Does widespread browser implementation of the Sec-Fetch-Site HTTP header mean we can protect against CSRF attacks without needing those hidden form tokens? It looks like the answer may be a cautious "yes"! simonwillison.net/2025/Oct/15/...

Nice writeup :) anto.pt/articles/go-...

Go on bare metal and no os-specific code, would love for this to be accepted. github.com/golang/go/is...

I think I found an excellent use for vibe coding. If you're writing complex code with many branches, nuances or that processes untrusted inputs, you should really invest time fuzzing it. The problem with fuzzing is that it yields the best results when you can write strong assertions on the results

And it's in Go! devblogs.microsoft.com/typescript/t...

I reckon we will soon see a growing demand for software engineers that can (and do) work without LLM assistance.

My talk on accepting complex inputs with simple code is out 😊 Thanks @golab.io for the amazing conference! youtu.be/Z11suX8ubGo?...

I'd love to see this implemented: github.com/golang/go/is...

After 6 years, last night I resumed writing about concurrency. Here is how to implement a chan with unlimited buffer in Go: blogtitle.github.io/go-advanced-...

One of the best tools I've seen to convert between various encodings. Thanks @miki.it for suggesting it. gchq.github.io/CyberChef/

I swear I didn't turn into an endorsement bot, but I found another yt channel to suggest, especially for new devs: youtube.com/@devtoolsmad...

I've been following the "chrome for developers" advent calendar lately and I'm very impressed at how much the web platform has evolved in the past few years. Strongly advise: youtube.com/@chromedevs?...

They found a full accounts.google.com compromise to get my password 🔑 That was quite the overkill, but helped fix a very scary bug. bughunters.google.com/blog/6355265...

Happy to publish the effort of my last five years: Security Signals. research.google/pubs/securit...

I remember it took me months to do what should have taken days while I was at Google due to red tape and sledge hammer approaches for every single choice one could make. People got promoted for putting those in place. Setting the right metrics in performance evaluation should be the first step.

I am considering creating a web security (defense) playbook for developers, can anybody suggest some good web security guides/blog posts that are already available? Everything I've found is lacking at best. My target audience would be devs.

testing/synctest just hit master for #golang 1.24 😭🎉 go-review.googlesource.com/c/go/+/629735 A godsend for anyone writing integration tests. I am definitely not rushing to update my slides for "What's coming in Go 1.24" at London Gophers in... two hours 😱

Should the Go iter package (or a sub package) expose functions like Map or Filter?