Articles

One package at a time, at the depth the package page does not have room for: the failure that prompted the design, the trade-off taken, and the boundary of what the code promises.

These were first published on tecnick.com and moved here in September 2026, so that the writing sits alongside the packages it describes. The old URLs redirect.

Overview

• Stop Rewriting Go Service Boilerplate : why the library exists and what a service lifecycle built on it looks like.

Reliability and Networking

• Exponential Backoff with Jitter in Go, Without the Overflow Footgun : the AWS jitter strategies, and the clamps that keep exponential growth from wrapping into a negative duration. Package: backoff.
• Between Two Attempts: What an HTTP Retry Loop Must Decide : judging the outcome, closing the body, replaying the request, honouring Retry-After, and knowing when to stop. Package: httpretrier.
• Observing Outbound HTTP in Go Without Disturbing It : a cloned request, a timeout timer tied to the response body, three-source trace IDs, redacted logs, and bounded debug dumps. Package: httpclient.
• Before the First Request and After the Last: a Go HTTP Server’s Edges : startup validation, a listener bound before serving, request contexts that survive shutdown, and the timeout lattice. Package: httpserver.
• A Reverse Proxy Is Defined by What It Refuses to Do : no followed redirects, no whole-request timeout, no base-path escapes, no 502 for a client that went away. Package: httpreverseproxy.
• A DNS-Caching Dialer for http.Transport in Go : ASCII-only host folding, single-flight caching, canonical dedup, family interleaving, rotation, and the attempt loop. Package: dnscache.
• From singleflight to a Production Cache: a Gap Analysis : TTL caching, context provenance, failure-anchored stale windows, and bounded eviction. Package: sfcache.
• A Distributed Lock in Go and MySQL, and Every Way the Session Can Betray You : a pinned connection, a bounded keep-alive, deadlock-free release, and what the lock cannot promise. Package: mysqllock.

Security

• The Life of a Password: Argon2id in Production with nurago : one password followed through minting, storage, verification, and parameter migration. Package: passwordhash.
• Checking Passwords Against Have I Been Pwned Without Leaking Them : what actually leaves the machine, what the padding hides, and why an unverifiable response must be an error. Package: passwordpwned.
• The Classic JWT Attacks, Addressed by Construction in Go : alg=none, RSA-to-HMAC confusion, unverified JSON, weak keys, oversized tokens, immortal sessions, and the structural property that answers each. Package: jwt.
• Redacting Secrets from Go Logs on a Performance Budget : a 256-entry byte-class table for speed, convergent and boundary-exact matching for safety. Package: redact.
• Filtering Untrusted Client Queries in Go: Threat Model First : bounded input, RE2 linear-time matching, exact int64 comparison past 2^53, and boxing-free in-place evaluation. Package: filter.

Logging and Observability

• A Production slog.Handler on Top of zerolog : extended syslog severities, open groups versus baked attributes, root trace IDs, pooled events, and the hazards of process-global state. Package: logsrv.

Data Structures and Encoding

• A Longest-Prefix Trie for Numeric Keys, in Six Design Questions : the fixed 10-slot child array, the packed match status, vanity letter folding, value ownership, and what O(k) covers. Package: numtrie.
• Packing an Entire Country Record into a Single uint64 : a full ISO 3166 record as a Reversible Numeric Composite Key, decoded with bit shifts. Package: countrycode.
• Random IDs in Go, Trap by Trap: UUIDv7 and Unbiased Random Strings : entropy budgeting in UUIDv7, rejection sampling, reader contracts, and allocation-free formatting. Package: random.
• Deriving a Fast Fixed-Width Hex Encoder in Go : from what encoding/hex does per byte to a branchless encoder on a 256-entry table. Package: uhex.

Longer form, elsewhere

• Building a Production REST API in Go : twenty parts building one service end to end, from net/http and the startup path through configuration, shutdown, middleware, the request lifecycle, connection pools, one complete feature, testing and deployment. It stays on tecnick.com, because it is a Go guide that happens to use nurago rather than a nurago guide.

• Stop Rewriting Go Service Boilerplate: Ship Production Go APIs Faster with nurago
• Exponential Backoff with Jitter in Go, Without the Overflow Footgun
• Between Two Attempts: What an HTTP Retry Loop Must Decide
• Observing Outbound HTTP in Go Without Disturbing It
• Before the First Request and After the Last: a Go HTTP Server's Edges
• A Reverse Proxy Is Defined by What It Refuses to Do
• A DNS-Caching Dialer for http.Transport in Go
• From singleflight to a Production Cache: a Gap Analysis
• A Distributed Lock in Go and MySQL, and Every Way the Session Can Betray You
• The Life of a Password: Argon2id in Production with nurago
• Checking Passwords Against Have I Been Pwned Without Leaking Them
• The Classic JWT Attacks, Addressed by Construction in Go
• Redacting Secrets from Go Logs on a Performance Budget
• Filtering Untrusted Client Queries in Go: Threat Model First
• A Production slog.Handler on Top of zerolog
• A Longest-Prefix Trie for Numeric Keys, in Six Design Questions
• Packing an Entire Country Record into a Single uint64
• Random IDs in Go, Trap by Trap: UUIDv7 and Unbiased Random Strings
• Deriving a Fast Fixed-Width Hex Encoder in Go