> Literally what else could that man have done?
He could have not sent all build-time network accesses to Google by default. It's that simple.
He could have not sent all build-time network accesses to Google by default. It's that simple.
Why are you so upset that other people will be using a feature you obviously won't? Why are you upset when this leaks literally no info that your github repo doesn't already?
I bet the DB is small enough that you could default to just downloading it and syncing on your machine.
That's a conservative estimate, and if you try to sync only what's needed you're no better off then not-syncing.
If you try syncing the whole thing incrementally (rsync style) all you leak is the frequency of your updates
Care to maybe check real quick before making bets?
This makes sense right? Cargo, the rust package manager, does replicate the entire package index using git and it is ~250 MiB (~150MiB in .git/) (The cargo index stores much more metadata in a more verbose JSON format). It seems like a very reasonable bet considering prior art.
I get that Google changed the way go packages work, but I don't understand the difference between that and literally every package manager in existence.