Go Analysis Framework: modular static analysis by go team
Posted by AbuAssar 1 day ago
Comments
Comment by b7e7d855b448 1 day ago
I love the error handling, I love the forced formatting, i love all the linting it has including style guides. When you read other source code it's so easy to understand it and make sense of it. Thank you go team
(Ok, maybe I am a bit sceptical with the latest generic additions, but overall it's a great language. I love it.)
Comment by wannabe44 1 day ago
found := false
for _, v := range s {
if v == needle {
found = true
break
}
}
Oh and I totally want to build a stack trace manually. It's like doing cardio to me. if err != nil {
return fmt.Errorf("my function name but in spaces: %w", err);
}
This is very elegant by the way, so that we need errors.Is now, which has to dynamically check if the error implements Unwrap() error or Unwrap() []error. Because having any language facilities for error handling is harmful.Comment by bayindirh 23 hours ago
No, making error handling verbose mandatory is meant to make developers do mental cardio and be mindful of what they are doing.
You can either keep developers mindful or punish them after they make a mistake by shouting at them and make them waste their time during re-compiling.
P.S.: Yes, I love Go's error handling mechanics, which makes handling errors mandatory, not optional, and if you ignore the error, this is a deliberate choice and the burden is on the developer. Go does the former, Rust does the latter.
Comment by KronisLV 6 hours ago
Unpopular take, but I personally also believe that unchecked exceptions in Java and other languages like that are an issue - because it makes too easy to miss where things could go wrong, instead of making you visibly handle the potential known failure points, or indicate to callers what you're not handling.
Comment by sapiogram 23 hours ago
Rust bakes this into the type system, a function can truly return a result or an error.
Comment by wannabe44 18 hours ago
The problem is painstakingly and manually having to build the stack trace, and then unwrapping it few layers above if you ever need to check what error it was.
Comment by bayindirh 13 hours ago
I have written a fresh example at https://files.bayindirh.io/misc/error_example.go. Give it a Go. ;)
OTOH, gopls is a great LSP, though, and it warns you about this immediately.
Comment by comex 13 hours ago
Comment by bayindirh 12 hours ago
Considering some expensive Go calls do the same caching underneath, this is the preferred design pattern, I assume.
Comment by wannabe44 7 hours ago
Comment by tomhp 21 hours ago
Comment by bayindirh 22 hours ago
So, you handle the error in the end, or forcefully and intentionally ignore it. Again, if the code goes boom, it's on the developer, not on Go.
> Rust bakes this into the type system, a function can truly return a result or an error.
Error being a variable or baked into the type system doesn't change the practical result. You must handle the error or purposefully ignore it.
> only Rust actually forces you to handle errors.
When you have two programming languages which makes you handle the error, the word only becomes a little invalid.
Semantics doesn't change the result. You have to acknowledge and act on the error either way.
Comment by madeofpalk 19 hours ago
Except Go doesn’t actually require you to handle the error. You can forget to handle the error, or forget to do a nil check. And Go won’t tell you until it crashes and explodes at runtime.
Technically the user’s fault, but good systems protect the users from their own mistakes.
Comment by bborud 9 hours ago
But as someone else pointed out, unhandled errors are very rare in practice in Go because every Go project tends to use static code analysis tools that catches this. When people talking about things blowing up during runtime I can’t help but think that they can’t be serious Go users.
On every build I generally run vet, lint (revive), staticcheck, gosec and test. And that’s the “light” build that doesn’t run leak analysis, fuzzing, race testing, benchmark regression and integration tests in addition. The light build is still faster than the Rust compiler. I haven’t compared the heavier build.
When people pretend the absence of features is a huge problem, I tend to think that these are people who either aren’t regular Go users or perhaps they are more interested in debating languages than writing code.
Let’s not pretend this is something it isn’t.
Comment by madeofpalk 9 hours ago
The fact that external tools exist that "every Go project tends to use" to fill common a gap in the type system indicates to me that maybe the language itself could be improved.
Comment by bborud 6 hours ago
Look at exceptions in Java, for instance. In theory the mechanism is there to guarantee that errors will be handled. In practice there are multiple schools of thought — several of which purposefully circumvent this mechanism by throwing runtime exceptions because they think checked exceptions just leads to a lot of unnecessary work.
It has been too long since I used Java to remember all the arguments for and against. But I do remember trying multiple approaches and realizing that only using checked exceptions turned out to be a bit too inflexible. That there were legitimate reasons to use runtime exceptions.
Go’s type system is probably “good enough”. Sure, I’d love to have option types and results. And it would have been nice to move some of the things in vet, lint, staticcheck into the compiler. But in _practice_ separating them is actually beneficial. Because it allows you to trade build speed for security. For instance when you are making a tiny change and you just want to make sure it still builds. That’s a _practical_ tradeoff you could not have made if the compiler were always strict.
One thing I wish Go would have adopted is Javadoc-like comments with explicit markup to document parameters, return values and possibly panics. Those were _more_ useful in practice than exceptions in Java because you could force people to be more deliberate when designing “contracts”. When I did Java we used to have the build fail if classes and methods did not document all params, return values, exceptions etc.
I also taught people to write unit tests while _only_ looking at the Javadoc for what they were testing and notating at the code. Even after years of doing this, I’d regularly find that implementations didn’t behave as documented when writing tests. This made people care about interfaces/seams/APIs/contracts and spend less time obsessing over having the compiler save them from sloppiness. It put the developer in the driving seat rather than have them run behind the compiler and just nudging things into a state where it compiles. It helped people think more about why something failed from a design point of view rather than put all their faith in the tooling.
I think that’s the biggest mistake of Go: it doesn’t care about documentation and to the extent it does, it introduces really, really stupid, pointless formal rules that does nothing to help developers.
Comment by majormajor 17 hours ago
Especially as someone who's read a lot of code written by newcomers to Rust.
Comment by yoghurtwere 16 hours ago
Comment by rowanG077 14 hours ago
Comment by bayindirh 13 hours ago
Comment by maleldil 8 hours ago
This can't happen in Rust.
Comment by rowanG077 12 hours ago
``` package main
import ( "errors" "fmt" )
func getMessage() (string, error) { return "DO NOT INSPECT", errors.New("something went wrong") }
func main() { msg, _ := getMessage() // Ignore the error. fmt.Println(msg) } ```
Compiles normally and prints "DO NOT INSPECT"
Comment by bayindirh 12 hours ago
Don't make me spit my tea. That monitor is expensive. Of course, yes: https://git.sr.ht/~bayindirh/nudge
Jokes aside...
You used "_" to ignore the error variable, which I call "IDGAF" placeholder.
So, you willingly ignored the error and tell me that you don't have to check the error? You told the compiler that you don't care about the error explicitly (via "_"). That's on you then.
In my first comment I noted in the P.S. section:
...if you ignore the error, this is a deliberate choice and the burden is on the developer.
You used "_" knowingly. Compiler/linter didn't add it there by itself.I mean, do you even read the language documents to understand how a language works?
Comment by rowanG077 12 hours ago
package main
import ( "errors" "fmt" )
func getMessage() (string, error) { return "DO NOT INSPECT", errors.New("something went wrong") }
func main() { msg, err := getMessage() fmt.Println(msg) fmt.Println(err) }
Comment by bayindirh 13 hours ago
I have commented inside the code, but to recap here:
- If you don't declare err variable, the code won't compile.
- If you don't use err variable, the code won't compile again.
So, you need to both declare and use the err variable to be able to compile the code. So you can't forget. Your code will not compile.The only way to "forget" is to declare err as "_", which I call IDGAF placeholder, and this is a deliberate choice to ignore that variable. So you willingly and knowingly ignore the error variable.
Otherwise Go won't give you Go ahead.
Seriously, try to compile the example I have given. It's fresh, so hold with mittens.
Comment by vander_elst 9 hours ago
``` a, err := f() b, err := g() if err != nil {} c:=a+b ```
The language will happily build and run, even though it should prevent to let you shoot in the foot.
Comment by bayindirh 9 hours ago
In a little blunt form: This machine has no brain, use yours.
Comment by vander_elst 8 hours ago
I hope it's clear that what was proposed above is just a toy problem to show the issue. In complex parts of the code, unfortunately, these errors sometimes happen. That's a fact.
A programming language should actually try to protect you from some logic errors. This is why have we programming languages in the first place. Otherwise why bother with garbage collection, types etc? Should we just use assembly then for maximal flexibilty and putting all the burden on the programmer?
Comment by madeofpalk 9 hours ago
Go errors if you try to assign a number to a string, so it's clear there is some intention for the machine to catch when your brain makes a silly mistake.
Comment by bayindirh 9 hours ago
I can also think a couple of cases where I deliberately catch the error, but don't do anything on it explicitly, esp. if I'm talking with a buggy hardware. I'd still log the errors as INFOs or WARNs though. I have seen too many "task failed successfully" errors in my life.
Comment by resonious 22 hours ago
This is the same argument C (and Zig!) people have for manual memory management. You can avoid memory problems by being a good developer.
Comment by bayindirh 9 hours ago
On the other hand, Go explicitly warns and tries to prevent you from ignoring or not handling possible errors. This is a bit different than a happy C compiler which doesn't warn you about leaking memory.
Comment by yoghurtwere 16 hours ago
Comment by stefr- 13 hours ago
Comment by yoghurtwere 16 hours ago
I am skeptical about Go's error handling, but there are cases where it is desirable to return both a result and also an error, like returning what can be returned while warning users about any errors. That can be modeled in Rust and other languages as well, though it is the default for Go.
Comment by akerl_ 18 hours ago
Comment by kubb 14 hours ago
Comment by b7e7d855b448 1 day ago
Comment by TheDong 22 hours ago
Comment by inigyou 22 hours ago
Comment by TheDong 17 hours ago
I think that one is true. Like, if you're building something that is able to be successful despite having a poor type system, frequent panics, and difficult to correctly use concurrency primitives, Go is a great language for letting the lowest common denominator programmer be productive.
If you're building more serious software, then it can be a very bad tradeoff that destroys your company or product, but you know, that's true of a bunch of languages.
Comment by inigyou 10 hours ago
Comment by yoghurtwere 15 hours ago
Rust async has a bad reputation in Rust circles, due to difficulties like deadlocks and poisoning (also regarding the messy panic system Rust has).
> Rite of passage for a Rust developer is creating a deadlock through an if-statement.
Comment by TACIXAT 15 hours ago
Also, if error wrapping hurts you so much (I don't use it), just implement a project-specific error that works how you want. This could be something that is JSON serializable, that captures a line number at each return site, etc. It will take like 10 minutes to get your project's errors working exactly how you want.
My projects usually do -
log.SetFlags(log.LstdFlags | log.Lshortfile)
// ...
if err != nil {
log.Println(err)
return errors.New("Error doing the thing.")
}
That essentially logs a stack trace with line numbers up the whole error chain, each return adding the outer context. I only ever use errors.Is for os.ErrNotExist.Comment by wannabe44 7 hours ago
I think your error solution is good. But still it's a poor imitation of Exceptions wherein you have to capture the stack trace manually, possibly incuring a perf hit (haven't measured), and write handling code in every layer. Made worse by the fact that people return desperate errors for even precondition violations which should be panics.
Comment by hoppp 10 hours ago
2.That error handling is one of the best features. It makes me explicitly acknowledge the errors instead of letting them just happen. No error goes unnoticed!
Each if err != nil is an explicit reminder to check, do I need to clean up? Do I need to log this error to a file?
"And no more oh an error happened I wonder where"
With LLMs verbosity is not an excuse anymore. Just generate it and focus on other things then
Comment by msie 1 day ago
Comment by logicchains 1 day ago
found := false
for _, v := range s {
if v == needle {
found = true
break
}
}
Do you see it? It copies the v into a local variable, which could be tremendously wasteful if it's a large struct. You should instead be taking a pointer to s[i] and comparing the value there with `needle`.If you'd used `slices.Contains(s, needle)`, on the other hand, it could have such a performance bug in it and you'd never know.
Comment by kajman 1 day ago
Perhaps you're much better at programming than I am, but I prefer these semantics in a language because I figure they're much more likely to have been optimized empirically, support vectorization, and be less buggy than another rote loop I'm trying to speed through.
Comment by asdf88990 19 hours ago
Even when Russ Cox and Go team had come to term with reality and stopped pretending like we are in 70s still, these lot will move goalposts. It is a kind of psychosis and sycophancy that is beyond rational discourse.
Comment by pjmlp 13 hours ago
Comment by irq-1 23 hours ago
https://cs.opensource.google/go/go/+/refs/tags/go1.26.5:src/...
Comment by boredatoms 1 day ago
Comment by mathisfun123 1 day ago
wut...? the debate isn't between closed (incompetent) source and open (competent) source - the debate is between verbose language and expressive language.
Comment by Someone 1 day ago
Even if you prefer manually checking for errors after every call that might fail, I fail to see how one can love go’s verbosity. Compare go’s
foo, err := bar()
if err != nil {
return ERR;
}
with something like (hypothetical) foo := bar() ||| return ERR;
where the compiler, seeing that bar returns an Either<int,err> can enforce the presence of the ||| clause or, alternatively, require later code to check for errors if the ||| clause isn’t present. I think that’s both more robust (prevents one from forgetting to check for errors) and shorter (allowing for showing a lot more code on a screen or page)Comment by bborud 9 hours ago
While the first occupies more lines I suspect I’d spend less time spotting it in the code. The physical shape of the expression is something my brain is used to seeing after 40 years of programming. Even when code grows more complex.
The second is OK when it stands alone, but I am not so certain it would be as easy to spot in more complex surroundings. Even on a single line, there is something a bit ugly about the code. Even before we get to the desperate triple-pipe. That kind of reminds me of the desperate attempts at repairing JS after they realized its equality semantics were shot. Just heap more characters on it.
The thing is: it is actually very hard to judge how ergonomic a language is by just looking at it. You have to use it and you have to use it enough to realize where the paint points really are. I’ve read through a lot of the responses in this discussion and I’ll be honest: I think a lot of people who criticize other languages (be they Rust, C, Go or whatever) aren’t very fluent in them. It takes a couple of years to develop fluency.
Comment by mayama 17 hours ago
Comment by BobbyJo 23 hours ago
Comment by asdf88990 19 hours ago
Comment by BobbyJo 4 hours ago
Comment by thiht 11 hours ago
Comment by asdf88990 10 hours ago
Comment by thiht 7 hours ago
Comment by aaa_aaa 12 hours ago
Comment by eptcyka 1 day ago
Comment by sethammons 19 hours ago
foo := thinger()
_ = foo # no longer unused
Comment by jerf 1 day ago
Comment by ncruces 1 day ago
Which is a great way to make sure they're not overused, which in my experience is better than underuse.
Comment by vander_elst 9 hours ago
Comment by b7e7d855b448 8 hours ago
Comment by spockz 23 hours ago
My only wish is that go could become less verbose. There are several frontends to go that are more compact, compile down into golang, and then let you enjoy all the benefits.
Comment by gempir 1 day ago
Comment by jzelinskie 1 day ago
[0]: https://github.com/authzed/spicedb/tree/main/tools/analyzers
Comment by jamescun 1 day ago
You can see it's used by _a lot_ of linters already:
https://pkg.go.dev/golang.org/x/tools/go/analysis?tab=import...
Comment by eonwe 15 hours ago
Comment by bijowo1676 16 hours ago
The early loop looked like this:
/goal improve the perf by 20%
-> a great deal of plausible code
-> a confusing benchmark
-> another plausible patch
Later it looked like this: find the expensive work
-> explain why it happens
-> change one mechanism
-> compare with the previous Rust revision
-> test the complete application
-> retain, revise, or rejectComment by ksec 1 day ago
Comment by hxtk 1 day ago
Comment by ksec 7 hours ago
Comment by hoppp 1 day ago
Comment by mchav 1 day ago
Comment by fractorial 23 hours ago
Comment by verdverm 1 day ago
An example from one of my recent projects: https://github.com/verdverm/gmd/blob/main/Makefile (give agents simple "tool calls" instead of needing to divine the correct args/flags every time, essentially invocable agents.md content)
One of the interesting things to call out from this is using build tags for testing { unit, coverage, recorded, real api }, with the buffet allowing the agent to iterate faster and more targeted. I tend to run the linting and coverage in a new session, have a report generated, and then another fresh session to start dealing with gaps.
Another super cool testing tool in the Go internal source is `testscript`. Roger Peppe extracted a number of those internal utilities here https://github.com/rogpeppe/go-internal/tree/master/testscri...
Comment by greatsage_sh 19 hours ago
Comment by ridiculous_fish 15 hours ago
Comment by k9294 1 day ago
Comment by someworkk 1 day ago
Comment by neet_dev 21 hours ago
Comment by dfasifsaf 1 day ago
Comment by zikohh 1 day ago
Comment by zahlman 1 day ago