Rez Moss

Too many events, little retention, learn t K8s event pain, read my article 👇

what are your fav Go packages I’m looking to sponsor 10 repos that have sponsorships open

Beyond Vulnerability Scanning, How SBOM Diff Exposes Shadow Dependencies in Your Supply Chain ( Go tool )

Do you remember when you joined X? I do! #MyXAnniversary

been digging into Bottlerocket os internals lately, small system but packed with big ideas

A high-performance Go package for detecting disposable/temporary email addresses

@PinkDraconian think of it like more id & quota management so its easier to control abuse

I still don't understand Google Maps API keys. If you're showing a map on your website, the API key is in your client-side code. An attacker can use this API key to send millions of requests and you're paying for it. There's no way to secure it?

@davidasinclair built this for myself, you might like it chromewebstore.google.com/detail/ora-new…

Just installed this. Great reminder!

@func25 mmap is fast ,until it isnt

mmap in Go is not always faster I/O like most people think. It performs blocking disk access that the runtime CAN'T see, and it can actually stall your entire application/process Go runs many goroutines on a small, fixed number of OS threads, controlled by GOMAXPROCS, right? When a goroutine does a known blocking operation like read() or pread(), the runtime knows it's entering a syscall. It marks that thread as blocked and can start another OS thread so other goroutines keep running. But with mmap(), this is a different story. mmap maps a file directly into your process's memory, so you can read or write the file by accessing it like a byte slice instead of calling read() or write(). The OS loads pages from disk on demand via page faults whenever you touch parts that aren't already in RAM. The only (big) problem is this: --- "a page fault is invisible to Go." --- What does this mean? A page fault turns a simple memory access into long blocking I/O, but Go treats it like CPU work. Go does not mark the goroutine as being in a blocking syscall state for that, because there is no syscall entry point involved: - mmap is a syscall when you create the mapping, which is fine; that part is visible to Go. - What's invisible is when you read or write bytes through the already-mapped memory. That access is just a normal CPU load or store instruction. So the OS thread can block in the kernel while still "owning" the processor, and the Go scheduler cannot do the usual handoff it does for known blocking syscalls (e.g., read(), pread()). Net effect: you can get hidden stalls and reduced parallelism, especially if enough running goroutines hit major faults at the same time (or if GOMAXPROCS=1).

Fast cloud provider IP detection for Go

@david_nix net

Question for the builders: If you have a .net and .org of the same name. (No .com) Which one should be your main domain? Which one shows the most trust?

@david_nix 😂

Friends don't let friends vibe security

@GergelyOrosz added to my watch list must be super interesting

How is the world's largest storage system, AWS S3 built? I found the best person to talk about this: Mai-Lan Tomsen Bukovec, who has been heading up S3 for 13 years (!) S3's scale is something else (tens of millions of hard drives, eleven 9s of durability (!!) and heavy usage of formal methods, microservices dedicated to durability, amongst others.) Watch or listen: • YouTube: youtu.be/5vL6aCvgQXU • Spotify: open.spotify.com/episode/5iWI2d… • Apple: podcasts.apple.com/us/podcast/how… Brought to you by: • @statsig — ⁠ The unified platform for flags, analytics, experiments, and more. statsig.com/pragmatic • @SonarSource – The makers of SonarQube, the industry standard for automated code review. sonarsource.com/pragmatic/?utm… Check out their latest State of Code Developer Survey report: sonarsource.com/pragmatic/deve… • @WorkOS – Everything you need to make your app enterprise ready. workos.com

A high-performance Go package for detecting disposable/temporary email addresses github.com/rezmoss/go-is-…

Year progress: 3.0%

How to Compare Container SBOMs and Detect Drift Between Image Versions rezmoss.com/blog/compare-c…

SBOM analysis & diff tool for software supply-chain security, integrity drift detection, and CI/CD enforcement github.com/rezmoss/sbomly…

@david_nix smart, so the destination page is the landing page with the form ?

Validate before building

Building a Network Vulnerability Scanner with Go 👇

How to Build a Smart HomeKit Virtual Light in Go 👇

@SumitM_X kinda feels like that payload is more about storage than a regular api, so parsing and processing makes sense as next step

Your API needs to process huge JSON payloads (5–20 MB) from clients. How do you design it so parsing alone doesn’t choke your CPU?