Comment by devsda | Hacker News Reader

Comment by devsda | Hacker News Reader

Link to the proposal behind this change:

https://go.googlesource.com/proposal/+/master/design/57001-g...

> Many people believe the go line in the go.mod file specifies which Go toolchain to use. This proposal would correct this widely held misunderstanding by making it reality.

That doesn't sound like a good reason to automatically download binaries and run them.

Is it difficult to update or install a new version of Go and are there frequent updates in Go spec introducing new features that it is necessary to auto install the compiler itself ?

Supply chain attacks are on rise and not a new concept and yet we see these changes.

This is not the first time Go lang has introduced a questionable opt-out feature [1]. They backed out but looks like there were no takeaways from that episode.

1. https://news.ycombinator.com/item?id=34771472

The binaries are fully reproducible from source[1] and are published in a transparency log to provide assurance that your go command is downloading the same binary as every other go command. This is state-of-the-art in preventing supply chain attacks and better than every other language.

[1] https://go.dev/rebuild

> Is it difficult to update or install a new version of Go

Go is the easiest language I know to build from source, let alone run a binary distribution.

As usual, Go team shows how much they have learned from the history of computing.

> are there frequent updates in Go spec introducing new features that it is necessary to auto install the compiler itself ?

From what I've seen, the need for frequent updates is more about keeping security scans happy.

Are you really surprised that people who explicitly refused to learn from 50 years of computer science and software engineering history are refusing to learn from their own mistakes, or even acknowledge them as such?

I'll be raising an issue with my distribution of choice to disable this behavior by default. They're the last line of defense for users' security and privacy, and we as an industry have been trying hard to circumvent them. Maybe precisely because of that reason, who knows.

Reply on news.ycombinator.com