ulid VS logrus

Our Go ULID package has millisecond precision + monotonic random bytes for disambiguation while preserving ordering within the same millisecond. https://github.com/oklog/ulid

There is no "tests".

There is just a single test. Which only tests the decoding of a single known value. No encoding test.

Go has infrastructure for benchmarking and fuzzing. Use it!

Also, you took code from https://github.com/oklog/ulid/blob/main/ulid.go which has "Copyright 2016 The Oklog Authors" but this is not mentionned in your base32.go.

maybe because of dependencies: https://github.com/oklog/ulid/blob/main/go.mod ??

Universally Unique Lexicographically Sortable Identifier

I'm not concerned too much about the performance or the storage size at this stage. I've checked ulids before posting (more specifically https://github.com/oklog/ulid) but the only difference than a random string (especially if you use them with math.rand) is the timestamp prefix which makes them sortable, but I don't need that (users could use the internal SQLite rowid if they needed to sort by a primary key).

why are you using https://github.com/oklog/ulid to generate a cookie secret?

oklog/ulid to generate IDs. coreos/go-oidc for validating JWTs I get from auth. google/go-cmp for comparing structs in tests (unless the project is already using Testify). spf13/pflag because life's too short for Go's flag handling. getkin/kin-openapi for validating reqests/responses against my OpenAPI spec (in tests).

If you just want to roll with an off-the-shelf library, you can use ULID. There are tons of custom made *flake alternatives. If ULID doesn't fit your purposes, look for others.

It's some sort of logging system well explained by Alex Edwards in Let’s Go Further. As stated, we could have used logrus or any other popular logging system in Go.

Option 2, please. You may not have been around for the logrus debacle, but it was a giant pain.

For the example I’m using the very popular logrus library and then I’m setting the log formatter to be JSON

For choosing the candidates for the poll, I didn't do any thorough research. I was looking for a library to use in my project at work, and I ended up at sirupsen/logrus which was already being used by one of the dependencies in that project.

I contribute to OSS as part of my job on the regular. The company is good about contributing upstream, signing CLAs, and all that. We still work against private forks for two main reasons: 1. Some changes that we need are not accepted by maintainers based on philosophical or architectural reasons that we can’t otherwise work around. You’re beholden to then unless you publicly fork the repo which has other legal/PR overhead for the company and OSS political implications. 2. Maintainers in the past have taken down repos, renamed repos, or changed the licensing on repos that have left us in a lurch. We always build against our own private forks because we need predictability and can’t be beholden to some other party for business continuity. We sync them down from the public upstream at our leisure.

If they change the case on their username on the other hand, the Go ecosystem explodes: https://github.com/sirupsen/logrus/issues/570#issuecomment-3...

Like, for example, some projects importing logrus with a capital L and some with a lowercase L, and go modules having no way to reconcile the two: https://github.com/sirupsen/logrus/issues/553

Ugh. Wish people would stop using logrus. It’s in maintenance mode and slow, especially its stack tracing.