--- title: "A Go security issue explained in depth" publication: "Go Weekly" issue: 346 published_at: "2021-01-22" canonical_url: "https://golangweekly.com/issues/346" --- Plus AWS SDK for Go v2 and a fast programming language detection library. | #346 — January 22, 2021 [Unsubscribe](https://golangweekly.com/leave/*|UID|*)|[Read on the Web](https://golangweekly.com/issues/346) Go Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/v1611270192/be4miiytidekyuyege4f.jpg)](https://groups.google.com/g/golang-announce/c/mperVMGa98w) Illustration by [Ekaterina Stanchenko](https://www.shutterstock.com/g/Matika.by) [Go 1.15.7 and 1.14.14 Released](https://groups.google.com/g/golang-announce/c/mperVMGa98w) — _(Requires Google login.)_ Two new releases to primarily fix two reported security issues around arbitrary code execution (covered in more depth in the item below) and [an error](https://github.com/golang/go/issues/43786) in `crypto/elliptic`. Downloads [here](https://golang.org/dl/). Roland Shoemaker [Command PATH Security in Go](https://blog.golang.org/path-security) — Go 1.15.7 and Go 1.14.14 address a arbitrary code execution bug that can occur around `go get` and other commands that build code. This bug is significant enough to get a full write up with where it came from and ways to improve the situation. Russ Cox [![\](https://copm.s3.amazonaws.com/93dadefc.png)](https://dashboard.redisgreen.net/goweekly) [Secure Redis Hosting with RedisGreen](https://dashboard.redisgreen.net/goweekly) — SSL encryption, key size tracking, memory mapping, online upgrades, and more. RedisGreen sponsor [AWS SDK for Go Version 2 Now Generally Available](https://aws.amazon.com/blogs/developer/aws-sdk-for-go-version-2-general-availability/) — There’s a lot to like in version 2, including modularized clients per service, better config and pagination, and performance improvements. Requires Go 1.15 or higher. Shantanu Kotambkar (AWS) [Go's `ioutil` Package to Be Deprecated in 1.16](https://www.srcbeat.com/2021/01/golang-ioutil-deprecated/) — Most of the useful functions in this package (called a “_poorly defined and hard to understand collection of things_” [by Russ Cox](https://github.com/golang/go/issues/42026)) have been moved to `io` and `os`, so this is really just clean up. Oliver Lowe 📘 Tutorials and Stories [Packages as Layers, Not Groups](https://www.gobeyond.dev/packages-as-layers/) — Looking at your packages as layers is a step toward a hexagonal architecture and can clean up your code structure significantly. Ben Johnson [How to Debug Go-Powered AWS Lambda Functions with Gebug](https://moshe-beladev-mb.medium.com/debug-aws-lambda-functions-with-gebug-bc643788c247) — Go is a fantastic language for serverless use cases but local debugging can be a pain point. Here are some pointers that involve [Gebug](https://github.com/moshebe/gebug), a tool for debugging Dockerized Go apps. Moshe Beladev [Non-Blocking Parallelism for Services in Go](http://www.goldsborough.me/go/2020/12/06/12-24-24-non-blocking_parallelism_for_services_in_go/) — Dubbed “The Tickler Pattern”, it’s a way to handle a queue using channels and semaphores that isn’t too complicated and won’t block the client adding work to the queue. Peter Goldsborough [Cheerful, Collaborative Project Management](https://clubhouse.io/?utm_source=cooperGO&utm_medium=spon_nl) — Some PM tools are too simple. Others, unwieldy and unpleasant. Clubhouse is nothing but good adjectives. [Give us a try](https://clubhouse.io/?utm_source=cooperGO&utm_medium=spon_nl). Clubhouse.io sponsor ▶[Go Pointers Explained, Once and for All](https://www.youtube.com/watch?v=sTFJtxJXkaY) — A simple, practical introduction to pointers in a 14-minute screencast covering their use in implementing stacks and heaps. Junmin Lee [Errors vs. Exceptions in Go and C++ in 2020](https://dr-knz.net/go-errors-vs-exceptions-2020.html) — Subtitled “Why and how exceptions are still better for performance, even in Go”, this is a return to a study done in 2018 and the conclusions are consistent. Raphael ‘kena’ Poss [But How, Exactly, Do Databases Use `mmap`?](https://brunocalza.me/but-how-exactly-databases-use-mmap/) — A look through the BoltDB source code to understand how memory mapping can work in a database system. [BoltDB](https://github.com/boltdb/bolt), by the way, is a Go-powered key/value story inspired by LMDB. Bruno Calza 🛠 Code & Tools [go-enry: A Faster File Programming Language Detector](https://github.com/go-enry/go-enry) — When they say ‘faster’, they’re comparing to the Ruby-powered [Linguist](https://github.com/github/linguist), as used by GitHub for its repo language detection. go-enry [Goridge: A High-Performance PHP-to-Go IPC Bridge](https://github.com/spiral/goridge) — Using native sockets in PHP and `net/rpc` in Go, this lets you call Go methods from PHP, if you so require. Spiral Scout [Dragonboat 3.3: A High Performance Multi-Group Raft Library](https://github.com/lni/dragonboat) — Consensus algorithms (such as Raft) provide fault-tolerance by allowing a system to continue to operate as long as a majority of member servers are available. Here’s [what’s new](https://github.com/lni/dragonboat/blob/master/CHANGELOG.md) in 3.3. lni [Video for Your Go App That Streams Beautifully, Everywhere](https://get.mux.com/3oBOZVP) Mux sponsor [BFE: A Modern Layer 7 Load Balancer From Baidu](https://github.com/bfenetworks/bfe) — Baidu operates a popular Chinese search engine so they’re used to working at scale. Baidu [wuzz: Interactive CLI Tool for HTTP Inspection](https://github.com/asciimoo/wuzz) — Think `curl` but with a text UI to show off request and response headers, manage params, etc. Adam Tauber 💻 Jobs [Senior Software Engineer (Go) - 100% Remote, UK/EU Only](https://www.form3.tech/careers/job-application?gh_jid=4003519002) — Solving complex technical challenges using the latest, cloud-native technologies to help Banks and FinTechs move money faster. Form3 [Find a Job Through Hired](https://hired.com/join/?utm_source=newsletter&utm_medium=sponsor&utm_campaign=%28b2c%29%28l-all%29%28r-all%29%28cooper-golangweekly%29&utm_content=find-your-next-job) — Create a profile on Hired to connect with hiring managers at growing startups and Fortune 500 companies. It's free for job-seekers. Hired 🥇 A Golden Oldie Revisited [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/qtx11jcurnnzcrufi4b4.jpg)](https://github.com/muesli/termenv) [termenv: Advanced ANSI Style and Color Support for Terminal Apps](https://github.com/muesli/termenv) — Offers convenient methods to colorize and style output, without needing to deal with weird ANSI escape sequences and color conversions. Christian Muehlhaeuser Curated by [Glenn Goodrich](https://twitter.com/ruprict) and [Peter Cooper](https://twitter.com/peterc). [Change your email address](https://golangweekly.com/edit_subscription/*|UID|*) or[Stop getting this newsletter](https://golangweekly.com/leave/*|UID|*) © Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom