Go is not vulnerable in the same way software using webpki is, because it generally uses the system trust store. However, this change is about golang proactively blocking the certs, so that even if your OS doesn't update, it still won't trust them.
https://github.com/golang/go/issues/82345
In CVE-2026-111943: Compromised Intermediate Certificate Authoritygolang
go
Go2014–2026
golang / go
go
The Go programming language
1,181Distinct people
1,944Mentions
14Explicit recommenders
139.9KGitHub stars
What to know before exploring
What it is
The Go programming language
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
> To convert the Stream.Reader to an std.Io.Reader, we need to call its interface() method. To get a std.io.Writer from an Stream.Writer, we need the address of its &interface…
j1elo used a recommendation phrase. 14 indexed comments match. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- golang/proposal · linked in 12 of the same discussions
- rust-lang/rust · linked in 8 of the same discussions
- nodejs/node · linked in 5 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year1,944 dated mentions
Observed mentions: 2014-12-08 08:41:45 UTC to 2026-10-22 10:17:39 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 16 | 1 | 15 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 80 | 17 | 63 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 135 | 18 | 117 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 164 | 20 | 144 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 174 | 26 | 148 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 196 | 30 | 166 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 159 | 21 | 138 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 184 | 34 | 150 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 220 | 45 | 175 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 221 | 27 | 194 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 163 | 13 | 150 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 167 | 24 | 143 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 65 | 15 | 50 |
From the project README
An excerpt from the repository, fetched Nov 12, 2026.
Read the project’s introduction
The Go Programming Language
Go is an open source programming language that makes it easy to build simple,
reliable, and efficient software.
Gopher image by Renee French, licensed under Creative Commons 4.0 Attribution license.
Our canonical Git repository is located at https://go.googlesource.com/go.
There is a mirror of the repository at https://github.com/golang/go.
Unless otherwise noted, the Go source files are distributed under the
BSD-style license found in the LICENSE file.
Download and Install
Binary Distributions
Official binary distributions are available at https://go.dev/dl/.
After downloading a binary release, visit https://go.dev/doc/install
for installation instructions.
Install From Source
If a binary distribution is not available for your combination of
operating system and architecture, visit
https://go.dev/doc/install/source
for source installation instructions.
Contributing
Go is the work of thousands of contributors. We appreciate your help!
To contribute, please read the contribution guidelines at https://go.dev/doc/contribute.
Note that the Go project uses the issue tracker for bug reports and
proposals only. See https://go.dev/wiki/Questions for a list of
places to ask questions about the Go language.
Read the full README on GitHubWhat Hacker News says
1,944 sourcesGo will reject certificate chains containing eight distrusted SPKIs
139 points · Open discussionYes, because HTTP/2 in Go is significantly slower: https://github.com/golang/go/issues/47840
In Better HTTP/1 connection reuse in Go 1.27Alberto (https://github.com/golang/go/issues/81639#issuecomment-58553...) found only a 75kB difference between the 'bloat' and your proposed patch in a stripped binary; and Roland (https://github.com/golang/go/issues/81639#issuecomment-58402...) contended:
> the symbols in your tester2 program account for ~67kb out of a 2.3mb binary
OP did find a "600k difference" in an unstripped comparison but if binary size was critical enough that 600k was a big deal, I'd assume users would be stripping the binaries outright or using a different language (tinygo perhaps) if a <100kb diff was on their list of concerns.
In Golang: Crypto/fips140: do not bloat crypto code unnecessarilyGolang: Crypto/fips140: do not bloat crypto code unnecessarily
19 points · Open discussionOh, net/http recovers from a panic inside a handler and sends error 500. I don't know if that was always the default. Where I worked before, our own Go servers didn't recover, and it did cause outages.
This is kinda bad practice. Go and Rust panics are similar, they aren't exceptions that you can safely recover from. Say there's a panic in the middle of modifying some global state like a database connection. Hence complaints about the net/http recover like https://github.com/golang/go/issues/25245 . But I guess they decided it's worse to let servers crash from trivial mistakes.
In Java 27Proposal: Cmd/cgo: cgo without a C toolchain
2 points · Open discussionStill working on Go's http2 10 years later :)
Recently:
https://github.com/golang/go/commit/128a36cf0367c46daff2528d...
https://github.com/golang/go/commit/3c0665e551be23e62167f625...
In Tailcat – Like netcat, but over Tailscale’s data planeFor a TL;DR, most relevant comment is: https://github.com/golang/go/issues/76920#issuecomment-53103...
In Go 1.27Not mentioned: Floating-point parsing and formatting now uses Russ Cox's uscale algorithm.
https://research.swtch.com/fp
https://github.com/golang/go/blob/go1.27.0/src/internal/strc...
In Go 1.27Re unions:
https://github.com/golang/go/issues/76920
You might want to follow this proposal, if you aren't already. It's the most recent one, and it's supported by quite a few “core members” of the Go Team. I don't think it'll land in 1.28, but I like the fact that it's still a feature that's being actively discussed.
In Go 1.27This idea that they just caved and added them due to pressure is a false narrative invented by detractors like yourself. Here is a timeline if you're interested:
2009 Go released.
June 2010 https://github.com/golang/proposal/blob/master/design/15292/...
Jan 2011 https://github.com/golang/proposal/blob/master/design/15292-...
March 2011 https://github.com/golang/proposal/blob/master/design/15292/...
Oct 2013 https://github.com/golang/proposal/blob/master/design/15292/...
Dec 2013 https://github.com/golang/proposal/blob/master/design/15292/...
April 2016 https://github.com/golang/go/issues/15292
Aug 2018 https://github.com/golang/proposal/blob/master/design/go2dra...
Aug 2018 https://github.com/golang/proposal/blob/master/design/go2dra...
June 2020 https://go.dev/blog/generics-next-step
Jan 2021 https://github.com/golang/go/issues/43651
Jan
Read the rest
2021 https://github.com/golang/proposal/blob/master/design/43651-...
Feb 2021 Proposal accepted.
March 2022 Ships in Go 1.18.
You could criticize Go for moving too slow. But I'm pretty happy with the way they landed. They definitely don't feel bolted-on.
https://github.com/golang/go/issues/70811 Go moves slowly
In How Go detects struct copies with sync.noCopyA Proposal to Fix Go's Proposal Backlog
2 points · Open discussion> Then C# came and said
It's worse than that. The WASM GC standards team was warned in advance that the proposal wouldn't work for .NET, and they moved forward with it anyway:
https://github.com/WebAssembly/gc/issues/77
They were also warned about Go (though I'm not sure if they ever actually consulted with golang devs):
https://github.com/WebAssembly/gc/issues/36
More links:
https://github.com/dotnet/runtime/issues/94420
https://github.com/golang/go/issues/63904
In Windows 11's built-in Weather app wastes more than 1 GB of RAMShowing the 15 most recent of 1,944 sources. Enable JavaScript to search and browse every indexed mention.