> This seems worrisome for the privacy of builders. What if someone wishing to stay anonymous built and distributed a Go binary from a system where GOROOT inclu

> This seems worrisome for the privacy of builders. What if someone wishing to stay anonymous built and distributed a Go binary from a system where GOROOT included their home directory and revealed their identity? Am I misinterpreting something? Anyone who cares enough about this must be sure to use a nondescript username / path for creating binaries. Sniffing around for paths and filenames (and other compiler artifacts, like date/date formats/time zone/time of build, version numbers, locale/language markers, debug symbols, UUIDs, copyright strings, format strings) is an extremely well-known technique for investigating the origin of a suspect binary -- anyone who has ever heard of "malware attribution" is sure to know about this.