Hacker News Reader

That's just the default, which you can easily override if you need to. IMO there is nothing wrong with treating Go package names as arbitrary identifiers like com.sun.* If you're spending a lot of time updating imports because the underlying repo has moved from its original URL, then just don't do that. It's unnecessary.

View on HN

And leave URLs to abandoned infrastructure all over the place? No thank you.

Sounds like classic developer OCD to me. Old URLs used as Go package identifiers are completely harmless.

Until your tooling automatically makes a request to a now-untrusted server and trusts its response...

The Go tooling won't do that if you configure it properly (e.g. via a 'replace' directive in your go.mod or https://go.dev/ref/mod#goproxy-protocol)

Any tool that automatically assumes that a URL in a Go module import is 'trusted' is just a broken tool.

And if any tooling ever gets executed without the proper replace directive...

Any tooling that looks at Go module imports should respect the contents of go.mod.

If you haven't added a replace directive to your go.mod, then you certainly haven't replaced all instances of the old URLs with updated ones.

Go mandates lockfiles, called go.sum

Reply on news.ycombinator.com