Hacker News Reader

See here[1]. From what I've gathered, you should set GOPRIVATE appropriately, otherwise the Go Module Mirror(s) and the Go Checksum Database(s) may know that you have a private repo called “github.com/you/very-private”. It could also probably reason about your dependencies a little bit.

[1]: https://tip.golang.org/cmd/go/#hdr-Module_configuration_for_...

View on HN

Yes, I don't mind if it shows up in the index. I have nothing to hide.

That just seems wasteful and clutterish. If too much of that occurs, the index could be littered with it. Sort of like old PGP keys that never go away.

In 10,000 years, the Go code will be lost, but bored future people will reconstruct it from its hash through shear brute force searching.

More seriously, if the hashes turn out to have serious security flaws, someone may be able to reconstruct the file someday.

> More seriously, if the hashes turn out to have serious security flaws, someone may be able to reconstruct the file someday.

Unlikely. The pidgeon-hole principle applies here, there are many equally likely Go source files that hash to the same thing (regardless of hash function).

The pigeon hole principle will find files that are not syntactically correct Go or of an unrealistic length unless there are really adversarially crafted inputs before the hash.

Reply on news.ycombinator.com