Tooling

If you work at a company that runs its own Go module proxy and you connect through a VPN, you’ve probably seen this: 1 2 Get "https://binaries.example.com/google.golang.org/grpc/@v/v1.77.0.mod": dial tcp 172.27.5.36:443: i/o timeout The module has nothing to do with your company. It’s a public dependency. Yet Go refuses to fetch it from the public proxy and just dies with a timeout. The frustrating part: you know proxy.golang.org has the module, and your config lists it as a fallback. So why doesn’t it fall through? ...

We all know better. Don’t hardcode secrets. Use a vault. Rotate your keys. We’ve been saying this for years. And then the agentic coding boom happened. Suddenly every tool wants an API key. OpenAI, Anthropic, Gemini, Groq, Mistral, Replicate—the list grows weekly. And where do those keys end up? Right there in .zshrc, in plain text, because you needed it working right now and you were going to fix it later. ...