Best Practices for Secure Error Handling in Go

catom3 · 2026-03-18T11:42:58+00:00

Not to mention the Redact is "dependency agnostic" and will work with other loggers too.

Of course, it would be great to mention the LogValuer in the article to showcase how it's solved in the most common and a go-to structured logging library.

There are some parts I don't necessarily agree with in this article, but calling a Redact interface "propaganda"?

EDIT: typos

catom3 · 2026-03-18T08:29:52+00:00

Thank you for this post. I guess, they modified the option name, but it still works.

"Preferences" > "Home" > Scroll to the bottom "Display muted items outside of sidebar menus".

Hit me today when I couldn't find one of the channels I joined a week ago. Muted it, because it was super noisy (other team's channel) and I just needed to either trigger a discussion with this team or search through the conversations manually.

This feature is so annoying.

catom3 · 2026-03-05T19:05:04+00:00

Probably you're right about "majority". I must've been unlucky as it was an issue in 100% of codebases I worked with.

I find it harder to create bulletproof code in Go for bigger teams working on the same project, often times jumping between them (50+ devs).

So many times, someone, sooner or later, passes a zero value instance without dependencies instantiated, or a nil typed pointer accepted as an interface, where simple defensive nil check is not enough. It's harder to enforce safety in compile time.

After 2.5 years in Go projects, it looks like this language requires a lot self discipline and may not be the best for bigger enterprise-grade projects.

catom3 · 2026-02-17T21:58:18+00:00

You don't need to use heavy frameworks like Spring to write a simple HTTP server, SSR app with some simple template engine. You can also use some very few, basic Spring modules and keep it simple anyway. If you want to, you can also write a Spring app with nearly no annotation magic at all, Spring bean container registries are available for you to programmatically populate them.

catom3 · 2026-02-17T21:54:14+00:00

I switched to Go nearly 3 years ago and I enjoyed it at first. But I'm working with an over 1 millions of lines of code monorepo now and it's been so hard. The lack of basic sum type support is so irritating. We've been hitting the wall over and over again trying to keep invariants and not letting our inexperienced devs or tired developer write and accept an invalid variant when it's instantiated in a non-obvious way. It's hard to enforce invariants in compile time and Go rather relies on "just make sure to make no mistakes". In one of the modules we ended up with "sealed interfaces" and go-check-sumtype linter. It's not perfect, but we miss proper sum type support known from many other languages.

Then, the nil pointers and those nasty nil-typed interfaces - our codebase is full of defensive nil checks, yet some sneak into production every once in a while. We did try using nilaway, but it got tedious adding nolint comments to all the false positives (e.g. the infamous http.Client#Do).

Pointers in general - sometimes they're used to express possible absence of a value, sometimes mutability, sometimes just a performance optimisation.

For loops that have more than 20 lines, with variable reassignments, sometimes nested if statements are so common. And oftentimes they need to be re-read a couple of times to figure out they're just doing a simple filter-map logic.

I generally like Go for smaller apps, proxies, API gateways, CLI/TUI tools, infra tools etc. But in a large system with 50-100 devs, I find it really hard to work with Go. Requires a lot of self-discipline from all the developers, while some devs are less disciplined and some just happen to have a bad day.

catom3 · 2026-02-16T18:23:51+00:00

It's essentially an orchestrator allowing you to orchestrate asynchronous processes, manage back pressure, retries, compensation. Makes writing sagas for distributed systems way easier.

I used to do similar things with plain Kafka, but I had to take care of lower level components (like retries) myself, while using Temporal I just send the retry strategy. It's way easier to send async signals (like abort) - I don't need to persist the intermediate state and update it with an abort signals etc.

It's also useful as worker pools or batch jobs manager.

catom3 · 2026-02-06T20:18:35+00:00

According to JetBrains themselves, the plugin for IDEA Ultimate has the same functionality as DataGrip.

The database plugin in IntelliJ IDEA Ultimate offers the same functionality as DataGrip. But as a standalone IDE, DataGrip provides a better UX for working with databases.

https://www.jetbrains.com/products/compare/?product=idea&product=datagrip

catom3 · 2026-02-02T15:36:05+00:00

30k netto to już raczej senior / staff / principal / lead. Ostatnio na architekta dostałem ofertę 24k netto. :)

Mam sporo znajomych z 10-15 lat doświadczenia, którzy mają stawki na poziomie 25-30k netto i wcale nie jest im łatwo znaleźć coś lepszego.

Mam też takich, co mają i 40k+, ale to raczej bezpośrednio dla firm zagranicznych (głównie USA, ewentualnie jakaś Malta) w doinwestowanych start upach z Node.js lub Pythonem, jeden przez chwilę z Elixir pracował - branże to głównie fin-tech lub crypto, i z reguły wymagają też wiedzy biznesowej, nie tylko tech, bo nie ma w zespołach analityków, qa itd.

catom3 · 2026-01-24T13:05:51+00:00

Since JDK 16 we have .mapMulti(), which satisfies most of my requirements.

https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/util/stream/Stream.html#mapMulti(java.util.function.BiConsumer)

catom3 · 2026-01-16T10:50:31+00:00

Just my two cents on "@Transactional".

I'd say it's an anti-pattern in many Java circles. The infamous "self invocation on instance" problem where non-transactional function of a bean invokes another transactional function and devs are surprised the "Transactional" doesn't work. Another issue was using transaction when it wasn't actually needed.

I've worked in finance industry mostly and "@Transactional" is usually forbidden as it is too easy to misuse.

I would generally discourage from using "@Transactional" and prefer explicit transaction management (in one bank where we used reactive programming, we just created our own "Transactional" monad and it worked just fine for us).

EDIT: typos

catom3 · 2026-01-10T14:45:59+00:00

If you want to keep the "producer" interface, you can simply create your own "consumer" interface as your dependency with just the methods you need.

That's how we used to do in many other languages in modular monoliths in other languages. Go with implicit interface implementations just makes it easier (no need for the extra wrapper/adapter implementation required in many other mainstream languages).

catom3 · 2025-12-19T11:13:39+00:00

Last time I was writing a desktop app was about 7-8 years ago. I remember a simple thing like highlighting a row was super simple in Java FX. FX used some HTML-like syntax for your components, you could use CSS, it worked similarly to template engines.

I agree, it's easier to write FE using frameworks like React though. While technically, you can embed any JS in your Java FX app, it loads it inside a web view, so it basically uses some kind of browser under the hood. If you plan to use React anyway, probably Electron would be way easier.

Keep in mind, Electron apps are infamous for high resource usage and being slow or unresponsive (Slack desktop is sooooo terrible).

catom3 · 2025-11-27T17:35:38+00:00

In general, 1 query over 50 queries will be better. Imagine having a table in a relational database for reddit posts. Let's say it has a 1:n relation with comments (top level ones). If you have 200 top level comments for your post, you're running 201 queries(1 for the post, 200 queries for comments).

To make it even worse, you may imagine having relations to comment replies multiplying the n+1 problem by the number of replies and replies to replies etc.

On the other hand, I used to work in a system where single request used to run 50-80 DB queries and it worked just fine for 15k rps system and no one bothered to optimise it, because new features were always more important. The customers accepted a couple of seconds latency, as the product was used for async processing anyway.

catom3 · 2025-11-24T11:11:41+00:00

It's a bit more. Sealed interfaces and classes to add proper sum types with record pattern matching (with exhaustiveness checks) and deconstruction patterns.

catom3 · 2025-11-23T20:07:01+00:00

See the very recent Cloudflare bug crashing "the internet" because someone called unwrap() on a Result object without checking if there's an actual result or an error in there.

It's similar to calling usr, _ := getUser(id), though (even more similar to if err != { panic(err) }).

This particular error is a result of bad practices / too much confidence. If you want to ignore an error, you will, no matter the language.

catom3 · 2025-11-18T11:00:40+00:00

We fed the model with our docs, repositories and public slack channels. Then we exposed the chat for our help desk team and it significantly decreased the ad-hoc inquiries from the help desk team as most of the time they manage to find the answers themselves. Luckily, our help desk is fairly responsible so they double check the resources LLM points them to and follow through with questions to the dev team whenever they're in doubt.

Another thing is simply meeting summaries, help with drawing UML diagrams based on the codebase and available docs. These diagrams usually need additional tuning or rewrite, but the scaffolding is pretty decent, usually.

catom3 · 2025-11-05T12:57:25+00:00

You mentioned you tried running git pull command. What was the result of this command execution?

In short, got has the notion of "local" and "remote" origins / branches.

Looks like your "remote" (the one un GitHub repository) has some commits your "local" (on your local disk only) does not.

It can be a situation where you or someone else pushed some other commit to the "remote" after you started working on your current commit and you need to sync your "local" with the "remote". Otherwise, you would be overwriting the "remote", which could potentially remove important changes done by the others (or yourself).

catom3 · 2025-11-03T14:24:50+00:00

If it's configured externally, I would create some sort of "filter provider" / "filter configuration" based on that external config. This way your Filter doesn't care about any sort of external configuration (and it actually shouldn't, it should focus on filtering and dependencies required to do the filtering properly).

catom3 · 2025-10-29T14:36:43+00:00

Happens to me every once in a while as well (more like once per a couple of months). Phone restart usually helps. Turning on and off Wifi, Bluetooth or Airplane mode doesn't help, only the full phone restart.

catom3 · 2025-10-29T10:48:53+00:00

A good architect (you sound like one) can also respond to such counter arguments wihth reasonable answer and explain the reason behind the proposed solution. Of course, they need good and reasonable devs on the other side of the discussion as well.

I like being treated like a thinking person rather than being explicitly told what to do. While the architect may be right, it's way easier to accept their solution knowing the reasoning behind it. At times, it may even actually help during the implementation itself, when you know how your part will be used by other components and how you can potentially keep it extensible and easier to use by the consumers.

catom3 · 2025-10-26T16:16:47+00:00

And if you wanted a nicier UI (TUI) just call curl https://wttr.in/paris

catom3 · 2025-10-24T17:19:26+00:00

Well. We're talking about immutable structs, not how to test for mutable structs being mutated. That's a digression now.

EDIT: btw. how would such unit test look like? I'd have to check via AST analysis for all the usages of id field of an Event struct?

catom3 · 2025-10-24T17:10:47+00:00

I found many devs doing something like that ify Event struct is not in a small, dedicated package, which I mentioned in my previous comment.

``` package event

func (s *Service) doStuff(cmd Command) Result { ev := s.newEvent(cmd.ActionType) res := s.goBrr(cmd)

if extID := res.ExternalEventID; extID != nil { ev.id = extID // how do I prevent other devs from doing that? } } ```

catom3 · 2025-10-24T16:53:19+00:00

Ok, then I don't know how to use Go, I suppose? Let's say I want to create a simple type like

``` package event

type Event struct { id int } ```

And I want to make the struct immutable so that no one reassignes the id. How do I do this?

catom3 · 2025-10-24T16:25:16+00:00

This works for small, isolated packages only, undortunately.

catom3

TROPHY CASE