Comment by TheDong | Hacker News Reader

Comment by TheDong | Hacker News Reader

Parent Full thread

> This is the first language in my 23 years programming that reports my usage back to the language authors

I suppose that means you haven't used any of:

1. nodejs, which reports your usage back to npm Inc with the exact same amount of detail (names of dependencies, ip of caller) (and stores much more, since it publishes 'downloads per month', etc)

2. rust, which does the same with crates.io

3. perl, which does that with cpan

4. python, which does that with pypi

5. ... etc

All of those languages have a central registry of packages that has the same level of detail in the metadata it can potentially collect as the go proxy does.

> This "feature" should have an option to disable it.. at the very least.

It does. Multiple options. You can run your own proxy, disable it entirely, or opt out of the go mod experiment and never run go get, but rather vendor by hand with `git clone` or whatever.

> And the truth is, if this is ok to you, then there's really no limit what the code I write today, may report back to google tomorrow.

Very much a slippery slope. They've communicated clearly how to disable it and what it does, it's in-line with what other language ecosystems do in terms of metadata reported to a central package repository, and I think it's very easy for someone to be okay with this, but to not be okay with any step beyond this line.

If I download something from a server, of course that server knows what I downloaded.

This is different. It’s a proxy in front of others repositories. They want info on downloads from GitHub, gitlab, and anywhere else you get code from.

They (google) are a 3rd party to the download.

> This is different. It’s a proxy in front of others repositories

It's not all that different.

It's perfectly possible to use gems in ruby without ever using the rubygems server by setting every gem to be something like 'gem foo, :source = "https://github.com/foo/bar"'

However, people want to use this centralized repository in the ruby community because it allows for easily updating gems and for convenient caching.

The go proxy is not just a proxy. It also pre-parses out go.mod/go.sum to provide metadata faster and to provide security guarantees.

In a similar way to how centralized repositories are helpful in other languages, the go proxy adds actual legitimate features.

If you look at the public information on its development of this feature, all the motivations cited are about security, performance, and useful features, not information collection.

> This is different

There is a difference. Other repositories, like npm, require someone to opt-in to code being available via it (e.g. type `npm publish`, whether the publisher owns the package or not), while the go proxy default opts-in everyone that publishes a go package publicly and uses the newer go toolchain.

In practice, with how the npm/rubygems/etc communities work, everyone does opt-in if they wish their code to be publicly used, so the difference doesn't seem meaningful to me.

Other than that, the difference seems vanishingly small. In both cases, a 3rd party exists that serves downloads, and it exists to provide performance and discoverability benefits (with the go proxy also does due to supporting version-related operations), and in some cases security benefits.

They're offering a cryptographically signed mirror - the first mainstream one available. You can either run your own personal mirror, run one for your company, or turn it off.

> They're offering a cryptographically signed mirror - the first mainstream one available.

But why? Who asked for this??

There is a difference between npm, perl, and the others mentioned and Go. Go is Google with a diverse set of products and services. Many people who use Go build competitive services to Google.

What company is using python and building something in competition to the python software foundation? Or something for the others?

This difference is worth taking into account. If Go were part of a software foundation like Python this would be a different story.

So, the issue isn't the information sent back to the language maintainer, but the identity of the maintainer?

perl, which does that with cpan

CPAN doesn't do that, because CPAN is a series of mirrors that neither collect nor report aggregate download numbers.

Reply on news.ycombinator.com