Hacker News Reader

Comment by leaveyou | Hacker News Reader

sorry for the slight off topic but I still don't understand what is the advantage of having the domain hard coded in the name of the module

go mod init example.com/hello

and also hardcoded in all the import statements

import "example.com/hello"

what if you move the code to other domain ? you need to change the module and all the references to it instead of only the references

I find it quite cumbersome/counter intuitive even after all these years.

View on HN

One big disadvantage of using the domain name in the module specification is, that as a package provider, you are kind of permanentely chained to the hosting provider of your choice, e.g. github.com. Moving your package would destroy its "identity".

It is bad enough how much of a monopoly and tie-in github today has (probably the reason Microsoft bought it) and a language environment shouldn't contribute or even aplify that role.

The alternative (as with e.g. npm) is being tied to the hosting provider for the package ecosystem. If you want to, you can use your own domain name for your Go package URL and then link it to a repo hosted elsewhere. There's really no namespace on the internet that you have a more permanent claim on than a domain that you yourself have registered.

In the case of npm you could also use something like Sonatype Nexus, push your packages to your own npm repository and install them with --registry or something like that: https://stackoverflow.com/a/35624145

Further discussion: https://stackoverflow.com/questions/40288843/installing-npm-...

It's just that most people don't do that, same as how most people will just store their code in GitHub.

You can host your own git repos too, if you want.

Yeah, I'm actually doing that with Gitea: https://about.gitea.com/

Some people went with the forgejo fork: https://forgejo.org/ though Gitea itself was a fork of Gogs, if I remember correctly: https://gogs.io/

I also ran GitLab in the past: https://about.gitlab.com/ but keeping it updated and giving it enough resources for it to be happy was troublesome.

There's also GitBucket: https://gitbucket.github.io/ and some other platforms, though those tend to be a little bit more niche.

Either way, there's lots of nice options out there, albeit I'd still have to admit that just using GitHub or cloud GitLab version would be easier for most folks. Convenience and all.

Not at all. If you just reference to a package by its name, that is good enough for a compiler. I think automatic download of packages from third party sites doesn't belong into a language and its native tooling. The downloading and installing of third party packages could be done by a tool provided together with the language core tools, but should not be required to be able to compile a project at all.

Strictly speaking, as with cargo/rustc, the Go module system and Go compiler are separate, and the latter can run without calling the former. There are various flags to tell the "go" command (which is a frontend to other tools) how to behave when modules are involved, e.g. so that it works well on airgapped networks and locked-down intranets or can be used safely with untrusted source. You can also still vendor modules to ensure they are locally available.

That's why there's https://go.dev/ref/mod#vcs-find . Your import path doesn't have to map directly to vcs repos, as long as you can serve an html meta tag to redirect it to where your current repo is:

    <meta name="go-import" content="root-path vcs repo-url">

Thanks for the link. When I started learning Go modules that spec was not available (or it was a lot smaller). After a brief look I feel the Go modules spec is longer and more complex than the (original) Go language spec which is quite ironic :-D. I still like Go although it's sad seeing it straying from the 'one true' path of simplicity.

It's a bit shorter than the current spec, but it does cover more: how it works conceptually, how the default toolchain works, and how it interacts with a lot of things outside of a world it creates on its own (which is what a language is).

But you can't serve this meta tag if you don't control the URL/domain anymore, and you can't force all of your users to use e.g. an intercepting HTTP proxy for such requests.

You need to plan for this up front, same as with deliberately uploading a package to a central repo.

> You need to plan for this up front

How exactly? If e.g. the registrar seizes the domain name that I've originally used and gives it to someone else, what, exactly, are my plans supposed to be for that?

The exact same as if npm did it.

The benefit is that you're not creating a new directory of names, they reuse an existing well established one.

Creating a central authority for names is a lot of work.

Im not that experienced with Go, but I believe it's possible to create a vanity package name on a domain you control. If you want to change hosts, you can just point your domain to something else.

I may be wrong there though!

Yes, if your module URL is on a site you control, you can serve a <meta name="go-import" ...> tag to redirect it to your source repo. The module URL is permanent but you can move the repo.

The go-import tag is documented here: https://go.dev/ref/mod#vcs-find

It's a bit more fiddly if your module is part of a monorepo and doesn't live at the root. In that case your go-import tag needs to point to a GOPROXY server. I have a proxy server here: https://github.com/more-please/more-stuff/tree/main/gosub

Indeed not creating a new directory of names is an advantage, plus it also means all the short names are effectively reserved for the standard library, and there's no scramble from developers to squat on all the "good" names.

Yep, it's unfortunately a bit hard to find, but it's well explained here:

https://pkg.go.dev/cmd/go#hdr-Remote_import_paths

Also AFAIK there's still no good UX for private packages that require auth.

An advantage is typo squatting gets eliminated (see js or python worlds for why this is an issue).

If you want to move to another domain the “go mod edit —replace” cli tool is designed for this.

If you want to host somewhere else, or maybe change to a vanity url or something, you can just publish a go-import meta tag and it all just works https://pkg.go.dev/cmd/go#hdr-Remote_import_paths

I don’t write go myself but man did they get a lot of big decisions right. I’d be totally open to writing go in future but I have java so don’t really need it. I envy go’s build and deploy stories though.

The obvious advantage of using domain names and in general URLs as the package names is that the Go project doesn't have to run a registry for package names. Running a registry is both a technical and especially a political challenge, as you must deal with contention over names, people trying to recover access to their names, and so on. By using URLs, the Go project was able to avoid touching all of those issues; instead they're the problem of domain name registries, code hosting providers, and so on.

I think that the domain is hard coded so you can import the module from any git repo and not depend on a central repository.

How many times does a module switch the domain? And in that case you can still search+replace over the whole project in one second. Non-issue.

I'm a simple man, I experiment a lot, I create a module locally and bam, straight from the beginning I have to decide where I will host this module and very often I don't want to make it public so I only keep it locally on my machine, but often I need to share my module among my several machines (laptop, mini desktop) but I still don't want to share with github publicly and it's annoying that there is no easy way to do this AFAIK. In a better world I would create a "module" in a folder, give it a symbolic name at most (like 'ShinyModule') and share it in various ways; like I could share the folder using samba, ftp, ftps, sftp, https and in the consuming side, you would just import 'ShinyModule' and have a single file per consuming module which says:

'ShinyModule' https://github.com/shinyAuthor/ShinyModule or

'ShinyModule' ../../ShinyModule or

'ShinyModule' \\something\something\ShinyModule

and if there is no 'download' description for an import, the default should be ..\ShinyModule relative to the current/importing module

And you can do all these things smoothly with rust's cargo: use a local relative path, use a git URL, or use a published package name. It's perfect if you want to try and hack around a dependency.

It's not because the tooling is better, which also happens to be true by far, but because they didn't tie themselves down to a domain name scheme. Funny, given that go waited a long time to take a shot.

Rust has a different problem: too many dead packages with desirable names on crates.io. There's a lot of derelict cruft in that shared namespace, especially for packages outside those most commonly used.

The company I am currently at has changed the domain name for the inner Gitlab server three times in two years. The older domain's are tentatively supported but they behave differently in respect to authorization so... we had to switch our imports whole-sale, or the builds would just keep breaking for no apparent reason.

I completely agree with this and this really smells of someone thinking about the problem for 3 seconds and moving on

It's the part of Go I find the weirdest

Node/Npn does this best.

Reply on news.ycombinator.com