Earlier quoted context omitted.
> Putting domain names in import statements is a massive mistake. Why do you say that? I appreciate the lack of indirection.
Several reasons: 1. Finding dependencies with tooling now requires parsing code. Luckily Go's syntax is relatively simple and doesn't have conditional includes like C++ does but it'd be better if you could simply inspect a depedency configuration; 2. You're directly importing potentially untrusted code that will often be of the form "github.io/someuser/reponame" so you now have a depedency on some random user's secur…
3) we’re six versions into go.mod by default. Nobody has this problem anymore.
4) Just untrue. Go proxies have been by far the easiest thing to deploy and secure because they’re so transparent in the toolchain.