Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Go 1.21.6 Released

go.dev

Post reply on HN
Print view View original

1–10 of 16 posts

Re: Go 1.21.6 Released

#2

Post by kramerger »

This is dot-dot release with just a few minor fixes. Not sure why it's on the front page, but since I have your attention... here something I noticed just the other day:

> the go command by default downloads and authenticates modules using the Go module mirror

Maybe I'm reading this incorrectly but it sounds as google will be able to see every dependency for every project I ever work on.

This is the second time Go adds something that can be used to spy on developers. Obviously they pinky promise to not abuse it, by why does this eventually happens to every Google product?

Re: Go 1.21.6 Released

#4

Post by dharmab »

kramerger wrote: post #2

This is dot-dot release with just a few minor fixes. Not sure why it's on the front page, but since I have your attention... here something I noticed just the other day: > the go command by default downloads and authenticates modules using the Go module mirror Maybe I'm reading this incorrectly but it sounds as google will be able to see every dependency for every project I ever work on. This is the second time Go ad…

The Python foundation can see all the dependencies you download from PyPI, and NPM can see all the dependencies you download from NPM/Yarn. This isn't unusual for a package manager.

If you prefer, you can run your own proxy and configure the Go command to use it instead.

Private modules don't use the mirror.

Re: Go 1.21.6 Released

#5

Post by kramerger »

dharmab wrote: post #4
kramerger wrote: post #2

This is dot-dot release with just a few minor fixes. Not sure why it's on the front page, but since I have your attention... here something I noticed just the other day: > the go command by default downloads and authenticates modules using the Go module mirror Maybe I'm reading this incorrectly but it sounds as google will be able to see every dependency for every project I ever work on. This is the second time Go ad…

The Python foundation can see all the dependencies you download from PyPI, and NPM can see all the dependencies you download from NPM/Yarn. This isn't unusual for a package manager. If you prefer, you can run your own proxy and configure the Go command to use it instead. Private modules don't use the mirror.

Unlike the ones you mentioned, Go doesn't have a central repository. The go.mod contains references to git repositories or local folders:

https://go.dev/doc/modules/gomod-ref

Not sure why a proxy is needed.

Re: Go 1.21.6 Released

#6

Post by dharmab »

kramerger wrote: post #5
dharmab wrote: post #4

Earlier quoted context omitted.

The Python foundation can see all the dependencies you download from PyPI, and NPM can see all the dependencies you download from NPM/Yarn. This isn't unusual for a package manager. If you prefer, you can run your own proxy and configure the Go command to use it instead. Private modules don't use the mirror.

Unlike the ones you mentioned, Go doesn't have a central repository. The go.mod contains references to git repositories or local folders: https://go.dev/doc/modules/gomod-ref Not sure why a proxy is needed.

It's needed to provide checksums for each module. It also significantly improves performance and prevents a left-pad situation.

https://go.dev/blog/module-mirror-launch

Re: Go 1.21.6 Released

#8

Post by kramerger »

dharmab wrote: post #6
kramerger wrote: post #5

Earlier quoted context omitted.

Unlike the ones you mentioned, Go doesn't have a central repository. The go.mod contains references to git repositories or local folders: https://go.dev/doc/modules/gomod-ref Not sure why a proxy is needed.

It's needed to provide checksums for each module. It also significantly improves performance and prevents a left-pad situation. https://go.dev/blog/module-mirror-launch

These are GIT repositories, they have their own cryptographically unique identifiers. No need to send your data to a third-party to get it confirmed.

Maybe I'm missing something, but this whole operation feels like a huge infrastructure paid by Google for something that is not needed.

Re: Go 1.21.6 Released

#9

Post by MCUmaster »

kramerger wrote: post #2

This is dot-dot release with just a few minor fixes. Not sure why it's on the front page, but since I have your attention... here something I noticed just the other day: > the go command by default downloads and authenticates modules using the Go module mirror Maybe I'm reading this incorrectly but it sounds as google will be able to see every dependency for every project I ever work on. This is the second time Go ad…

Ugh, more telemetry.

Re: Go 1.21.6 Released

#10

Post by ratorx »

kramerger wrote: post #8
dharmab wrote: post #6

Earlier quoted context omitted.

It's needed to provide checksums for each module. It also significantly improves performance and prevents a left-pad situation. https://go.dev/blog/module-mirror-launch

These are GIT repositories, they have their own cryptographically unique identifiers. No need to send your data to a third-party to get it confirmed. Maybe I'm missing something, but this whole operation feels like a huge infrastructure paid by Google for something that is not needed.

> cryptographically unique

Git uses SHA1 which is pretty far from cryptographically secure. It’s unlikely that’s the sole reason for having a separate checksum database though.

Post reply on HN