o' Go

★ Support this podcast on Patreon ★

Creators and Guests

Host
Jonathan Hall
Freelance Gopher, Continuous Delivery consultant, and host of the Boldly Go YouTube channel.
Host
Shay Nehmad
Engineering Enablement Architect @ Orca
Editor
Filippo Valvassori Bolgè
Sound Designer / Audio Editor based in Milan

What is Cup o' Go?

Stay up to date with the Go community in about 15 minutes per week

Shay Nehmad:

Man, am I happy to be back recording though? I was sick last week and I was like, I don't know what's happening in Go. What do I do? This is Cup of Go for Friday, 08/21/2026. Keep up to date with the important happenings of the Go community in about twenty minutes per week.

Shay Nehmad:

I'm Shay Nehmad.

Jonathan Hall:

And I'm Jonathan Hall.

Shay Nehmad:

What's up?

Jonathan Hall:

Good to have you back, Shay.

Shay Nehmad:

Thank you. Thank you. I was sick. I had, like, strep. My daughter might have picked it up this morning unfortunately, which is why I don't have a microphone and I'm recording from home.

Shay Nehmad:

But you see like my beautiful backyard here in the in the I hope it looks like California y and nice.

Jonathan Hall:

That's nice stickers or decals that are on your windows. What's that, Yeah, ice

Shay Nehmad:

she made those.

Jonathan Hall:

Pizza.

Shay Nehmad:

So we have lots of things to talk about, which is

Jonathan Hall:

an

Shay Nehmad:

understatement because probably the biggest news is Go 127 came out.

Jonathan Hall:

Exactly, yeah. And we're not going to talk about that at all. We're not even going to mention it once like we just did. Yeah,

Shay Nehmad:

we're not going to mention that Go 127 came out at all. No, we want to do it justice. We sometimes have these like big release episodes where we just comb through the release. I think it's sort of the equivalent of the, you know, just reading the release notes or the interactive release notes. But we still have so many things to talk about that we missed last week that we want to talk about that.

Jonathan Hall:

Yeah, so quick highlights from what will be happening in this episode. We are going to talk about some security releases that came out last week. We have an interview coming up and a whole bunch of like a smorgasbord of AI related stuff to talk about. Smorgasbord. Yeah, stick Smorgasbord, there you go.

Jonathan Hall:

We should just have an AI produce this whole thing for us, we go do other stuff.

Shay Nehmad:

Nah, I don't think so.

Jonathan Hall:

You don't think so?

Shay Nehmad:

When I'm actually reading it and I have to prepare for the episode, I actually learn what the thing actually means.

Jonathan Hall:

So you haven't outsourced all your learning yet to AI?

Shay Nehmad:

Yeah. I haven't outsourced a 100% of my thinking. Some friction is good in life, I feel. That's great. But please don't get me started.

Shay Nehmad:

I have a whole blog post on my blog that's called like At the Gates of Slob. Just talk about the proposal you put up first.

Jonathan Hall:

Yeah. So, Yeah, we'll finally dive in. This is a proposal that's fresh off the press from 08/10/2012. Oh my gosh, that's not new. The proposal is to remove string int.

Jonathan Hall:

How often do you convert an int to a string in Go by just doing string and then parentheses and an integer?

Shay Nehmad:

Convert a string to an int.

Jonathan Hall:

Or I'm sorry the other way. Convert an int to a string. I said backwards.

Shay Nehmad:

Converting int to a string, do all the time, right? You get a number and then you want to put like print it or Well, actually you do percentage d.

Jonathan Hall:

Yeah, you're probably doing fmt. Print sprintf with a percent d or strcons. I to a or something like that, right? Yeah. Because you want the integer value 12 to be presented as one, two, right?

Shay Nehmad:

Yes. Instead of But that's

Jonathan Hall:

not what string does. It converts it to the Unicode character at that code point. So for ASCII values, it's relatively simple, 65 becomes an A, but that's almost never what you want. So Rob Pike proposed this. The

Shay Nehmad:

fact that I didn't remember what it does probably proves that it's like not what I said. I do the I2A thing because I need a number and then I wanna like print it or store it to, you know course. Interpolate or whatever.

Jonathan Hall:

And that's normal. The rare cases where you would want to do what string int does would be something like you're writing a file in byte format or something like that. But there are better ways to do that too, less surprising ways to do that, which is why a couple of years ago, I think, I don't remember which version of Go, but this was added to GoVet. So GoVet now complains if you try to do stream ints correctly. The proposal now is to completely remove it from the language, a breaking change.

Shay Nehmad:

I guess we're bound by the Go one compatibility promise to keep this until Go two. That was a comment by Andrew Jerrand in 2013.

Jonathan Hall:

Yes.

Shay Nehmad:

Opened But 08/10/2012. Yeah. This is I think I was 17.

Jonathan Hall:

Were you using Go yet?

Shay Nehmad:

No. I was using assembler, c sharp. These were my two main languages back then. What happened? Why is this like raised from

Jonathan Hall:

Why is this raised from the dead? Yeah. So I'm sure you recall the whole reusing of a variable and a loop thing that happened many versions ago where used to be really annoying. Was Go's most infamous foot gun and it got fixed, which was technically a breaking change. They've essentially decided we could do the same thing for this.

Jonathan Hall:

This is another foot gun. So, the proposal is that starting with presumably Go 128, assuming it's accepted in time, this would just stop working in new versions of Go. But old versions of Go still use the old one. I'm assuming that if your Go module or your Go build tags for the file reference an older version of Go just like it does for the loop variable, it would continue to use the old logic. So, it would be sort of on a per file per module basis that you would get the new behavior.

Jonathan Hall:

I'm assuming that's the case. This isn't fully laid out here, but that's how they did it with the loop variables. I'm assuming they would use the same sort of rules to allow us to stop having this foot gun and go while old code continues to behave the foot gunny way.

Shay Nehmad:

So, I'm looking at the discussion and it seems like it was almost a likely decline because, well, it simplifies the code in the Copilot just a little bit, but it might break code. And what you're saying is it will actually not break code. Right? That's right. Because if you tie it to a language version.

Jonathan Hall:

Correct.

Shay Nehmad:

Oh, I get it.

Jonathan Hall:

If you wrote old style code in a new version of Go, that would break, but that's not

Shay Nehmad:

That's fine.

Jonathan Hall:

That's fine. Yeah, exactly.

Shay Nehmad:

Yeah. I do wanna point out this comment here of Vet is not universal by Austin Clemens here on the issue tracker. It's true technically that you can compile and ship Go code without running Go Vet, but I mean, come on.

Shay Nehmad:

what I mean? I think there's

Jonathan Hall:

two things to tease out of this. And the first is, you're right, it's not universal, which is why it was allowed to go into GoVet in the first place. If it were universal then a GoVet failure would be the same as a compiler failure, right? So, the fact that it is less enforced is what allows it to be more strict in the first place. And I guess actually that's my two points right there already is is a different barrier.

Jonathan Hall:

It's still a high barrier because it's almost universal. Like you can ignore it if you want to, but you get notified about it. So, is a little bit of a maybe a catch 22 because part of the argument in favor of doing this now is, oh, it's been in GoVet for a while, so people probably aren't doing it. But on the other hand, they're also saying, but GoVet isn't universal. So, is it universal or is it not?

Jonathan Hall:

You can't kind of I feel like the discussion is arguing both directions. Having said that, I'm in favor of the change.

Shay Nehmad:

Me too. It seems super reasonable. I wonder, though, like, is it interesting at all? Like, this is an open question to search for code that that looks like this. Like, is this interesting to to search in all Go code, you know, calls to a string and then a number?

Shay Nehmad:

Like, is it is it is there any point?

Jonathan Hall:

Is there a point to do occasionally Like, because because

Shay Nehmad:

if it again, because if it if it doesn't break, then there's like zero reason not to do it. It'll just change new code. Right? Yeah. I wonder.

Shay Nehmad:

Well, maybe I'll we used to do Source Graph. It seems like there's zero results. Maybe I'm like, my search foo is wrong, but I'm I'm trying to use this this app we saw for similar purposes, source graph. So I'm searching for string, open paren, zero x, and then anything.

Jonathan Hall:

Mhmm.

Shay Nehmad:

There are literally zero results. So either I don't know how to search in this in this app or this doesn't happen. So for instance, calls to string.

Jonathan Hall:

Yeah. It must happen. Because, I mean, I use I use string conversion all the time, but usually between other string types, not between integer and string.

Shay Nehmad:

So Yeah. Or

Jonathan Hall:

white slices and strings.

Shay Nehmad:

I'm trying to see if I can find, like, cases where it's an integer. Any digit, any number of times. Let's see. Yeah. So oh, rand dot string.

Shay Nehmad:

That's weird. Test details. No. I don't think it actually I I don't think it actually happens.

Jonathan Hall:

I don't think it happens sometimes.

Shay Nehmad:

Sensitivity. Well, that's an interesting tool. I'll play around with it more. But if if we can actually find it if we can can't actually find real cases of it in the in the wild, that would be interesting to add to the discussion. Right?

Shay Nehmad:

Like, oh, I searched public code and this doesn't seem to actually happen. I'll I'll I'll add it as a comment to the issue, which is this one. I've searched public code using Source Graph and haven't found any real usages of it, which isn't surprising. Cool. I'll submit this later after I clean it up, not live on the air.

Jonathan Hall:

Very good.

Shay Nehmad:

But I'm all for it. This seems like a good change. Alright. Let's move on then. Security releases.

Shay Nehmad:

It's my favorite topic as longtime listeners of the show know. There are 10 things fixed.

Jonathan Hall:

Oh my gosh.

Shay Nehmad:

It's impossible to go over all of them. And actually a lot of them are interesting, but I've picked two to share with you today because I think they teach two interesting topics that might be useful for you even outside like Go security. Alright. When there's a problem in production, what is it always?

Jonathan Hall:

The other guy.

Shay Nehmad:

There's a haiku about it.

Jonathan Hall:

Oh, wait. I don't know the haiku.

Shay Nehmad:

It's DNS. It was always DNS.

Jonathan Hall:

It's always DNS.

Shay Nehmad:

It was DNS. Right. So it's DNS. The context is, of course, Go has security releases like minor releases. This time we're talking about one twenty six point six and one twenty five point thirteen.

Shay Nehmad:

Before we dive into the details, like always, just upgrade. Unlike upgrading to 1.27, which you need to wait until our episode to make sure that you want it, the minor security releases are almost always worth upgrading for, two, I mean. And one of the security fixes is a panic when DNS server, like the DNS Go code, tries to parse a specific DNS message. So DNS has these like records, record types. Right?

Shay Nehmad:

Which ones can you remember, like off the top of your head?

Jonathan Hall:

A would be the obvious one. Right.

Shay Nehmad:

A. A and AAAA. Yeah. Right. And if you really stretch, like, you know, if I put a a gun to your head, you'll be like maybe MX for email

Jonathan Hall:

or MX or TNS. Used to be an NS nerd when I had to for my work.

Shay Nehmad:

Man, I used to sleep literally. I mean mean this in the most literal sense there is. I used to sleep on Tannenbaum, like the computer's not computer networks book was my pillow for like a few days. And in the most literal sense possible, that was I rested my head on it. Luckily, it's thick enough, so it has good neck support.

Shay Nehmad:

So what do A records have in them?

Jonathan Hall:

They they have a they map a host name to an IP address. Right? Exactly. That's it.

Shay Nehmad:

So when you I'm, like, quizzing you. You're like, what the hell?

Jonathan Hall:

Yeah. It like it's supposed to be complicated, but it's easy.

Shay Nehmad:

Is easy.

Jonathan Hall:

I feel like a gotcha interview question.

Shay Nehmad:

Yeah. Gotcha interview. I love those. What's the difference between a duck? If you're in a box, how would you think outside the box?

Shay Nehmad:

Anyway, before I shrink you down to the size of a penny and put you in a blender, you're absolutely correct. The A record has the DNS name to the IP address, which used to be enough to start talking to a web server. Right? You have its IP address and you can just start talking to it. But the web has gotten a lot more complicated since then.

Shay Nehmad:

Right? Every server has, oh, maybe it's a redirect to HTTPS. Right? And then when you redirect to HTTPS, which protocols do you support? And you end up having like a pretty significant ping pong from the moment you got the IP until you have all the information you need to, like, get get working.

Shay Nehmad:

Apparently, and I didn't know about this, there's a relatively new message type, not a, not quadruple a, SVCB.

Jonathan Hall:

Never heard of it. Okay.

Shay Nehmad:

You wanna guess what it stands for?

Jonathan Hall:

Something that's simple? It is it No. No. It's because I always think simple anymore.

Shay Nehmad:

It's service binding. Service contract binding or something like that. Okay. Oh, no. SVC binding.

Shay Nehmad:

SVC service and b is binding.

Jonathan Hall:

Okay.

Shay Nehmad:

This is a new message type, and it has a lot

Jonathan Hall:

of

Shay Nehmad:

parameters where it's not only so we're looking at the RFC request for comment documentation. It's number 9460. You can read it yourself on the RFC editor if you're watching the video episode. We're also sharing it, but it's just the document that outlines what this message is supposed to do. What it's supposed to do is give you like, you can read through the entire thing and it's like RFCs as they tend to do, it's like incredibly detailed.

Shay Nehmad:

But this service binding message type is basically give you more details about the service you're gonna talk to with a lot of parameters for each endpoint. Meaning you detail when talking to my server for all these endpoints, this one supports DLS this version, and this one has encrypted client hello, this one doesn't have it. So a lot of detail.

Jonathan Hall:

So I suppose it's meant to be a shortcut, so I don't have to like look up the IP, then do HTTP and get the redirect address, then do the redirect, etcetera, etcetera, etcetera. It's sort

Shay Nehmad:

of And then a like you tell it what things you support and then it tells you what things it supports and then you do the encrypted client hello and then blah, blah, blah. Like for example, the record includes the public keys already. So you don't even need to ask the server for its public keys.

Jonathan Hall:

These must be big records then.

Shay Nehmad:

Exactly. And that's the bug, there's just a panic of a buffer overflow when you're parsing invalid messages. Parsing an invalid service binding message or by the way, there's a similar equivalent one for HTTPS. It's the same concept. The RFC actually talks about them both.

Shay Nehmad:

So if the parameter overflows the message, it can panic. It's true that the messages can be really big and it's understandable why you would think that, oh, a really big message might like cause DDoS and that might actually be true. Maybe someone should look into it now that I'm saying it out loud. But this is something way simpler. Like the size of a parameter value may overflow the message buffer because, you know, every record has like multiple parameters.

Shay Nehmad:

You can just have a really big number there and then it causes a panic.

Jonathan Hall:

Fascinating.

Shay Nehmad:

Yeah, I didn't know about this record type. Obviously, it's reasonable, but it was interesting to learn about it. The fix is pretty simple though. So if you have DNS servers and you don't want people to send service binding messages that can crash them, you should upgrade.

Jonathan Hall:

So this matters if I'm running a DNS server different than Go?

Shay Nehmad:

Case matters if you run code that parses DNS messages as part of a data pipeline, for example, like you're writing a firewall or something like that. Okay. Someone might crash crash your firewall if you're using that. It's not necessarily a server. It's anything that parses DNS messages.

Shay Nehmad:

I just assume that most cases are DNS servers.

Jonathan Hall:

Right. Fair

Shay Nehmad:

enough. But even I don't know. Like, if there's a Wireshark I don't know what language Wireshark is written in, but it's older than Go, so it's probably not in Go. But if you have like a Go module for Wireshark worth updating as well, I guess. Man, I love Wireshark.

Shay Nehmad:

Alright. So this was the first one. Again, this is one of 10. I'm gonna pick another one, which was reported by a dear friend of the show, Filippo Valvassori. And this one is wouldn't surprise you related to cryptography.

Shay Nehmad:

It's fixed transparency log tile verification bypass. How does that how do these words make you feel?

Jonathan Hall:

I think I understood about two thirds of those words.

Shay Nehmad:

Tile for me was was I was like, what? I don't know what is is Tile like a normal I only know Tiles in the floor. Right. And I tried to read this, and actually, very very luckily for us, there's a great commit message, which explains this pretty well, but it does require a bit of background. This vulnerability is is like real, and it impacts the go some and like the verification that the data you're getting is actually the data you want.

Shay Nehmad:

So let's start with the go sum file. What is that?

Jonathan Hall:

It's a I don't know what the hashes represent, but it's some sort of hash of each specific version of each module you're using for verification purposes.

Shay Nehmad:

So, the hash, I didn't know about this, well, I think I did, but not in the detail that I'm about to share, is to make sure that the model is the one you actually module is the one you actually want. Because theoretically, someone could take over your Go proxy, Go server in the way and download not the code you want. Right? And nobody wants that. I want the code that I asked for.

Shay Nehmad:

So if I ask for, you know, Jonathan's new Logarus version, which we'll talk about later on, you know, you are an attacker and you want to put some malicious code on my machine, right, like a crypto logger. You want it to CryptoMiner, I mean. You want it to run crypto on my machine. A good way to do that would be to take over, like, whatever server I'm downloading my Go code from and just serve some malicious code from there, right?

Jonathan Hall:

Sure.

Shay Nehmad:

So the Go sum is the part that doesn't allow you to do that. Now you see the hash, how would you think that like provides some security?

Jonathan Hall:

I imagine the Go toolchain validates that hash against the version that downloads when it's downloading, maybe when it's compiling to make sure that things match. Probably only when it's downloading, I'm guessing.

Shay Nehmad:

So you're correct, but there's a little question here of trust because where do you get the hash from, right? You have to have some root trusted thing. Right. And the way they solved it is with a thing called Merkle trees, which I learned and then forgotten and then relearned for this episode. It sounds complicated, but it actually like Let's say you have A and B, right?

Shay Nehmad:

A is like trusted and b is like not trusted. You hash a and b and then you hash both of them and then you hash both again. You have c and d and then you hash both of them and then you hash the result again and it looks like sort of like a tree. But if you change any one of the leaves, all the results change. So it has a nice quality like Merkle trees that it can give you a lot of verification.

Shay Nehmad:

Like if the things don't match, they don't match, but you don't have to recalculate everything if you know some of them are trusted. And that's how the GoSum sort of DB works. It's based on Merkle trees. And because otherwise, you'll have to calculate the hashes of all the things in the world every time you wanna, you know, make sure that your your specific module is correct, which obviously you don't wanna do. You don't wanna download this entire tree and then run all the hashes in the world.

Shay Nehmad:

So the fix, the bug, I guess I should start with the bug before I go to the fix, is you have these like this Merkle tree, has some things assigned, trusted, like root, And then you download the modules that have these little checksums and you make sure that the checksums match up to the root, like you calculated back up to the root, assuming some parts are trusted. Basically, everything from the like, everything that's from the proxy is considered malicious until you compare it to the trusted root at some.golang.org. So there is a Go SumDB that's like a checksum database, it's append only, and like that represents a Merkle tree. You don't want again, you don't want to go to download the entire Merkle tree because it's millions of hashes and you only need to verify one module. So you cut it up or you cut up the tree into like these convenient blocks and these blocks are what's called the tiles.

Shay Nehmad:

So it's all the consecutive hashes from one level. So already now I know what is a tile in a Merckle tree. It's just like one level of a Merkle tree. And what you do is you reconstruct only the levels above a tile, and then storage and network access are much more practical because you only do one branch to verify your thing. Now the the root is trusted of the tree.

Shay Nehmad:

And then the tile reader fetches more tiles. They can it can fetch it from the network, from a disk cache, from Go proxy, whatever, and the downloaded tiles are obviously not trusted, right, because you're downloading them from my malicious thing. When you'll verify them, the hashes won't match up and it'll be like, woah, this is like not matching up. Someone's trying to supply chain attack you. Does that make sense?

Jonathan Hall:

Mhmm.

Shay Nehmad:

Cool. The bug was, you want the tile readers like give me hash x, and then it figures out which tiles it needs to bring, which parent tiles prove it, and then it reads it, and then it reads like the unverified bytes and then verifies them. But sometimes you get duplicates. Right? You have a tile a that needs tile b that needs tile c, and that goes to the root.

Shay Nehmad:

But if you to verify the root, you need a, b, and c, and the tiles you're requesting are c, d, and e, you don't wanna fetch c twice. Does that make sense? Like, imagine the tree. You need three are below you and three are above you and one is shared in the middle.

Jonathan Hall:

Right, okay.

Shay Nehmad:

There's no reason to go fetch C twice from the GoModel proxy, right?

Jonathan Hall:

Yeah, right.

Shay Nehmad:

Fetch it once. The ones below are trusted, the ones above are not trusted, or it depends on how you visualize Merkle trees, right, or trees in general. So there's some group of them are trusted. Right?

Jonathan Hall:

Right.

Shay Nehmad:

Some group are not trusted. What would you expect to happen when you deduplicate the lists in terms of which ones to trust and which ones not to trust? Let's say A, B and C are Like A and B are trusted and C, D and E are not trusted. But C was also part of the first group because, oh, that's what I need to verify the root.

Jonathan Hall:

You might have to walk me through it. I don't know if I'm I'm making this next eventually. I'll I'll explain it again. You

Shay Nehmad:

need a, b, and c to prove to verify against the root, and you need c, d, and e, you need that those are the ones you need to, like, download to verify the signature.

Jonathan Hall:

Okay.

Shay Nehmad:

C, D, and E are not trusted.

Jonathan Hall:

Right.

Shay Nehmad:

And usually the ones like A and B are trusted because those are the ones you verify against the root. Those are the ones you assume are okay. A is like the root. Right? So that's signed and trusted.

Shay Nehmad:

There was the code was like, well, to verify the root, I need c, d, and e, and to get c, need sorry, to verify the root, I need a, b, and c. And to get the hash I need for c, I need e, d and c. Obviously, you don't wanna fetch c twice.

Jonathan Hall:

Yeah.

Shay Nehmad:

So you're like, okay, I'll just put it in one of those lists, either the trusted one or the untrusted one.

Jonathan Hall:

Uh-huh.

Shay Nehmad:

It put it in the untrusted in the trusted one.

Jonathan Hall:

The trusted one, even though it shouldn't have. Okay. Yeah.

Shay Nehmad:

So you could the whole mechanism basically, like it collects it and then it deduplicates. Again, shout out to the commit message where you see this it collects all the tiles it needs to compute the tree hash and then the request didn't text. It really walks through it. There's even a little ASCII art that shows how this works. And then some of the tiles are basically just never authenticated, but were still used and they were completely attacker controlled.

Shay Nehmad:

So it basically didn't do the security contract it was meant to do.

Jonathan Hall:

Well, I realize I realize now that none of the tiles in my kitchen are authenticated, so I probably need to get that too.

Shay Nehmad:

You should you should check. You should talk to talk to your contractor. I just love this little element of the of the commit message. I totally get it. It's like, it explains, it walks through this entire thing and ends up with, these tiles were all this is quote verbatim.

Shay Nehmad:

The tiles were also passed attacker control to save tiles, breaking its security contract. And then like two new lines and then like, oof. Yeah, I love this one. Very interesting. It is like serious.

Shay Nehmad:

So and this impacts everybody, like everybody who downloads dependencies. Definitely worth upgrading.

Jonathan Hall:

Brings me to a point that I think is interesting here. This bug and one other in the release isn't in the standard library or the standard tooling. Actually, there's a couple of those. It's in the Xmod module. Why is that included in a Go release since it's part of the golang.org/x/modrepo?

Jonathan Hall:

And I had to go figure this out. I know the answer now, but I'm curious if you know the answer you can tell our listeners. If not, I'll tell you what I learned.

Speaker 3:

I no idea.

Jonathan Hall:

In the last few minutes. Maybe because

Shay Nehmad:

I look at all these things as like part of Go, but obviously you're They're not like technically part of like the Go rep or whatever.

Jonathan Hall:

So, I was looking at the CL, the change list for this fix just as you were talking about it. And this is actually, it is part of Golang org. Oh, X mod. And there are two vulnerabilities in this release from there. There's other one from XNet.

Jonathan Hall:

But those are vendored into the Go repo. Oh. And I'm assuming that's because it's part of the Go tool chain. So, this isn't part of the center library, but this tool chain depends on this. So, we also had a security vulnerability release announced at the same time for the Golangorg XMod package, which is exactly the same thing.

Jonathan Hall:

So, we don't need to talk about that as a separate news item because it's the same news item. Same fix landed in two different places.

Shay Nehmad:

Yeah, that makes sense. But again, like the whole well, X is not really part of the standard library. It is. I mean, it's vendor day. You know what I mean?

Jonathan Hall:

Yeah. It is.

Shay Nehmad:

Practically, it is. Cool. So that these are like two highlights of the security releases. Again, are 10, so we're not going to go through all of them, but some of them are more like vanilla and boring like, oh, parsing bug, whatever.

Jonathan Hall:

Yeah, HTML There's

Shay Nehmad:

always a lot to learn from these security releases. I love churning through them. And I hope you enjoyed listening to this. I'll get off my soapbox, security soapbox now.

Jonathan Hall:

All right, Shay, we've been talking a long time about these two items. I thought stringing in would take a while, the security issues took a while. I think we're going have to save our discussion about MCPs. And AI assisted Yeah, AI assisted stuff. We're going to have to save most of that for another week.

Shay Nehmad:

You know what, Claude has been making me wait for so long for API responses recently. AI can wait on

Jonathan Hall:

me for a

Shay Nehmad:

little while. Just turn the taters Well, on

Jonathan Hall:

if you're if you were itching for some AI content, we have some. The interview that we're gonna be doing is AI related. So I know you haven't heard it Shay, because I recorded it last week while you were sick. So, stick around

Shay Nehmad:

for actually won't hear it until the episode comes out. So, stick around, but I actually have to stick around until the episode though. How about we jump to a quick lightning round?

Jonathan Hall:

I think we should. We should get more than two things on our our backlog taken care of this week.

Shay Nehmad:

Let's go.

Guilluame Moigneu:

Lightning round.

Jonathan Hall:

First up, Logris has a new release. Do you remember Logris? Did you ever use Logris, Shay?

Shay Nehmad:

Yeah, I like Zero Log, but I use Logris as well. And now I don't need any of them because there's S Log.

Jonathan Hall:

Exactly, so I used to be a big Loggers user. I submitted some PRs way back in the day. And then I was actually surprised several weeks ago when Manuel de la Pena, who we had on the show to talk about Go Test Containers.

Guilluame Moigneu:

Well, I'm the core maintainer of Test Containers Go. You know that Test Containers is a set of libraries in multiple programming languages. The more famous or the older one or the one that came first was the Java flavor of test containers. And from that, languages, many different implementations appear in different languages.

Jonathan Hall:

He pinged me and he's like, hey, there's PR you have on LogRisk. Could you answer some questions on it and get it merged? I'm like, wow, I forgot that even existed. I went and looked and I had created a pull request back in 2023 to add S Log support to Logris. Anyway, long story short, that has finally been merged and released.

Jonathan Hall:

So now Logris version 1.10 supports S Log natively. So, if you're still using LogRisk and want to support S Log either permanently or transitionally, it's easier now. This release also has a bunch of performance improvements. So, if you're using LogRisk, which few people probably are anymore, but if you are, this is definitely worth an upgrade for the performance improvements, if nothing else.

Shay Nehmad:

I would assume that if you're using, if you used to use LogROS in a big project, like, the cost of removing it and replacing it with the s log, it's just not not worth it. What's the point?

Jonathan Hall:

Probably, yeah, for a

Shay Nehmad:

large part of it. Will probably make the transition easier. Yep. Well, well done. This is slowly becoming the Jonathan open source contribution show because there's another release to talk about, right?

Jonathan Hall:

There's another one. Shay, the web router that we all know and love had a new release

Shay Nehmad:

Citation needed.

Jonathan Hall:

This another one of those packages you probably don't need anymore because the center library has improved. But I also created a pull request on Shay almost a year ago, October 2025 to fix a very minor bug in how it reports allow headers. So, bug was if she responds to a request that uses an unsupported method, so like say your endpoint only accepts GET and somebody sends a PUT, it can respond with an allow header that tells you here's the ones that are supported, It would duplicate some of those headers of the allow header.

Shay Nehmad:

It would duplicate the So

Jonathan Hall:

it would say like allow get, Yeah, common the allow header itself would have the allow methods. It would

Shay Nehmad:

have get twice.

Jonathan Hall:

Twice, sometimes. So it might say allow get get. Not a big deal, I don't think it broke anything because I imagine every client would like de duplicate that. I submitted, I was one of like five or six people to submit PRs. Yeah, like this like

Shay Nehmad:

Dancing with the Stars situation they have here. It's like a reality TV show. There are like 17 PR's that fix it, but you got the, you know, I the wanna love it. And the chair spins around.

Jonathan Hall:

Anyway.

Shay Nehmad:

Looks like the cleanest fix.

Jonathan Hall:

Yeah. I I don't I I didn't look at all the others. It's hard for me to imagine a dirty fix for this bug. It was pretty simple thing. Anyway, if you're using Chi, and I am on a couple projects still, you might upgrade to 5.3.2 and have fewer duplicated options in your allow responses.

Shay Nehmad:

Well, my That's

Jonathan Hall:

all I got.

Shay Nehmad:

Lightning round item, is a kind of a weird one, but we had Patricio Diaz on the show talking about crappy.

Jonathan Hall:

Oh, yeah. That was a crappy interview, wasn't it?

Guilluame Moigneu:

Yeah. I'm Patricio Diaz. I'm from Paraguay. I'm a software developer and freelancer right now. I'm looking for a new position.

Guilluame Moigneu:

In fact, the for crap is part of my portfolio I'm building to catch up the the attention of recruiters and all of that.

Shay Nehmad:

So following that interview, we came up with the idea, like, sort of live on the show to have a CRAAP report for various Go repositories. And it ranks the CRAAP, which is cyclomatic readability and predictability, higher is worse. It's like Golf of various like popular libraries, which I've found very interesting. So you see types of Go, Tailscale, Podman, NetBird, Chainloop, Olama, Gorm, like all these different libraries here with their scores and when they were analyzed. So you should build this like very cool tool, it's called Go Craft Tracker.

Shay Nehmad:

And if you want like the details on how it's working, just go to our Slack channel, upago on the gopherslack because it's actually literally all happening there. So, hey, this link is cool. Go visit it and like look at the numbers and be like, why is TypeScript so bad? Whatever. And like there's interesting discussions about, you know, whether this number means anything at all, blah blah blah.

Shay Nehmad:

It was interesting to see that it's all happening in the context of like cup of go. I used to think this show I don't know how you feel about it, but I used to think about us, like, taking from the Go community and just sharing what we took. But recently, more and more, it feels like we're, like, creating things that if the show didn't exist, like just straight up wouldn't happen.

Jonathan Hall:

Is it generative?

Shay Nehmad:

It's generative. It's definitely not artificial. And I don't know if it's intelligent.

Jonathan Hall:

All right.

Shay Nehmad:

Anyway, so there's just this follow-up cool project. Thanks, Bertrand for putting that up.

Jonathan Hall:

All right, stick around for an interview with Gal.

Shay Nehmad:

Yeah, and as we promised, no ad breaks, but if you wanna know more about previous episodes or buy swag, the store is still up, but it's gonna be down very soon.

Jonathan Hall:

Do it now while while supplies last. Yeah.

Shay Nehmad:

Exactly. We'll still offer things just via email instead of via shop. Visit cupogo.dev. You can find everything there. Also, we started putting out YouTube Shorts.

Shay Nehmad:

So if you haven't subscribed to us on YouTube, maybe do that. I don't know, you don't have to. But we're just trying to get the show to more people. And I think it might help.

Jonathan Hall:

You don't have to, but like and subscribe.

Shay Nehmad:

Yeah, exactly. All right.

Jonathan Hall:

Welcome, everybody. Thanks so much to all three of you for joining. I think this is the biggest interview we've had on the show or will have had on the show. Who wants to start with an introduction and tell me, of course, who you are and where you come from and why you're on the show?

Guilluame Moigneu:

Yeah, I can do that. So everyone's calling me G because my first and last name are a mess. Sorry. Obviously French. Based in Texas for seven years now.

Guilluame Moigneu:

So we're just a group of three friends that also happen to be working together you know, as a tech start up doing like deployment and things like this. And we all came up with the same issue in our own setup at the same time. We were struggling with the amount of different coding agent, different systems, and everything. And we were all configuring them manually. And I've got three different machines.

Guilluame Moigneu:

I've got external servers, and they were never in sync. And I hate that. I want a machine to be fully replaceable if I lose it or something goes wrong. So we came up with the idea of GAL, G A A L, because, like, we wanted a simple layer to actually be able to govern and sync all the configuration between, at the beginning, an individual agents. So different machines, different agents, and stuff like this.

Guilluame Moigneu:

And well, the second step after that was that every time we were discussing with someone from the ecosystem, they were like, I'm struggling so much. I've got like 10 people on my team. Everyone's using different setups, and we don't know how to deal with that. So we started thinking of Gad as more like the overall team organization way of managing skills, MCP and agent configuration, whether that's coding agent to use on your laptops and desktops, but also now that we see with background agents running all the different system like Maestro as Flutter agents and stuff like this. So that that's basically the core ID and the need we add from the product.

Guilluame Moigneu:

I'm going to introduce my fellow colleagues, Greg, based in Manchester right now, and Miki tebeka based in France. We are all more or less technical backgrounds. Miki has been like a highly skilled developers for like the thirty years now. I've been doing development as well for twenty years. And I'm sorry, not the right side of development, mostly PHP and Node.

Guilluame Moigneu:

Js. I'm sorry for this. Miki is more Go oriented than myself. And Greg, which is also a really good friend of ours, is more on the product marketing side of it, even obviously if he has a really good understanding of everything technical be behind that.

Speaker 3:

I wanna say, I I know a lot of developers. I think that's where where I come into a snuff.

Guilluame Moigneu:

No. The best thing about Greg is that you you can put it anywhere and people will think he's a developer, but he's not. He's really good at disguising himself.

Jonathan Hall:

Okay. All right. So let's talk about who initially had the idea for this product for Gal and who proposed it first? What was the birthplace or the birth moment of Gal?

Guilluame Moigneu:

I was actually spending a few days at Michael's place because we've known each other for like twenty years. And we were discussing on his couch and I was actually trying to do some reinstall of my machine at the time. And I was struggling because I realized that I had Clothes, Codex, Spy, and I was trying other agents and actually realized that, oh god, everything is everywhere. I have no idea what is running. And actually, when I started actually listing everything that was installed, I realized that I had like 300 skills overall everywhere.

Guilluame Moigneu:

And also some sneaky one from a company called Versal that actually got installed without my own knowledge. So that triggered a lot of things because those skills can access a lot of different things. They've got they can catch your problem, the story, a lot of things. So more than just organization, it's also become kind of security measures as well. So that's where we started actually working on this.

Guilluame Moigneu:

At least just a weekend working on the single binary agent, and then develop that over the weeks to a full fledged product.

Jonathan Hall:

Cool. So is it a paid product at this point or is it an open source project or both?

Guilluame Moigneu:

That's a tricky question. We are all deep into the open source ecosystem for a really long time. So we want a really good part of the product to remain open source. Some things will be source available but a bit of a different license. The main agents that you can run like as obese as an individual will stay GPL.

Guilluame Moigneu:

But we're thinking of other layers. So the goal right now, the strategy which is still to be revised is you can use the single binary agent on your different machines, completely open source, completely free. There will be a community edition that will match like companies with like 50 to 100 people that want to manage their skill at scale with like publishing workflows, auditability, traceability. And the only thing that we want companies to pay for is the upper compliance reporting level. So if you're a company with like thousand developers, 2,000 developers, and you have to meet SOC two compliance and stuff like this, that's where we're gonna offer a paid offering to actually match those compliance framework.

Guilluame Moigneu:

But that's all. We we want to be committed to fully give away what what we're doing, because that's been in our DNA for the past twenty years.

Jonathan Hall:

Alright. And is Gala a full time job for any of you at this point or is it a side project? What does that look like?

Guilluame Moigneu:

It's a side project for now. We all work at the same company called Appsum, that provide like a platform as a service deployment. Also because we we found the same needs inside that organization. So we are part of the engineering team, it's a web which is more on product marketing side. But we have 115 engineers and we see those problems day to day.

Guilluame Moigneu:

So that's why we also wanted to create that. And that will remain a side project for now. Yeah.

Jonathan Hall:

Are you using it at your employment, at your work, Goal? Are you using Goal at work? Somewhat We a little do.

Guilluame Moigneu:

We do not officially in the company processes, but some people, Okay,

Jonathan Hall:

okay. I understand that Goal is written in Go, is of course why you're on this show. Let's talk about that choice a little bit. How did you choose, why did you choose Go? What did you consider or was that like the only option in your mind or did you consider alternatives?

Guilluame Moigneu:

We did consider alternatives but actually Miki being a big Go fan that actually settled the debate pretty fast.

Jonathan Hall:

There

Guilluame Moigneu:

are two main reasons we went with Go. The first one, which is not the most important is that Go is the perfect language for having coding agent work on it. I think like the way Go is structured, the packages, the testing and everything is really suitable for Cloud Code, Codex and the other agents. They know the Go ecosystem very well, they're very proficient and it's also easier to verify what they're doing. So we really like that for it.

Guilluame Moigneu:

Because even if we like very well good tested crafted code, we still rely on the agents to create most of it. So we need to have like the right level of control on top. The second reason which is more like business related is because of our deployment model. The the GAD agent that you can use in individual is a binary you need to have on your computer. So having Go completely bundled, not tied to any other dependency is a big win there, better than any node or whatever the other languages.

Guilluame Moigneu:

Rust could have been an option there. I'm not a big fan of Rust personally, but that's just my own opinion. So I would prefer staying with Go. Because we want to also allow companies to do on prem deployments with the Community Edition, we need the package to be easily installable, the setup and maintainable. And having a Go binary once again, that bundle also the Node.

Guilluame Moigneu:

Js front end that goes with it for the dashboard and stuff is so easy for them to manage. No matter what they're using, even Docker, just bare metal, whatever they're using, it's gonna be instalable in just a few seconds. So that's a big, big plus for us.

Jonathan Hall:

Let's so you you've talked about you described the product. I'm curious, maybe this is one for for Greg. Who should and who shouldn't use this product and why? Like, for for our listeners who are considering, should I go try out Gal? Who should give it a shot and who should should pass because it's not solving their problems?

Speaker 3:

Yeah. I mean, what I've come across multiple times now is like, if you're if you're just using a single agent, you're just a Claude code person and you have no plans of doing anything else. Honestly, like I would say for that, that's all you're doing and, you know, everything's inside of that. You maybe have two to three repos you're working on. You've got a handful of skills you use and nothing else beyond that.

Speaker 3:

You're not trying to go beyond that. Please use Gol. We'd love to get the feedback, but it's not gonna be something where you're going to feel like the super going like, oh, this is amazing. It's helping solve all my problems. Because you're not gonna feel really any problems with that.

Speaker 3:

Cloud Code is gonna be able to easily manage it. But the second you get into that second agent, some kind of an IDE situation there where they're where you're running like, Cloud Code and then codex and then maybe some kind of Gemini thing going on. The second you start doing anything where it's two agents or two machines you're running on, anything where it goes from one to two, immediately that's where you can see the benefit from there. Even if, even if it's exactly the same and you're like, because I've had some argue by the way, I'm the Reddit guy that's posted this stuff on Reddit first. So I get to see everybody's pushback and arguments on this stuff online.

Speaker 3:

And they're like, well, you know, I just use a Git repo and sync on it. And it's like, that's perfect if you're doing something simple, but then what happens the second you wanna change and try a new agent? You know, I it's constantly it's not even the models have become a commodity at this point, but where the big differences come in is like the agents you're using around that, the the ecosystem that you're inside of there. And, they're always leapfrogging, trying something new. I've seen Guillaume alone go from being a a Claude fanboy now to a Codex fanboy.

Speaker 3:

And me going from being a a chat GPT, and I'll be very clear on that chat GPT is how I started all my stuff of copy and paste and then copy and paste back and forth to now being a Claude fanboy. And now I'm probably about to switch over back into to the Codex world. And I mean, with that, it's been whenever I do decide to make that switch, it's gonna be, you know, go all sync and I'm done kind of a thing. It's not a a huge situation for me to make those changes whereas, and I manage, you know, because I joke, I know a lot of developers, but since the rise of AI has allowed me, like I had a bachelor's degree in computer information systems back in the day. So I've always been coding adjacent and knew, you know, no coding principles, no programming principles, no all those kinds of things, but never took the time to just sit down and learn a language.

Speaker 3:

And so what AI has allowed me to do is to be able to code without having to know the code anymore. For that reason, you know, now I'm building out software factories on a home server that's sitting next to me now. And Gol's able to keep all my 26 repos connected with the right skills and the right agents and the right MCP servers all in there. And I'm not having to bounce around to each one and see whether it's right or not. So I the big the at the base level, the if you just wanna try to use it, the individual, the second you go to two for a company, where we're talking about what the the community edition side of it is.

Speaker 3:

Right now, as more and more companies are adopting the idea of agentic software development, it's a wild wild west inside of companies because you get one person that tries this skill, you got another person that creates their own skill, you got somebody that spins up an MCP server, and you have no idea what anybody's doing and how to manage that. And that's the goal we're hoping to help out with that. It's just in the same way before AI was even a thing, the more you standardized and unified how everything's done inside of a coding software development life cycle, the better output you get, the faster things work. Everybody speaks the same kind of, language around those things. And so being able to bring that now into an AI era is one of the hopes we are able to do with this.

Guilluame Moigneu:

I would add two caveats to what Greg just said. If you're not a developer, if you have no idea what gits or YAML file is, don't choose Gal. You're not the target for

Jonathan Hall:

And also the opposite of the show.

Shay Nehmad:

Yeah. Know. Definitely.

Guilluame Moigneu:

But if you're just a business users that just using Cload for like chatting with it, absolutely no use for it.

Shay Nehmad:

Yeah.

Guilluame Moigneu:

The second thing though that I think is really important and I don't trust the big frontier labs right now. Whether that's Entropic, OpenAI, DeepSeek, I don't trust that they're not gonna update their term of use in a way that you will maybe have to change to something else. So having your setup backed up somewhere in a more generic way is always good. Because if tomorrow I want to drop my Entropic subscription to go to whatever else exists, then it's an easy switch. Reinstalling everything and moving from that proprietary format to another proprietary format is a mess.

Guilluame Moigneu:

So I would be wary about that as well. Okay.

Jonathan Hall:

So one of the things you mentioned, Greg, is if you're, if you have two of many things, let's say I have a work laptop and a home laptop and I want to keep some skills in sync. Is Gol the best way to go or is it Git repo the simplest way to solve that particular issue?

Speaker 3:

It will sound dumb, but both and. So that's how I do it is I have a Git repo that I keep track of all the skills that I like and even ones I've built inside of it, but then I use Gol to then sync and then I can put the skills specifically that I want into the repos that I want and it's consistent across the board. So I it's have that one central place where and then on top of that, I don't even have to have that if I have the list of it on there. That's where Miki is genius and how he built that out too of going like, okay, if I if I do this, I just I want it to go here, here, and here, but not here. And then I want it to pull from here, but here, and here, but not here.

Speaker 3:

And then also I wanna run this command whenever I do a sync. And so it pulls and does all this stuff too. So for me, that that's where I would say it's like, yeah, it it doesn't take away from that that repo. You can add that in there. So if you've already been doing that and you wanna start now using Gaul, it's not that you get rid of it.

Speaker 3:

It's now you use Gaul to incorporate that in. And now you just have one YAML file that is keeping everything in track and in sync. So the second you wanna move, you wanna do anything like that. You're not sitting there, okay. Now I've gotta move these over and I gotta sync this and I gotta get pull this and get push that and then, you know, you're just and then I'll wait.

Speaker 3:

Okay. In codecs, I gotta go in here and change that from, you know, agent to this and that. And so it's just all handled in one place.

Jonathan Hall:

Alright. I have a question. Maybe I'll direct this one to, Michael, but anyone's free to answer if someone else has a better or a different take. But I'm curious how you overcome some of the technical difficulties that I can imagine exist. My experience is basically limited to Cloud Code and Open Code.

Jonathan Hall:

I haven't tried Codecs or Gemini for coding yet, but some of the skills and agents and different concepts just don't transfer over because of the different paradigms and the different tools used. How has this affected you and how have you addressed it, if at all? Good question.

Speaker 5:

Actually, it's more generic. We have some way to synchronize, for example, the list of your tool you want to use. We have a specific tool, we have some initiative of some provider to have a generic aspect of the tool. Actually, you need to explain all the tool combining for all agentic system. You don't have a a translation between them.

Speaker 5:

It can be for the future. But, actually, we just you would like to concentrate only on the capability to just clone the scale, keep the scale up to date. We don't have a capability to map a tool for a specific agentic system to another one. So

Jonathan Hall:

it just keeps them in sync is kind of where it all leaves things. So like, I'm trying to remember if I can think of an example. I think for example Claude gives you hooks that OpenCode does not. So, does that just mean that those don't get synchronized into OpenCode? Is that Yeah.

Jonathan Hall:

The

Guilluame Moigneu:

That that's the same example for a skill like for example OpenAI or you to have like 10 font matter different fields that describe the skill and how it should get triggered. But the standard is only two. So if you give us an OpenAI skill that has everything, then we're gonna sync only the two required ones to the other system.

Speaker 3:

That makes sense.

Guilluame Moigneu:

That's kind of the same for MTPs. MTPs is a bit trickier because they're all nearly the same. You have like STD IO, you have like a streamable MCPs. But then the way they're implemented into the different agent change. In OpenAI, it's in their toml config file, in cloud it's a different JSON somewhere.

Guilluame Moigneu:

So we do that translation between the the base command to launch the MCP and the format that the agent expects to be able to launch it. So that's just more mapping than anything else.

Jonathan Hall:

So that's translation, it's more just like mapping and filtering.

Guilluame Moigneu:

Yeah, but that mapping is tricky because like right now we support like 23 different coding agents. And every day there is a new one. This morning was Deepsikarnes, I have no idea if they use standards or not. And you know, that's the famous XKCD drawing, like you have 14 different standards, let's create one that's going to convert them and then you end up with 15. So that's this problem we're also trying to override.

Jonathan Hall:

Yeah. Interesting.

Speaker 3:

It's also one of the reasons like why the open source, right? Because at a certain point this is constantly changing and moving and, you know, where I I was about to say we're three guys working on this. There's two real guys working on this, and then I'm I'm helping him where I can. But like, we've already got our first person that's come in and started contributing with us to help out. They've pushed now two or three branches, I think, or two two or three forks into it.

Speaker 3:

And their main focus is on the the Gemini capabilities and using it there. And so it's really those people that are closest to a particular agent saying like, okay, this I wanna help out with this and make this better for everyone from here on out. So I think right now, like I was looking at some of the numbers before, we're like 43 stars, but, we know from the actual packages, have 120 downloads and over almost close to 900 clones at this point. So the fact that it's growing means that it's the chance of more people being able to come in and be involved and helped out with that base piece of goal there to say like whenever the next new thing comes out that somebody's like, oh, okay, yeah, here, worked it off and here you go.

Guilluame Moigneu:

Just a quick shout out to that company which is Positron AI. They are building like amazing data center grade like GPU cluster and stuff like this. So we're really happy they're contributing. If they have like a few prototypes on end that they could send to us, I'm happy to receive one.

Jonathan Hall:

Yeah, yeah, yeah. Where do you hope to go with Gala in the next say three to six months? Any major features you're thinking of adding or is it just polishing and improving the mapping or what do you have in the roadmap?

Guilluame Moigneu:

There are few different things. There is the technical part, the pure product part and there are the more the commercial and how do we support the project. So we're launching a first beta offering for Registry 42 over the weekend, which is targeted at people that really don't understand the technical side and just want something really easy to use, they can maintain their skill at JensenD and then just ask their agent to install it. And that's gonna be compatible with GAL but that's just a quick way to have some funds to be able to fund GAL afterwards. The three to six months roadmap right now is be able to fully have the community edition working and deployed into some customers.

Guilluame Moigneu:

We have already a lot of discussion around that. So that will be completely free. So if you're willing to talk to us and beta test it and stuff, you're welcome to. And then yeah, keep getting better. We have a few optimization even if Go is really good at like fire system operation and stuff like this because we have to scan the fire system and the different projects.

Guilluame Moigneu:

We we are still working on optimizing this, because it takes a bit of time right now which could be better and a bit of resources. So yeah, there are both the technical upgrades to the product, more stability, trying also to figure out where the ecosystem is going with all the different tools and stuff. MCP is evolving right now, skills as well. So we need to follow that and making sure everything stays compatible with it. And yeah, try trying to start more the obviously the funding of the project side of it.

Jonathan Hall:

Yeah, yeah, very cool.

Guilluame Moigneu:

The the ideal and once again I don't know about this but a year from now being like a product that work on its own is sustainable that we can actually provide in the long term and start maybe hiring one or two people to work on it, yes.

Jonathan Hall:

Greg, I'm curious if you want to talk a little bit about how community outreach or community response has been. You talked about getting some pushback on Reddit. We're all too familiar with that. Has there been good feedback too?

Speaker 3:

Yeah, I was gonna say, yeah, anybody that's been on Reddit knows like, I think there's some people that that's they find their whole identity as being a troll on there. So it's just, it's funny. And yeah, so right now the main thing we've been doing is honestly, it's just kind of starting with Reddit, some stuff on some other socials, but honestly, Reddit's where we've gotten the most traction. It's funny because my day job is doing product marketing for a tech company where everything's like paid for as far as marketing's concerned. And it's not an open source product.

Speaker 3:

So it's been funny because it's nice to be on Reddit and I can just talk about something and not have to worry about them going like, oh, you're just trying to make money off this. It's like, well, not from you. So it's interesting and seeing where it takes off and where things have connection with it and seeing some people that resonate with it. And then, you know, the stuff I was mentioning earlier about like, if you have one computer and one, you know, Git repo you're working on, like it's not for you. Those are the funny Those are the people that pipe up the most.

Speaker 3:

They're like, I just use async and Git repo. And it's like, cool, that works for you. Then this isn't But the product for then you get the few people that hop in there and go like, oh my gosh, I was just talking about this with my friend and this is a big issue that we've been running into. And it's nice to see that there's a tool out there. I'll try it out.

Speaker 3:

I think the thing I haven't seen yet is that I would like to at some point, and we've talked about At least I've thought about this or talked about this is, you know, do we set up like a Discord server, which I've done with past projects before where I think it gets really interesting very quickly where you have like 2,000 people on a Discord server and, you know, five of them are the actual people talking. So then it becomes like I'm managing all this for a small amount of feedback. I've thought about, do we do a subreddit? Do we do any of those things? For now, honestly, the community has been building is honestly on the GitHub page.

Speaker 3:

So just, you know, github.com/gitgall, I think, or is yeah. It's gitgall, not gall. At one point it was gall, but now it's git gall for that on there. But, just seeing it there because in all honesty, like it's a it's a product for developers and built by developers. So therefore, like the it will we listen and wanna be where it's at.

Speaker 3:

So even, you know, Positron, we found out about that because we saw somebody made a fork, but then we were like reached out

Guilluame Moigneu:

and said, hey, what are you doing

Speaker 3:

with this? And he's like, oh yeah, I needed it because, I guess Gemini like got rid of their CLI. So he was like, oh, I needed to switch it over to this. And so I forked it. I was like, do you wanna send it back?

Speaker 3:

You know, push it. And he's like, can I? I was like, yeah, man. Like just having these conversations around it. So, from a community aspect, it's interesting and seeing that that it's, we can see the number of people kind of using it, but now trying to find those people to have the conversations to say like, hey, how do we make this better?

Speaker 3:

Getting the feedback as far as like filling out issues or filling out, any kind of comments around things. Because we have a long list of issues in there ready to work on at a certain time. It's just prioritization and getting to it is where it plays out. Of course. Yeah.

Jonathan Hall:

Of course.

Guilluame Moigneu:

What we're missing a bit right now is feedback on agents we don't use ourselves because there are so many, like kilo, kilo, all the other ones. So yeah, any contribution there is welcome. It's more like testing because we follow their documentation, we follow their implementation, but we can't guarantee that everything is working perfectly until we have actually people testing it. So yeah. Right.

Speaker 3:

Yeah. And having been a guy that's over documentation, surprise, surprise, not all documentation is up to date or right?

Jonathan Hall:

Just tell your agent to write the documentation. That's all it takes, right?

Speaker 3:

Yeah. Sure. Yeah. That's hoping your agent gets it right too and that you catch it. But yeah, that's that's the other part of it is so we're basing it off of what we've been told, but we all know that until you get your hands on it and get it into the wild, you don't know if it's actually gonna work, work in those situations.

Jonathan Hall:

Well, think that's a great segue into, talking about how our listeners can get involved or first off, how they can download it. Where do they go to get it? You mentioned the GitHub. Is that the best place to go or is there an official website?

Speaker 3:

Official website is getgall.com and that's GAL, G A A L. Honestly, like we call it gall, but I've heard people call it, gail and gal. I I joke it.

Guilluame Moigneu:

We we need to get into that because, I've listened to the original podcast and I know you struggle with it. So Mihai and I are a big fan of Izai Tassimov and the foundation TV show and the book series. And Gal is actually one of the the before between all those different universe and different things. So that's why we call it that way. It's also work as governed or go agent access layer, whatever that means.

Guilluame Moigneu:

But yeah, we wanted to keep that. Our internal agents are all named after the show as well. So yeah, that's the reason we named it that way.

Jonathan Hall:

Okay, very good. So getgall.com and if anybody's interested in reaching out or following any of you on social media, I don't wanna put you on the spot, if any of you don't have a presence or don't want followers, that's cool. But then you could do, now's your chance to tell our listeners.

Guilluame Moigneu:

No, no, yeah, we can add the Mihai Ting, Dean and X and Greg as well. We're all trying to expand also our audience, posting a lot of content about AI, not just Gal obviously, but AI as a whole. I'm more working personally on the on the processes and workflows around AI agents. So how can you like move from just a single agent from a single user to a team oriented agents like this. So that's a problematic I work on day to day.

Guilluame Moigneu:

So posting a lot of content around this as well. Cool.

Speaker 3:

Yeah. I'm I'm I'm pretty easy everywhere. I'm Greg Qualls. So at Greg Qualls on all social media, a website, gregqualls.com. And for those that don't wanna go read it, it's GREGQUALLS.

Speaker 3:

So that's how that works. And I I write about all different things. But yeah, I Okay. On the Great Qualls one, I I have on there my main AI projects that I'm working on as well. So if anybody wanna poke in there and see the things I've worked on with Gol being one of the top of the list, you can see that too.

Speaker 5:

Okay. On my side, I'm sorry. I'm on the web browser on GitHub. Okay.

Shay Nehmad:

Perfect.

Guilluame Moigneu:

He's the shadow engineer. Yeah. Doesn't want to go in the spotlight.

Jonathan Hall:

Awesome. Well, if you can all send me those links by email after the recording, I'll be sure to include those in the show notes for our listeners to, to follow-up on. One last question I mentioned before we started recording, we asked all of our guests this and the answers could be broad. So like Greg, I know you're not directly a developer, you just know some. So I'll give you a lot of leeway on this question.

Jonathan Hall:

But the question for each of you is what's your favorite third party Go tool or library? And let's say Goal is not an option to answer since we've already talked about that. We'll just assume that's your number one or go for your number two.

Speaker 5:

I can start if you want. Yes. For me, it's PFLAG because when you create any application on Go, we

Jonathan Hall:

need them. Yeah. Okay. Good answer.

Guilluame Moigneu:

For me, this package is Go feature flag. It's also French guy, Thomas, which I know by the ecosystem. But basically, well, title is pretty easy. It's be able to enable disable features based on flags in your application. And that package, like, is really solid.

Guilluame Moigneu:

Quality is insane. The amount of work that has gone into it is really, really good. So if you ever need that feature, that's the package to go with.

Jonathan Hall:

Go feature file. Awesome. I'll have to check that out.

Speaker 3:

Cool. And mine, does not exist anymore, but it was actually a custom Go CLI tool that I vibe coded at one point to convert our, documentations from Hugo, to another situation. So like, that's the only thing I could pull in the recesses of my brain of like that I knew that I'm involved with Go at another point. All right. Other than Gol.

Speaker 3:

I was like sitting there, I was like, oh, I'm gonna be like, Gol, that's easy.

Guilluame Moigneu:

And then

Speaker 3:

I took that with him. So yeah.

Jonathan Hall:

Awesome. Well, hi. Thanks everybody for coming on and talking about Gol. I'm sure we'll have you you'll have a few more followers after this, interview and the users hopefully get some more feedback. So I want to thank you all for coming on and, yeah.

Guilluame Moigneu:

Thank you, Jonathan.