The Hacker News thread about Go 1.24's crypto/fips140 module being validated by FIPS 140-3 is full of misconceptions and it's too exhausting to reply to them all.

https://go.dev/blog/fips140

https://news.ycombinator.com/item?id=44575607

Before I begin, don't call it "FIPS certified". You have "validated modules", not certifications. This isn't CompTIA.

Broadly speaking, FIPS module validation has very little to do with actual cybersecurity. FIPS doesn't make you more secure.

FIPS is the minimum bar you must clear in order to sell to US government customers. Some non-US entities also care about it, but mostly you only give a shit if you want to sell to the US gov.

If you don't care about that, you don't care about FIPS. You're free!

Most developers shouldn't care about FIPS.

The handful of developers that need to care about FIPS will be well-served by Go's crypto module being validated, as it provides a memory-safe implementation of these algorithms that isn't Java.

In short, FIPS ain't what many HN users think it is.