The Regex Papers That Changed How People Think
In 2007, Cox published "Regular Expression Matching Can Be Simple And Fast" on his personal site. It was not a paper submitted to a conference. It was not reviewed by a committee. It was just a precise, beautifully written explanation of why most regex engines are dangerously slow - and how they don't have to be. The piece spread through the programming community the way good explanations always do: person by person, link by link, until it became required reading.
The series continued through 2012 - four articles in total, covering the virtual machine approach, automata theory, and real-world regex behavior. Today, those articles are cited in university courses, security research, and engineering onboarding documents. The writing is Cox at his most characteristic: no unnecessary words, no hand-waving, and the kind of worked examples that make a difficult concept click.
RE2, the library that emerged from this research, is the practical result. It's in use at Google, Cloudflare, and countless other organizations - not because it's faster than every alternative in every case, but because it's predictably fast. It eliminates the entire class of regex denial-of-service vulnerabilities by design. That is a security property, not a performance feature. Cox understood the difference.
Go's Compatibility Guarantee - The Underrated Masterwork
Most of the public conversation about Go focuses on goroutines, channels, and the recent addition of generics. Cox's contribution that may matter most over the long term is quieter: the Go 1 compatibility guarantee, which promises that programs written for Go 1.0 will continue to compile and run correctly in all future Go 1.x releases.
This sounds like a modest promise. It is not. Maintaining backward compatibility across a decade of language evolution requires constant discipline, careful tooling, and the willingness to tell people "no" when they propose changes that would break existing code. Cox led this effort for over a decade. The result is a language where upgrading the compiler is not a project - it is a Tuesday afternoon task.
He has spoken publicly about how the Go team tests compatibility: running every public Go module against new releases, catching regressions before they ship. This is not heroic. It is methodical. It is exactly the kind of work that never gets a TechCrunch article and keeps millions of production systems running.
Generics: The Long Wait Paid Off
Go's lack of generics was the community's longest-running complaint. Cox and the team were aware of the demand - he addressed it directly in his "The Future of Go" keynote at GopherCon 2017. The decision to wait was deliberate: the Go team wanted to understand the use cases before committing to a design, because a poorly designed generics system would be worse than none.
Go 1.18, released March 15, 2022, introduced generics using type parameters. It was Go's most significant language change since the original release. Cox framed it clearly: "Generics are the most significant change to Go since Go 1." The wait produced a design that fits Go's philosophy - powerful enough to eliminate significant boilerplate, restrained enough to keep code readable.
Supply Chain Security - Before It Was a Crisis
Long before the xz backdoor attack made supply chain security front-page tech news, Cox was writing and speaking about it. His 2019 piece "Surviving Software Dependencies" in Communications of the ACM laid out the risks of the open source dependency ecosystem with characteristic clarity. He co-authored research on Google's approach to supply chain security and presented at ACM SCORED 2023.
When the xz attack emerged in April 2024 - a sophisticated, years-long effort to insert a backdoor into a widely used compression library - Cox published one of the most detailed technical analyses of what happened, including a timeline and a line-by-line walkthrough of the attack shell script. It is the kind of writing that turns a frightening incident into teachable knowledge.
After Go: AI for the Maintainers Nobody Thinks About
When Cox stepped down as Go's technical lead in September 2024, he did not retire or shift to management. He started building something new. Gaby and Oscar are AI agent systems designed to help open source maintainers with the work that burns people out: triaging issues, identifying duplicates, managing the perpetual backlog of a popular project.
The first capability - automatically identifying similar issues when new ones are submitted - launched June 7, 2024. It uses Google's Gemini LLM and is described by Cox as currently the most impactful feature. The goal is not to replace human maintainers but to give them leverage over the parts of the job that are purely mechanical. This is classic Cox: identify the actual problem, build the minimal thing that addresses it, iterate from there.
His blog at research.swtch.com continues to publish original technical work. In January 2026, he published a series on floating-point formatting that covered Knuth's fixed-point printer, floating-point printing and parsing, and fast unrounded scaling. These are not hot topics. They are hard topics. Cox writes about them because they matter, and because he has thought about them more carefully than most.
