Yes, it's worrisome. An issue like this was brought up on golang-nuts in 2014 [1]; the response from the devs was that this behavior is intentional [2], and the

Yes, it's worrisome. An issue like this was brought up on golang-nuts in 2014 [1]; the response from the devs was that this behavior is intentional [2], and they note that this happens with other compilers as well. I'm attempting to say this without sounding facetious: it's generally bad for privacy if you install tools and compilers to a personally-identifiable path, compile programs from personally-identifiable directories, perhaps using personally-identifiable accounts. Using generic paths (which is in this case the Go default), generically-named work directories, and generic-sounding user accounts is a viable mitigation, that has been used by many programmers who get burned by this from various environments. As you suggest, perhaps there's an education gap here, because this is well-known by security professionals and intelligence services (like the CIA [3]), and less well-known by developers. Furthermore, most of these privacy-leaking behaviors are being (re-)discovered or discussed as a part of the 'reproducible builds' movement (like this one) to attempt to identify context-specific behavior, rather than a concentrated approach about privacy in particular. [1] https://groups.google.com/forum/#!topic/golang-nuts/oVDD8oPvDIY https://groups.google.com/forum/#!topic/golang-nuts/oVDD8oPv... [2] https://groups.google.com/d/msg/golang-nuts/oVDD8oPvDIY/fQ_r_gECFbUJ https://groups.google.com/d/msg/golang-nuts/oVDD8oPvDIY/fQ_r... [3] https://wikileaks.org/ciav7p1/cms/page_27721733.html https://wikileaks.org/ciav7p1/cms/page_27721733.html